HSC § 11306

(a) A government agency, controlled substances checking service provider, or agent thereof, shall not collect, maintain, use, or disclose any personal information relating to an individual from whom the agency receives a controlled substance or controlled substance analog for checking or disposal and shall not provide this information to law enforcement.

(b) Notwithstanding subdivision (a), collection and disclosure of aggregate information that is not linked to an individual and does not contain a personal identifier may be released to clinicians, public health officials, researchers, or other local and state agencies as requested and may be stored or uploaded onto an internet website.