CA AB1830

Authorizes the California Health Benefit Exchange to use or disclose personally identifiable information only to the extent necessary to carry out functions specified under federal regulations (45 C.F.R. Section 155.200 and 155.260).

Requires the Exchange to establish and implement privacy and security standards consistent with federal principles and to execute contracts with non-Exchange entities that include specific privacy protections and require binding downstream entities to the same standards.

Prohibits contractors, subcontractors, volunteers, and vendors of the Exchange from using or disclosing personally identifiable information beyond what is necessary to perform their duties, with exceptions for covered entities under HIPAA.

Establishes that federal tax return information must be kept confidential and used only in accordance with Internal Revenue Code Section 6103.

Imposes civil penalties of up to $25,000 per individual or entity per use or disclosure for knowing and willful violations of the disclosure provisions.