INS §791.27: (a) A disability insurer that provides coverage for hospital, medical, or surgical expenses shall not release any information to an employer that would directly or indirectly indicate to the employer

(a) A disability insurer that provides coverage for hospital, medical, or surgical expenses shall not release any information to an employer that would directly or indirectly indicate to the employer that an employee is receiving or has received services from a health care provider covered by the plan unless authorized to do so by the employee. An insurer that has, pursuant to an agreement, assumed the responsibility to pay compensation pursuant to Article 3 (commencing with Section 3750) of Chapter 4 of Part 1 of Division 4 of the Labor Code, shall not be considered an employer for the purposes of this section. (b) Nothing in this section prohibits a disability insurer from releasing relevant information described in this section for the purposes set forth in Chapter 12 (commencing with Section 1871) of Part 2 of Division 1. (c) Nothing in this section prohibits a disability insurer from releasing relevant information described in this section for the purposes set forth in Section 10181.10.