An agency may disclose personal information to the University of California or a nonprofit entity conducting scientific research, provided the request for information is approved by the Committee for the Protection of Human Subjects (CPHS) for the California Health and Human Services Agency (CHHSA) or an authorized institutional review board.