[§321-311.5] Epidemiologic investigations. (a) The department may conduct investigations to determine the nature and extent of diseases and injuries deemed by the department to threaten the public health and safety.

(b) Every person, health care provider, and medical facility shall provide the patient's name, the name of a minor patient's parent or guardian, address, telephone number, age, sex, race or ethnicity, clinical signs and symptoms, laboratory test results, diagnostic interview data, treatment provided, and the disposition of the patient when requested by an authorized representative of the director for the purpose of conducting such an investigation. The authorized representative may only view the limited portion of the patient's medical record which is directly relevant in time and scope to the subject of the investigation.

(c) No person, health care provider, or medical facility that provides information requested by an authorized representative of the director for the purpose of conducting an investigation under this section shall be held civilly or criminally liable for providing that information to the department.

(d) All information provided to the department under this section shall be kept strictly confidential, except as the director determines is necessary to protect the public health and safety. Access to confidential records shall be restricted to those individuals specifically authorized to participate in any given investigation. However, epidemiologic and statistical information with no individual identifying information may be released to the public. The identities of individuals whose medical records are investigated shall be disclosed only to those persons authorized by the director or the director's representative to conduct a specific investigation under this section or determined by the director to be necessary to protect the health and safety of the public. [L 1999, c 192, §2]