[§323C-35] Disclosures for health oversight. (a) Any person may disclose protected health information to a health oversight agency for purposes of an oversight function authorized by law.

(b) For purposes of this section, the individual with authority to authorize the health oversight function involved shall provide to the person described in subsection (a) a statement that the protected health information is being sought for a legally authorized oversight function.

(c) Protected health information about an individual that was obtained under this section may not be used in, or disclosed to any person for use in, an administrative, civil, or criminal action or investigation directed against the individual unless the action or investigation arises out of and is directly related to:

(d) Protected health information disclosed for purposes of this section remains protected health information and shall not be further disclosed by the receiving health oversight agency, except as permitted under this section. [L 1999, c 87, pt of §2]