[§440J-3]  Confidential information.  (a)  Notwithstanding chapter 92F, statements and reports provided to the department pursuant to section 440J-2, and the data contained therein, shall be kept confidential; provided that the department may disclose mapping information and data aggregated to the extent necessary in the director's discretion to prevent identification of a provider with the specific data furnished by that provider.

     (b)  Unless otherwise provided by law, the department shall be prohibited from:

     (1)  Using the information furnished or obtained for any purpose other than the purposes for which it is supplied; and

     (2)  Making any publication whereby the data furnished by any person can be identified.

     (c)  The department shall:

     (1)  Ensure the security and confidentiality of the information;

     (2)  Protect against any anticipated threats or hazards to the security or integrity of the information; and

     (3)  Protect against unauthorized access to or use of the information that could result in personal or competitive harm to individuals or providers. [L 2012, c 259, pt of §2]