A. A person who obtains communicable disease related information in the course of providing a health service or obtains that information from a health care provider pursuant to an authorization shall not disclose or be compelled to disclose that information except as authorized by state or federal law, including the health insurance portability and accountability act privacy standards (45 Code of Federal Regulations part 160 and part 164, subpart E), or pursuant to the following:

1. 1. The protected person or, if the protected person lacks capacity to consent, the protected person's health care decision maker.
2. 2. A health care provider or first responder who has had an occupational significant exposure risk to the protected person's blood or bodily fluid if the health care provider or first responder provides a written request that documents the occurrence and information regarding the nature of the occupational significant exposure risk and the report is reviewed and confirmed by a health care provider who is both licensed pursuant to title 32, chapter 13, 14, 15 or 17 and competent to determine a significant exposure risk. A health care provider who releases communicable disease information pursuant to this paragraph shall provide education and counseling to the person who has had the occupational significant exposure risk.
3. 3. The department or a local health department for purposes of notifying a Good Samaritan pursuant to subsection E of this section.
4. 4. An agent or employee of a health facility or health care provider to provide health services to the protected person or the protected person's child or for billing or reimbursement for health services.
5. 5. A health facility or health care provider, in relation to procuring, processing, distributing or using a human body or a human body part, including organs, tissues, eyes, bones, arteries, blood, semen, milk or other body fluids, for use in medical education, research or therapy or for transplantation to another person.
6. 6. A health facility or health care provider, or an organization, committee or individual designated by the health facility or health care provider, that is engaged in the review of professional practices, including the review of the quality, utilization or necessity of medical care, or an accreditation or oversight review organization responsible for the review of professional practices at a health facility or by a health care provider.
7. 7. A private entity that accredits the health facility or health care provider and with whom the health facility or health care provider has an agreement requiring the agency to protect the confidentiality of patient information.
8. 8. A federal, state, county or local health officer if disclosure is mandated by federal or state law.
9. 9. A federal, state or local government agency authorized by law to receive the information. The agency is authorized to redisclose the information only pursuant to this article or as otherwise allowed by law.
10. 10. An authorized employee or agent of a federal, state or local government agency that supervises or monitors the health care provider or health facility or administers the program under which the health service is provided. An authorized employee or agent includes only an employee or agent who, in the ordinary course of business of the government agency, has access to records relating to the care or treatment of the protected person.
11. 11. A person, health care provider or health facility to which disclosure is ordered by a court or administrative body pursuant to section 36-665.
12. 12. The industrial commission of Arizona or parties to an industrial commission of Arizona claim pursuant to section 23-908, subsection D and section 23-1043.02.
13. 13. Insurance entities pursuant to section 20-448.01 and third-party payors or the payors' contractors.
14. 14. Any person or entity as authorized by the patient or the patient's health care decision maker.
15. 15. A person or entity as required by federal law.
16. 16. The legal representative of the entity holding the information in order to secure legal advice.
17. 17. A person or entity for research only if the research is conducted pursuant to applicable federal or state laws and regulations governing research.
18. 18. A person or entity that provides services to the patient's health care provider, as defined in section 12-2291, and with whom the health care provider has a business associate agreement that requires the person or entity to protect the confidentiality of patient information as required by the health insurance portability and accountability act privacy standards (45 Code of Federal Regulations part 164, subpart E).
19. 19. A county medical examiner or an alternate medical examiner directing an investigation into the circumstances surrounding a death pursuant to section 11-593.

C. A state, county or local health department or officer may disclose communicable disease related information if the disclosure is any of the following:

1. 1. Specifically authorized or required by federal or state law.
2. 2. Made pursuant to an authorization signed by the protected person or the protected person's health care decision maker.
3. 3. Made to a contact of the protected person. The disclosure shall be made without identifying the protected person.
4. 4. Made for the purposes of research as authorized by state and federal law.
5. 5. Made to a nonprofit health information organization as defined in section 36-3801 that is designated by the department as this state's official health information exchange organization.