Subd. 1. Written procedures to ensure confidentiality.

A utilization review organization must have written procedures for ensuring that patient-specific information obtained during the process of utilization review will be:

1. (1) kept confidential in accordance with applicable federal and state laws;
2. (2) used solely for the purposes of utilization review, quality assurance, discharge planning, and case management; and
3. (3) shared only with those organizations or persons that have the authority to receive such information.

Subd. 2. Summary data.

Summary data is not subject to this section if it does not provide sufficient information to allow identification of individual patients.