1. Any person who, in the ordinary course of business, practice of a profession or rendering of a service, creates, stores, receives or furnishes genetic information, as such term is defined in subdivision (3) of section 375.1300, shall hold such information as confidential medical records and shall not disclose such genetic information except pursuant to written authorization of the person to whom such information pertains or to that person’s authorized representative. The requirements of this section shall not apply to:

(1) Statistical data compiled without reference to the identity of an individual;

(2) Health research conducted in accordance with the provisions of the federal common rule protecting the rights and welfare of research participants (45 C.F.R. § part 46 and 21 C.F.R. § part 50 and 56), or to health research using medical archives or databases in which the identity of individuals is protected from disclosure by coding or encryption, or by removing all identities;

(3) The release of such information pursuant to legal or regulatory process; or

(4) The release of such information for body identification.

2. If the director determines that a person has engaged, is engaging in, or has taken a substantial step toward engaging in an act, practice or course of business constituting a violation of this section or a rule adopted or order issued pursuant thereto, or that a person has materially aided or is materially aiding an act, practice, omission, or course of business constituting a violation of this section or a rule adopted or order issued pursuant thereto, the director may issue such administrative orders as authorized under section 374.046. A violation of any of these sections is a level two violation under section 374.049.

3. If the director believes that a person has engaged, is engaging in, or has taken a substantial step toward engaging in an act, practice or course of business constituting a violation of this section or a rule adopted or order issued pursuant thereto, or that a person has materially aided or is materially aiding an act, practice, omission, or course of business constituting a violation of this section or a rule adopted or order issued pursuant thereto, the director may maintain a civil action for relief authorized under section 374.048. A violation of any of these sections is a level two violation under section 374.049.