1. An insurance company, as defined in section 26.1-02-01, health maintenance organization, or any other entity providing a plan of health insurance subject to state insurance regulation may not deliver, issue, execute, or renew a health insurance policy or health service contract unless confidentiality of medical information is assured pursuant to this section. An insurer shall adopt and maintain procedures to ensure that all identifiable information maintained by the insurer regarding the health, diagnosis, and treatment of persons covered under a policy or contract is adequately protected and remains confidential in compliance with all federal and state laws and regulations and professional ethical standards. Unless otherwise provided by law, any data or information pertaining to the health, diagnosis, or treatment of a person covered under a policy or contract, or a prospective insured, obtained by an insurer from that person or from a health care provider, regardless of whether the information is in the form of paper, is preserved on microfilm, or is stored in computer-retrievable form, is confidential and may not be disclosed to any person except:

a.    If the data or information identifies the covered person or prospective insured upon a written, dated, and signed approval by the covered person or prospective insured, or by a person authorized to provide consent pursuant to section 23-12-13 for a minor or an incapacitated person; b.    If the data or information identifies the health care provider upon a written, dated, and signed approval by the provider. However, this subdivision may not be construed to prohibit an insurer from disclosing data or information pursuant to chapter 23-01.1 or from disclosing, as part of a contract or agreement in which the health care provider is a party, data or information that identifies a provider as part of mutually agreed-upon terms and conditions of the contract or agreement; c.    If the data or information does not identify either the covered person or prospective insured or the health care provider, the data or information may be disclosed upon request for use for statistical purposes or research; d.    Pursuant to statute or court order for the production or discovery of evidence; or

e.    In the event of a claim or litigation between the covered person or prospective insured and the insurer in which the data or information is pertinent.

2.    An insurer may claim any statutory privileges against disclosure that the health care provider who furnished the information to the insurer is entitled to claim.

3.    This section may not be construed to prevent disclosure necessary for an insurer to conduct utilization review or management consistent with the standards imposed by chapter 26.1-26.4, to facilitate payment of a claim, to analyze health plan claims or health care records data, to conduct disease management programs with health care providers, or to reconcile or verify claims under a shared risk or capitation arrangement. This section does not apply to data or information disclosed by an insurer as part of a biomedical research project approved by an institutional review board established under federal law. Nor may this section be construed to limit the insurance commissioner’s access to records of the insurer for purposes of enforcement or other activities related to compliance with state or federal laws; however, medical records acquired by the commissioner as part of an examination of an insurer’s business practices under section 26.1-03-19.2 or any other regulatory action or proceeding commenced by the commissioner are confidential.