Except as necessary for treatment, payment, or health care operations, a carrier providing health insurance benefits coverage under this chapter may not disclose identifiable or unidentifiable insured or provider data or information to a related or unrelated health care delivery entity. The board may establish exceptions to the disclosure limitations under this section for the limited purpose of addressing public interest and benefit activities; for the limited purpose of addressing research, public health, or health care operations; or for the solicitation of bids pursuant to section 54-52.1-04. An exception established by the board under this section may not be more permissive than allowed under state and federal privacy laws.