12-2324. Waiver; exception; penalties

A. The privilege prescribed in section 12-2323 does not apply to the extent the privilege is expressly waived by the owner or operator who prepared the audit report or caused the report to be prepared.

B. Disclosure of an audit report or any information generated by a health or safety audit does not waive the privilege, if the disclosure complies with any of the following:

1. Is made to address or correct a matter raised by the health or safety audit and is made only to:

(a) An individual employed by the owner or operator, including a temporary or contract employee.

(b) A legal representative of the owner or operator.

(c) An officer or director of the regulated facility or operation or a partner of the owner or operator.

(d) An independent contractor retained by the owner or operator, including the owner's or operator's independent external auditors.

2. Is made under the terms of a confidentiality agreement between the organization for whom the audit report was prepared or the owner or operator of the regulated facility or operation and any of the following:

(a) A partner or potential partner of the owner or operator of the regulated facility or operation.

(b) A transferee or potential transferee of the regulated facility or operation.

(c) A lender or potential lender for the regulated facility or operation.

(d) A state government official.

(e) A person or entity engaged in the business of insuring, underwriting or indemnifying the facility or operation.

3. Is made under a confidentiality agreement to a government official or agency by the organization for whom the audit report was prepared or by the owner or operator.

C. A party to a confidentiality agreement described in subsection B, paragraph 2 of this section who violates the confidentiality agreement is liable for damages caused by the disclosure and for any other penalties prescribed in the confidentiality agreement.

D. Information that is disclosed under subsection B, paragraph 3 of this section is confidential and shall not be disclosed. An entity, employee or official of this state who knowingly or intentionally discloses information in violation of this subsection is subject to sanctions as prescribed by the rules of civil procedure or to a civil penalty not to exceed ten thousand dollars. The lack of labeling may not be raised as a defense if the entity, employee or official knew or had reason to know that the document was a privileged audit report.

E. This section shall not be construed to circumvent the protections provided by federal or state law for individuals who disclose information to enforcement authorities.