(1) A record for each person receiving services shall be diligently maintained by the community-centered board. The record must include, but not be limited to, information pertaining to the determination of eligibility for services and the individualized plan. The record is not a public record.

(2) Except as otherwise provided by law, all information obtained and any records prepared in the course of determining eligibility or providing services and supports pursuant to this article are confidential and subject to the evidentiary privileges established by law. The disclosure of this information and these records in any manner shall be permitted only:

(a) To the applicant or person receiving services, to the parents of a minor, to such person's legal guardian, and to any person authorized by the above named person;

(b) In communications between qualified professional personnel, including the board of directors of community-centered boards and service agencies providing services to persons with intellectual and developmental disabilities, to the extent necessary for the acquisition, provision, oversight, or referral of services and supports;

(c) To the extent necessary to make claims for aid, insurance, or medical assistance to which a person receiving services may be entitled, or to access services and supports pursuant to the individualized plan;

(d) For the purposes of evaluation, gathering statistics, or research when no identifying information concerning an individual person or family is disclosed. Identifying information is information which could reasonably be expected to identify a specific person and includes, but is not limited to, name, address, telephone number, social security number, medicaid number, household number, and photograph.

(e) To the court when necessary to implement the provisions of this article;

(f) To persons authorized by an order of court issued after a hearing, notice of which was given to the person, parents or legal guardian, where appropriate, and the custodian of the information;

(g) To the agency designated pursuant to 42 U.S.C. sec. 6012 as the protection and advocacy system for Colorado when:

(I) A complaint has been received by the protection and advocacy system from or on behalf of a person with an intellectual and developmental disability; and

(II) Such person does not have a legal guardian or the state or the designee of the state is the legal guardian of such person;

(h) To the state department or its designees as deemed necessary by the executive director to fulfill the duties prescribed by this article.

(3) Nothing in this section shall be construed to limit access by a person receiving services to such person's records.

(4) Nothing in this section shall be construed to interfere with the protections afforded to a person under the federal "Health Insurance Portability and Accountability Act of 1996", 42 U.S.C. sec. 1320d, and the federal "Family Educational Rights and Privacy Act of 1974", 20 U.S.C. sec. 1232g.