(a) The following information received and records kept by the Department for purposes of administering this chapter are confidential and exempt from the Delaware Freedom of Information Act [Chapter 100 of Title 29], and not subject to disclosure to any individual or public or private entity, except as necessary for authorized employees of the State of Delaware to perform official duties pursuant to this chapter:

(1) Applications and renewals, their contents, and supporting information submitted by qualifying patients and designated caregivers, including information regarding their designated caregivers and physicians.

(2) Applications and renewals, their contents, and supporting information submitted by or on behalf of compassion centers and safety compliance facilities in compliance with this chapter, including their physical addressees.

(3) The individual names and other information identifying persons to whom the Department has issued registry identification cards.

(4) Any dispensing information required to be kept under § 4919A of this title or Department regulation shall identify cardholders and registered compassion centers by their registry identification numbers and not contain names or other personally identifying information.

(5) Any Department hard drives or other data-recording media that are no longer in use and that contain cardholder information must be destroyed. The Department shall retain a signed statement from a Department employee confirming the destruction.

(b) Nothing in this section precludes the following:

(1) Department employees shall notify law-enforcement about falsified or fraudulent information submitted to the Department if the employee who suspects that falsified or fraudulent information has been submitted.

(2) The Department shall notify state or local law-enforcement about apparent criminal violations of this chapter.

(3) Compassion center agents shall notify the Department of a suspected violation or attempted violation of this chapter or the regulations issued pursuant to it.

(4) The Department shall verify registry identification cards pursuant to 4921A of this title.

(5) The submission of the § 4922A of this title report to the legislature.

Information obtained pursuant to this chapter is subject to the same protections and penalties afforded other health information under the Health Insurance Portability and Accountability Act (HIPAA), 45 C.F.R. Part 160, 162 and 164.

78 Del. Laws, c. 23, § 1.