Section 23. (a) Except as otherwise provided in this section, all records containing personal data which are created, collected, used, maintained or disseminated pursuant to this chapter shall not be public records, and shall be governed by the provisions of chapter sixty-six A, the notice provisions of section sixty-three of chapter thirty and the enforcement provisions of section three B of chapter two hundred and fourteen.

(b) If the department, any designated agency, or any other agency obligated to make an assessment under this chapter determines that the allegations in a report cannot be substantiated, it shall within 3 years of such determination, either (i) destroy said report and any other records containing personal data created because of the receipt of said report or (ii) physically remove therefrom all personal identifiers; provided, however, that the department, the designated agency or any other agency obligated to make assessments may create and hold whatever statistical records it needs for purposes of planning and reporting, as may be prescribed by regulations adopted by the department pursuant to section two of chapter thirty. Each government agency shall promulgate regulations prescribing the manner of creating and holding its own such statistical records, and the department shall adopt such regulations for itself and any designated agency. Each government agency shall annually report such statistical records to the executive office of elder affairs.

(c) The department, any designated agency, or any other agency obligated to make an assessment under this chapter shall inform in writing an individual, upon his request, whether he is a data subject, as that term is defined in section one of chapter sixty-six A, with respect to records created or maintained under this chapter, and if so, the department or agency shall make such data fully available to him or his authorized representative, upon his request, in a form comprehensible to him, unless doing so is prohibited or excused under the provisions of this or any other statute. In making any disclosure or information to a data subject the department or agency may remove personal identifiers relating to a third person, except where such third person is an officer or employee of a government or non-governmental department or agency obligated to make assessments under this chapter.

(d) Any agent or employee of the department, a designated agency, or any other agency obligated to make an assessment under this chapter who violates the provisions of chapter sixty-six A, as modified by this section, with respect to records created or maintained under this chapter shall be punished by a fine of not more than five hundred dollars, or, if harm shall have resulted to any one whose privacy was sought to be protected by the provision violated, by a fine of not more than one thousand dollars, and, if such agent or employee is employed by the commonwealth, he shall also be subject to administrative disciplinary action pursuant to regulations adopted by the department or agency under section two of chapter thirty A.

(e) No provision of chapter sixty-six A, section one hundred and thirty-five of chapter one hundred and twelve or this section relating to confidential data or confidential communications shall prohibit the department or designated agency from making reports to the district attorney under subsection (b) of section sixteen or subsection (a) of section eighteen, or from providing in such reports to the district attorney any information obtained by the department or a designated agency under section fifteen or section eighteen. No person providing notification or information to a district attorney or testimony in court pursuant to the provisions of this subsection shall be liable in any civil or criminal act by reason of such action.

Nothing herein shall be construed to limit the prosecutorial power of a district attorney.

No provision of chapter sixty-six A, section one hundred and thirty-five of chapter one hundred and twelve, or any other provision of law relating to confidential data or confidential communications shall prohibit the department, by its appropriate employees, or any designated protective services agency, by its appropriate employees from testifying in any judicial proceeding pursuant to subsections (a) and (b) of section twenty, chapter two hundred and one, or chapter two hundred and nine A where the employee has acquired the information which is the subject of his testimony while conducting an assessment in accordance with section eighteen. Such testimony shall not include the identity of the reporter of abuse under section fifteen.