(b) The commissioner may only obtain enrollee information subject to the establishment of protocols that will ensure that such patient-specific information is not disclosed to third parties other than to entities serving as agents of the state for the purposes of quality assurance and oversight. Such protocols shall be developed in consultation with representatives of health maintenance organizations, health care provider organizations and consumer organizations and shall, where possible, include the development of a unique confidential identifier to be used in connection with patient-specific data. These protocols shall address issues relating to the collection, maintenance, and disclosure of such patient-specific information. Such protocols shall be promulgated as regulations, provided however, that protocols or regulations in use prior to the effective date of this subdivision shall remain in effect until the regulations developed hereunder are promulgated.
(c) In addition to any other sanction or penalty as provided by law, any employee of the department who willfully violates this regulation or any other rule or procedure pertaining to the disclosure of any material collected pursuant to this subdivision shall be deemed to have committed an act of misconduct and shall be disciplined in accordance with the provisions of the civil service law.