(a) General rule.--Except as provided for in this section, all working papers, recorded information, documents and copies of working papers, recorded information and documents produced by, obtained by or disclosed to the department or any other person in the course of exercising the department's powers and duties under this chapter:

(1) shall be confidential;

(2) shall not be subject to subpoena;

(3) shall not be subject to the act of February 14, 2008 (P.L.6, No.3), known as the Right-to-Know Law;

(4) shall not be subject to discovery or admissible in evidence in any private civil action; and

(5) may not be made public by the department or any other person.

(b) Personal health and financial information.--The department shall protect personally identifiable health and financial information in accordance with Federal and State laws and regulations, including the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191, 110 Stat. 1936), the Health Information Technology for Economic and Clinical Health Act (Public Law 111-5, 123 Stat. 226-279 and 467-496) and implementing regulations.

(c) Information disclosure.--Subject to the confidentiality provisions of this section:

(1) Information shall be shared as follows:

(i) Between the department and the Centers for Medicare and Medicaid Services for purposes of compliance with the Federal acts.

(ii) Between the department and each insurer participating in the reinsurance program.

(iii) Between the department and the exchange authority.

(2) Information may be disclosed as follows:

(i) As necessary to comply with the audit requirements of section 9508 (relating to annual audit) and the reporting requirements of section 9509 (relating to annual report of operations), only in an aggregated and de-identified form.

(ii) In any circumstance other than as described in paragraph (1) or subparagraph (i), only if the prior written consent of the company or person to which the information pertains is obtained.

(d) Construction.--Nothing in this section shall be construed to prohibit the department from accessing the information reasonably required to carry out its responsibilities in accordance with law.