(a) The director, any employee of the Department of Health and Human Resources, or any individual, business entity or government entity with which the director enters into an agreement under subdivision (3), subsection (k), section 5 of this article, shall not release information collected pursuant to this article concerning a specific building used as a private residence or the real property upon which it is located to anyone other than the owner or occupant of the building or real property without his or her consent: Provided, That the director may release information if he or she determines that the release is necessary for use in conducting legitimate scientific studies or the information is released in summary statistical or other form that does not reasonably tend to disclose the address of the building or real property or the identity of the owner or occupant.
(b) The division of health shall maintain information pursuant to this article and the rules adopted under this article for at least three years. The division may destroy any information that it has maintained for three years.