(1) Information about patients received by persons employed by, or providing services to, a home health agency or received by the licensing agency through reports or inspection shall be confidential and exempt from the provisions of s. 119.07(1) and shall only be disclosed to any person, other than the patient, as permitted under the provisions of 45 C.F.R. ss. 160.102, 160.103, and 164, subpart A, commonly referred to as the HIPAA Privacy Regulation; except that clinical records described in ss. 381.004, 384.29, 385.202, 392.65, 394.4615, 395.404, 397.501, and 760.40 shall be disclosed as authorized in those sections. (2) This section does not apply to information lawfully requested by the Medicaid Fraud Control Unit of the Department of Legal Affairs.
