Iowa Code Title VI. Human Services [Chs. 216-255A] § 228.7. Disclosures for claims administration and peer review--safeguards--penalty

a. Instruct its employees and agents to maintain the confidentiality of mental health information and of the penalty for unauthorized disclosure.

b. Comply with the limitations on use and disclosure of the information specified in subsection 2 of this section.

c. Destroy the information when it is no longer needed for the purposes specified in subsection 2 of this section.

2. a. An employee or agent of a third-party payor or of a peer review organization shall not use mental health information or disclose mental health information to any person, except to the extent necessary to administer claims submitted or to be submitted for payment to the third-party payor, to conduct a utilization and quality control review of mental health care services provided or proposed to be provided, to conduct an audit of claims paid, or as otherwise authorized by law.

b. Employees of a self-insured employer, and agents of a self-insured employer which have not filed a statement with the commissioner of insurance pursuant to subsection 1, shall not be granted routine or ongoing access to mental health information unless the employees or agents have signed a statement indicating that they are aware that the information shall not be used or disclosed except as provided in this subsection and that they are aware of the penalty for unauthorized disclosure.