(a) Each managed care organization shall conform to all applicable state and federal antidiscrimination and confidentiality statutes, shall ensure that the confidentiality of specified enrollee patient information and records in its custody is protected, and shall have written confidentiality policies and procedures.
(b) No managed care organization shall sell, for any commercial purpose the names of its enrollees or any identifying information concerning enrollees.