(a) Protected health information collected by the Department of Health and Social Services or its agencies, the Maternal and Child Death Review Commission, the Child Protection Accountability Commission, and the Drug Overdose Fatality Review Commission shall be used solely for legitimate public health purposes.
(b) Nonidentifiable health information shall be used by the Department of Health and Social Services and its agencies whenever possible consistent with the accomplishment of legitimate public health purposes.
(c) Any use of protected health information permitted by this subchapter shall be limited to the minimum amount of information which the official using the information reasonably believes is necessary to accomplish the legitimate public health purpose.
(d) Protected health information shall not be used by the State for commercial purposes.
(e) Protected health information whose use no longer furthers the legitimate public health purpose for which it was acquired shall be expunged.