Each utilization review organization shall have written procedures for assuring that patient-specific information obtained during the process of utilization review will be:
(a) Kept confidential in accordance with applicable federal and state laws; and
(b) used solely for the purposes of utilization review, quality assurance, discharge planning and catastrophic case management.