All applications and requests for admission and release, and all certifications, records, and reports of the Cabinet for Health and Family Services which directly or indirectly identify a patient or former patient or a person whose hospitalization has been sought, shall be kept confidential and shall not be disclosed by any person, except insofar as:
(1) The person identified or his guardian, if any, shall consent; or (2) Disclosure may be necessary to carry out the provisions of the Kentucky Revised Statutes, and the rules and regulations of cabinets and agencies of the Commonwealth of Kentucky; or (3) Disclosure may be necessary to comply with the official inquiries of the departments and agencies of the United States government; or (4) Disclosure may be necessary for:
(a) Treatment of the patient by any health care provider involved in the patient's care;
(b) Treatment, payment, or health care operations under the federal Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, including disclosure between health care providers through an electronic health information exchange or network; or (c) Participation by health care providers through an electronic health information exchange or network for the purpose of meeting the requirements of the American Recovery and Reinvestment Act of 2009, Pub. L. No. 111-5, and its related federal regulations; or (5) A court may direct upon its determination that disclosure is necessary for the conduct of proceedings before it and failure to make such disclosure would be contrary to the public interest. Nothing in this section shall preclude the disclosure, upon proper inquiry of the family or friends of a patient, of information as to the medical condition of the patient.