There is hereby recognized a patient's right of privacy in the content of a patient's record and communications between a patient and a health care provider with regard to mental health or chemical dependency.
(1) An insurer may request the provider to furnish the insurer only such limited information concerning the patient from a patient's record as is necessary for determining covered services and benefits, medical necessity, appropriateness, and quality of care for authorization or continuation of mental health and chemical dependency health services to be provided to the patient, or for payment for those services.
(2) No third party to whom disclosure of patient records is made by a provider may redisclose or otherwise reveal the mental health and chemical dependency records of a patient, beyond the purpose for which the disclosure was made, without first obtaining the patient's specific written consent to the redisclosure.