(1) A quality assurance committee may use or publish health care information only for the purpose of evaluating matters of medical care, therapy, and treatment and for research and statistical purposes.
(2) In any report or publication of findings and conclusions of a quality assurance committee, the committee or the members, agents, or employees of the committee may not disclose the name or identity of any patient whose medical records or other protected health information have been studied.
(3) A quality assurance committee and its members, agents, or employees shall protect the identity of any patient whose condition or treatment has been studied and may not disclose or reveal the name of any patient of a medical practice group.