(1) Except as authorized in 50-16-529, 50-16-530, and 50-19-402 or as otherwise specifically provided by law or the Montana Rules of Civil Procedure, a health care provider, an individual who assists a health care provider in the delivery of health care, or an agent or employee of a health care provider may not disclose health care information about a patient to any other person without the patient's written authorization. A disclosure made under a patient's written authorization must conform to the authorization.
(2) A health care provider shall maintain, in conjunction with a patient's recorded health care information, a record of each person who has received or examined, in whole or in part, the recorded health care information during the preceding 3 years, except for a person who has examined the recorded health care information under 50-16-529 (1) or (2). The record of disclosure must include the name, address, and institutional affiliation, if any, of each person receiving or examining the recorded health care information, the date of the receipt or examination, and to the extent practicable a description of the information disclosed.