(a) Prescription information submitted to the Department of Health under this subchapter is confidential and not subject to the Freedom of Information Act of 1967, § 25-19-101 et seq.

(b)

(1) The controlled substances database created in this subchapter and all information contained in the controlled substances database and any records maintained by the Department of Health or by an entity contracting with the Department of Health that is submitted to, maintained, or stored as a part of the controlled substances database is privileged and confidential, is not a public record, and is not subject to subpoena or discovery in a civil proceeding.

(2) Information in the controlled substances database may be accessed by:

(A) A certified law enforcement officer pursuant to a criminal investigation but only after the law enforcement officer obtains a search warrant signed by a judge that demonstrates probable cause to believe that a violation of federal or state criminal law has occurred, that specified information contained in the database would assist in the investigation of the crime, and that the specified information should be released to the certified law enforcement officer;

(B) A regulatory body engaged in the supervision of activities of licensing or regulatory boards of practitioners authorized to prescribe or dispense controlled substances;

(C) A person or entity investigating a case involving breaches of privacy involving the database or its records;

(D) A certified law enforcement prescription drug diversion investigator of a qualified law enforcement agency;

(E) A practitioner within the Arkansas Medicaid prescription drug program; or

(F) The Department of Human Services or the Crimes Against Children Division of the Department of Arkansas State Police if:

(i) The purpose of the database access is related to an investigation under the Child Maltreatment Act, § 12-18-101 et seq., and not pursuant to a criminal investigation by a certified law enforcement officer; and

(ii) The Department of Human Services has obtained a circuit court order to access the database under § 12-18-622.

(c) This section does not apply to information, documents, or records created or maintained in the regular course of business of a pharmacy, a medical, dental, optometric, or veterinary practitioner, or another entity covered by this subchapter, and all information, documents, or records otherwise available from original sources are not immune from discovery or use in a civil proceeding merely because the information contained in the records was reported to the controlled substances database under this subchapter.

(d) The Department of Health shall establish and enforce policies and procedures to ensure that the privacy and confidentiality of patients are maintained and that patient information collected, recorded, transmitted, and stored is protected and not disclosed to persons except as listed in § 20-7-607.

(e) The Prescription Drug Monitoring Program shall establish and maintain a process for verifying the credentials and authorizing the use of prescription information by individuals and agencies listed in § 20-7-607.