(a) General rule.--Except as provided in this chapter, all working papers, recorded information, documents and copies of working papers, recorded information and documents produced by, obtained by or disclosed to the exchange authority or any other person in the course of the exercise of the exchange authority's powers and duties under this chapter:

(1) shall be confidential;

(2) shall not be subject to subpoena;

(3) shall not be subject to the act of February 14, 2008 (P.L.6, No.3), known as the Right-to-Know Law;

(4) shall not be subject to discovery or admissible in evidence in any private civil action; and

(5) may not be made public by the exchange authority or any other person.

(b) Personal health and financial information.--The exchange authority shall protect personally identifiable health and financial information in accordance with all applicable Federal and State laws and regulations, including the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191, 110 Stat. 1936), the Health Information Technology for Economic and Clinical Health Act (Public Law 111-5, 123 Stat. 226-279 and 467-496) and implementing regulations.

(c) Information disclosure.--Subject to the confidentiality provisions of this section:

(1) Information shall be shared, as appropriate, for the purpose of determining and coordinating the eligibility of individuals for the exchange or any government program, including the Children's Health Insurance Program and medical assistance program, or for compliance with Federal law:

(i) Among the exchange authority and departments, including:

(A) The department.

(B) The Department of Aging.

(C) The Department of Drug and Alcohol Programs.

(D) The Department of Health.

(E) The Department of Human Services.

(F) The Department of Labor and Industry.

(G) The Department of Revenue.

(ii) Between the exchange authority and Federal agencies, including:

(A) The Centers for Medicare and Medicaid Services.

(B) The Treasury Department.

(2) Information may be disclosed:

(i) As necessary to comply with the audit requirements of section 9310 (relating to audits) and the reporting requirements of section 9311 (relating to reports), only in an aggregated and de-identified form.

(ii) In any circumstance, other than those described in paragraph (1) or subparagraph (i), only if the prior written consent of the company or person to which the information pertains has been obtained.

(d) Construction.--Nothing in this section shall be construed to prohibit the exchange authority from accessing the information necessary to carry out its responsibilities in accordance with law.