(a) Section 33-3-103 does not preclude making reports of harm or granting access to records if making reports of harm or granting access to records is expressly required by:

(1) The Child Abuse Reporting Law, compiled in title 37, chapter 1, part 4;

(2) The Child Sexual Abuse Reporting Law, compiled in title 37, chapter 1, part 6; or

(3) The Adult Protective Services Law, compiled in title 71, chapter 6.

(b)

(1) The identity of a person who reports abuse, exploitation, fraud, neglect, misappropriation or mistreatment to the department is confidential and may not be disclosed without the person's consent, except as follows:

(A) As necessary to carry out the laws cited in subsection (a);

(B) To employees of the department as necessary to investigate the report;

(C) To the abuse registry;

(D) To the appropriate district attorney general;

(E) By order of a court with jurisdiction over abuse, exploitation, fraud, neglect, misappropriation or mistreatment; or

(F) By order of a court or administrative law judge in a proceeding involving sanctions or disciplinary actions against a caregiver or an entity accused of abuse, exploitation, fraud, neglect, misappropriation or mistreatment, when it appears to such court or administrative law judge that the person making the report is or may be a witness to facts relevant to the proceeding.

(2) The person's identity is irrelevant to any civil proceeding and is not subject to disclosure, except in cases where a caregiver or other person is the subject of a complaint and can make a showing that the complaint was made with malice so that the caregiver or other person may pursue such remedies as may be permitted by law. The person may be subpoenaed if the department or district attorney general deems it necessary to protect the service recipient who is the subject of the report, but the fact that the person made the report may not be disclosed.