(a) Upon execution of a release by the health care practitioner, the statewide credentialing verification organization shall, under terms established in rule, provide the credentialing entity with electronic access to data generated.

(b) In order to assure that information in its files is current, the statewide credentialing verification organization shall establish processes to update information as required by credentialing entities.

(c) Except as provided in subsection (d) of this section, all information collected by the statewide credentialing verification organization from any source is confidential in nature, is exempt from disclosure pursuant to subpoena or discovery, is exempt from disclosure under the provisions of article one, chapter twenty-nine-b of this code, and shall be used solely by a credentialing entity to review the professional background, competency and qualifications of each health care practitioner applying to be credentialed.

(d) Credentialing information received by a credentialing entity from the statewide credentialing verification organization shall not be disclosed except:

(1) In appeals of credentialing decisions or to peer review and quality improvement committees: Provided, That such information shall be afforded the same protection from disclosure as is provided to other records used in proceedings subject to section three, article three-c, chapter thirty of this code;

(2) In any matter in which an action or order of a professional licensing board or other state or federal regulatory authority is at issue, including any proceeding brought by or on behalf of a health care practitioner or patient or by a regulatory body that challenges the actions, omissions or conduct of a credentialing entity with respect to credentialing decision; or

(3) When authorized by the health care practitioner to whom the credentialing information relates: Provided, That the health care practitioner's authorization shall only permit disclosure of information that he or she provided directly to the statewide credentialing verification organization.

(e) Upon the expiration of the contract with a statewide credentialing verification organization, all information collected in connection with the duties under such contract shall be delivered to the Secretary and Insurance Commissioner to the extent allowed by law and subject to any legal requirements applicable to the sources of such information.

(f) The statewide credentialing verification organization may enter into contractual agreements to define the data type and form of information to be provided to users and to give users assurances of the integrity of the information collected.