(a) Except as provided in this section, records received and information assembled by the birth defects information system pursuant to section two of this article are confidential medical records.

(b) (1) The commissioner may use information assembled by the system to notify parents, guardians and custodians of children with congenital anomalies or abnormal conditions of medical care and other services available for the child and family.

(2) The commissioner may disclose information assembled by the system with the written consent of the parent or legal guardian of the child who is the subject of the information.

(c) (1) Access to information assembled by the system is limited to the following persons and government entities:

(A) The commissioner;

(B) Authorized employees of the bureau; and

(C) Qualified persons or government entities that are engaged in demographic, epidemiological or similar studies related to health and health care provision.

(2) The commissioner shall give a person or government entity described in subparagraph (C), subdivision (1) of this subsection access to the system only for informational requests of data and only if the person or a representative of the person or government entity signs an agreement to maintain the system's confidentiality.

(3) The commissioner shall maintain a record of all persons and government entities given access to the information in the system. The record shall include all of the following information:

(A) The name of the person who authorized access to the system;

(B) The name, title and organizational affiliation of the person or government entity given access to the system;

(C) The dates the person or government entity was given access to the system; and

(D) The specific purpose for which the person or government entity intends to use the information.

(4) The record maintained pursuant to subdivision (3) of this subsection is a public record as defined in chapter twenty-nine-b of this code.

(5) A person who violates an agreement described in subdivision (2) of this subsection shall be denied further access to confidential information maintained by the commissioner.

(d) The commissioner may disclose information assembled by the system in summary, statistical or other form that does not identify particular individuals or individual sources of information.