958 CMR 3.313
Confidentiality
No carrier or utilization review agency shall, except as specifically authorized by an
appropriate release signed by an insured or authorized representative, release medical and
treatment information or other information obtained as part of the internal inquiry or grievance
process unless otherwise required or authorized by law.