958 CMR 3.416
Confidentiality – External Review
No external review agency or reviewer shall, except as specifically authorized by an
appropriate release signed by an insured or representative authorized by law, release medical and
treatment information or other information obtained as part of an external review, except to the
Office of Patient Protection and as otherwise authorized or required by law.