(1) The chief executive officer of the Department of Health and Human Services may adopt and promulgate rules and regulations which prescribe standards and procedures for access to and security of confidential information among the divisions within the department and within each division. These include standards for collection, maintenance, and use of information in electronic or other storage media. Procedures for disclosure of confidential information among the divisions shall include a determination by the chief executive officer on whether confidential information should be shared among the divisions. In making the determination, the following factors shall be considered:

(a) The law governing the confidentiality of the information and the original purpose for which the information was collected;

(b) The potential for harm to an individual if the disclosure is made;

(c) Whether the disclosure will enhance the coordination of policy development, service provision, eligibility determination, program management, quality assurance, financial services, or support services;

(d) Whether the information is a trade secret, academic or scientific research work which is in progress and unpublished, or other proprietary or commercial information;

(e) Any limitations placed on the use of the information by the original source of the information;

(f) Whether the proposed use is for a bona fide research project or study, the procedures and methodology of which meet the standards for research in the particular body of knowledge;

(g) The security of the information, including the scope of access, ongoing security, publication, and disposal of the information at the end of its use;

(h) The degree to which aggregate or summary data may identify an individual whose privacy would otherwise be protected; and

(i) Whether such information constitutes criminal intelligence information maintained by correctional or law enforcement authorities.

(2) Otherwise confidential information may be disclosed among the divisions pursuant to subsection (1) of this section if not expressly prohibited by law. Such disclosure shall not be considered a public disclosure or make the record a public record. Any further disclosure may be made only if permitted by law or a policy governing the originating division. Each division shall observe confidentiality of human resources information and employment records, except that the divisions shall act and be considered to be one agency for purposes of human resources issues, employment records, and related matters.

(3) All officials and employees shall be informed regarding laws, rules and regulations, and policies governing confidential information and acknowledge receipt of that information.