No carrier or utilization review agency shall, except as specifically authorized by an appropriate release signed by an insured or authorized representative, release medical and treatment information or other information obtained as part of the internal inquiry or grievance process unless otherwise required or authorized by law.
958 CMR, § 3.313