No external review agency or reviewer shall, except as specifically authorized by an appropriate release signed by an insured or representative authorized by law, release medical and treatment information or other information obtained as part of an external review, except to the Office of Patient Protection and as otherwise authorized or required by law.
958 CMR, § 3.416