(a) Voluntary disclosures.--Section 1307 of the act of April 17, 2016 (P.L. 84, No. 16),¹ known as the Medical Marijuana Act, shall not prohibit the voluntary disclosure of any records or other information by a legitimate cannabis-related business, or a business associate to a financial institution or insurer, as necessary to obtain financial or insurance services to the extent not prohibited by and consistent with any applicable requirements of the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191, 110 Stat. 1936) privacy regulation as promulgated by the United States Department of Health and Human Services under 45 CFR Pts. 160 (relating to general administrative requirements), 162 (relating to administrative requirements) and 164 (relating to security and privacy) and 16 CFR Pt. 313 (relating to privacy of consumer financial information).

(b) Restrictions on use of records.--A financial institution, or insurer receiving access to information under subsection (a), the distribution of which would otherwise be prohibited, may only use the information as necessary to satisfy due diligence obligations required to provide financial or insurance services to persons participating in the medical marijuana program established under the Medical Marijuana Act and may not disclose the information records to other persons except for information: