(a) An insurer or MA or CHIP managed care plan shall adopt and maintain procedures to ensure that all protected health information regarding covered person or enrollee health, diagnosis and treatment is adequately protected and remains confidential in compliance with all applicable Federal and State laws and regulations and professional ethical standards.

(b) To the extent an insurer or MA or CHIP managed care plan receives medical records relating to a covered person or enrollee, the insurer or MA or CHIP managed care plan shall adopt and maintain procedures to ensure that covered persons and enrollees have timely access to their medical records upon request of the covered person or enrollee, including medical records provided by a health care provider in the context of utilization review or a complaint, grievance or adverse benefit determination, unless prohibited by Federal or State law or regulation.