(a) No use or disclosure of protected health information maintained by or on an approved health information organization shall be made except pursuant to rules and regulations adopted by the department consistent with this act. An approved health information organization that uses or discloses protected health information in compliance with such rules shall be immune from any civil or criminal liability or any adverse administrative action arising out of or relating to such use or disclosure.

(b) Protected health information in the possession of an approved health information organization shall not be subject to discovery, subpoena or other means of legal compulsion for the release of such protected health information to any person or entity. An approved health information organization shall not be compelled by a request for production, subpoena, court order or otherwise, to disclose protected health information relating to an individual.