A patient’s confidential health care information shall be released or transferred without the written consent of the patient or the patient’s authorized representative to the auditor general or his or her designated representative for the purpose of conducting financial audits, management audits, program evaluations, and research, provided the personnel shall not identify, directly or indirectly, any individual patient in any report of the audit, evaluation, or research, or otherwise disclose patient identities in any manner.