The department may promulgate rules pursuant to the administrative procedures act of 1969, 1969 PA 306, MCL 24.201 to 24.328, necessary to implement this act. Rules governing the exchange of information under this act shall be consistent with all laws, regulations, and rules relating to the confidentiality or privacy of personal information or medical records, including, but not limited to, the health insurance portability and accountability act of 1996, Public Law 104-191, and regulations promulgated under that act, 45 C.F.R. § part parts 160 to 164.