Each organization shall prepare an annual report of the effectiveness of the organization’s internal quality control. The report shall be in a form prescribed by the commissioner after consultation with the director of the Department of Health, and shall be certified and signed by two officers of the organization. The commissioner may at any time require an audit of an organization’s quality control system. The audit shall be performed by qualified persons designated by the commissioner. Auditors shall have full access to all records of the organization and its providers, including medical records of individual patients. The information contained in the medical records of individual patients shall remain confidential, and information derived from those records may not be used in a manner that could directly or indirectly identify an individual. All information, interviews, reports, statements, memoranda, or other data furnished by reason of the audit and any findings or conclusions of the auditors are privileged and are not subject to discovery, use, or receipt in evidence in any legal proceeding except hearings before the commissioner or the director of the Department of Health concerning alleged violations of the provisions of this chapter.