Subject to s. 153.455:

   (1)   After completion of data verification, comment and review procedures specified by the department by rule, the department shall release data, together with comments, if any, in the following forms:

      (a)    Standard reports.

      (b)    For information that is submitted by health care providers other than hospitals or ambulatory surgery centers, public use data files that do not permit the identification of specific patients, employers, or health care providers, as defined by rules promulgated by the department. The identification of patients, employers, or health care providers shall be protected by all necessary means, including the deletion of patient identifiers; the use of calculated variables and aggregated variables; the specification of counties as to residence, rather than zip codes; the use of 5-year categories for age, rather than exact age; not releasing information concerning a patient’s race, ethnicity, or dates of admission, discharge, procedures, or visits; and masking sensitive diagnoses and procedures by use of larger diagnostic and procedure categories. Public use data files under this paragraph may include only the following:

         1.    The patient’s county of residence.

         2.    The payment source, by type.

         3.    The patient’s age category, by 5-year intervals.

         4.    The patient’s procedure code.

         5.    The patient’s diagnosis code.

         6.    Charges assessed with respect to the procedure code.

         7.    The name and address of the facility in which the patient’s services were rendered.

         8.    The patient’s sex.

         9.    Information that contains the name of a health care provider that is not a hospital or ambulatory surgery center, if the department first reviews and approves the release.

         10.    Calendar quarters of service, except if the department specifies by rule that the number of data elements included in the public use data file is too small to enable protection of patient confidentiality.

         11.    Information other than patient-identifiable data, as defined in s. 153.50 (1) (b), as approved by the department.

      (c)    Custom-designed reports containing portions of the data under par. (b). Information that contains the name of a health care provider that is not a hospital or ambulatory surgery center may be released only if the department first reviews and approves the release. Reports under this paragraph may include the patient’s zip code only if at least one of the following applies:

         1.    Other potentially identifying data elements are not released.

         2.    Population density is sufficient to mask patient identity.

         3.    Other potentially identifying data elements are grouped to provide population density sufficient to protect identity.

         4.    Multiple years of data elements are added to protect identity.

   (1m)   After completion of data verification and review procedures specified by the department by rule, the department may, but is not required to, release special data compilations.

   (2)   The department shall provide to other agencies or to organizations the data necessary to fulfill their statutory mandates for epidemiological purposes or to minimize the duplicate collection of similar data elements.

   (3)   The department may, but is not required to, release health care provider-specific and employer-specific data that relates to health care providers other than hospitals and ambulatory surgery centers, except in public use data files as specified under sub. (1) (b), in a manner that is specified in rules promulgated by the department.

   (4)   The department shall prohibit purchasers of data from rereleasing individual data elements of health care data files.

   (5)   The department may not release any health care information that is subject to rules promulgated under s. 153.75 (1) (b) until the verification, comment and review procedures required under those rules have been complied with. Nothing in this subsection prohibits release of information to a health care provider that is not a hospital or ambulatory surgery center, to whom the information is specific.