228.2  Mental health information disclosure prohibited — exceptions — record of disclosure.
  1.  Except as specifically authorized in section 228.3, 228.5, 228.6, 228.7, or 228.8, a mental health professional, data collector, or employee or agent of a mental health professional, of a data collector, or of or for a mental health facility shall not disclose or permit the disclosure of mental health information.
  2.  a.  Upon disclosure of mental health information pursuant to section 228.3, 228.5, 228.6, 228.7, or 228.8, the person disclosing the mental health information shall enter a notation on and maintain the notation with the individual’s record of mental health information, stating the date of the disclosure and the name of the recipient of mental health information.
  b.  The person disclosing the mental health information shall give the recipient of the information a statement which informs the recipient that disclosures may only be made pursuant to the written authorization of an individual or an individual’s legal representative, or as otherwise provided in this chapter, that the unauthorized disclosure of mental health information is unlawful, and that civil damages and criminal penalties may be applicable to the unauthorized disclosure of mental health information.
  3.  A recipient of mental health information shall not disclose the information received, except as specifically authorized for initial disclosure in section 228.3, 228.5, 228.6, 228.7, or 228.8. However, mental health information may be transferred at any time to another facility, physician, or mental health professional in cases of a medical emergency or if the individual or the individual’s legal representative requests the transfer in writing for the purposes of receipt of medical or mental health professional services, at which time the requirements of subsection 2 shall be followed.
86 Acts, ch 1082, §2; 88 Acts, ch 1226, §4, 5; 90 Acts, ch 1079, §2; 2009 Acts, ch 41, §263
See also §622.10