(1)(a) A health care provider or health care facility may use or disclose the health care information of a patient without obtaining an authorization from the patient or the patient's personal representative if the conditions in (b) of this subsection are met and:

(i) The disclosure is to a family member, including a patient's state registered domestic partner, other relative, a close personal friend, or other person identified by the patient, and the health care information is directly relevant to the person's involvement with the patient's health care or payment related to the patient's health care; or

(ii) The use or disclosure is for the purpose of notifying, or assisting in the notification of, including identifying or locating, a family member, a personal representative of the patient, or another person responsible for the care of the patient of the patient's location, general condition, or death.

(b) A health care provider or health care facility may make the uses and disclosures described in (a) of this subsection if:

(i) The patient is not present or obtaining the patient's authorization or providing the opportunity to agree or object to the use or disclosure is not practicable due to the patient's incapacity or an emergency circumstance, the health care provider or health care facility may in the exercise of professional judgment, determine whether the use or disclosure is in the best interests of the patient and, if so, disclose only the health care information that is directly relevant to the person's involvement with the patient's health care or payment related to the patient's health care; or

(ii) The patient is present for, or otherwise available prior to, the use or disclosure and has the capacity to make health care decisions, the health care provider or health care facility may use or disclose the information if it:

(A) Obtains the patient's agreement;

(B) Provides the patient with the opportunity to object to the use or disclosure, and the patient does not express an objection; or

(C) Reasonably infers from the circumstances, based on the exercise of professional judgment, that the patient does not object to the use or disclosure.

(2) With respect to information and records related to mental health services provided to a patient by a health care provider, the health care information disclosed under this section may include, to the extent consistent with the health care provider's professional judgment and standards of ethical conduct:

(a) The patient's diagnoses and the treatment recommendations;

(b) Issues concerning the safety of the patient, including risk factors for suicide, steps that can be taken to make the patient's home safer, and a safety plan to monitor and support the patient;

(c) Information about resources that are available in the community to help the patient, such as case management and support groups; and

(d) The process to ensure that the patient safely transitions to a higher or lower level of care, including an interim safety plan.

(3) Any use or disclosure of health care information, including information and records related to mental health services, under this section must be limited to the minimum necessary to accomplish the purpose of the use or disclosure.

(4) A health care provider or health care facility is not subject to any civil liability for making or not making a use or disclosure in accordance with this section.