Except as otherwise required by statute or rule, a carrier and the Washington state health insurance pool, and persons acting at the direction of or on behalf of a carrier or the pool, who are in receipt of an enrollee's or applicant's personally identifiable health information included in the standard health questionnaire shall not disclose the identifiable health information unless such disclosure is explicitly authorized in writing by the person who is the subject of the information.