(1) No person who receives health care information for health care education, or to provide planning, quality assurance, peer review, or administrative, legal, financial, or actuarial services, or other health care operations for or on behalf of a health care provider or health care facility, may use or disclose any health care information received from the health care provider or health care facility in any manner that would violate the requirements of this chapter if performed by the health care provider or health care facility.
(2) A health care provider or health care facility that has a contractual relationship with a person to provide services described under subsection (1) of this section may terminate the contractual relationship with the person if the health care provider or health care facility learns that the person has engaged in a pattern of activity that violates the person's duties under subsection (1) of this section, unless the person took reasonable steps to correct the breach of confidentiality or has discontinued the violating activity.