(1) A licensee shall not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer whose nonpublic personal health information is sought to be disclosed.

(2) Except as provided in WAC 284-04-510, nothing in this section shall prohibit, restrict or require an authorization for the disclosure of nonpublic personal health information by a licensee for the performance of insurance functions by or on behalf of the licensee, for activities permitted under RCW 70.02.050, and for activities permitted under health privacy regulations adopted by the U.S. Department of Health and Human Services governing health information privacy.