(1) The following information held by the department is confidential and exempt from s. 119.07(1) and s. 24(a), Art. I of the State Constitution:(a) A patient’s or caregiver’s personal identifying information in the medical marijuana use registry established under s. 381.986. (b) All personal identifying information collected for the purpose of issuing a patient’s or caregiver’s medical marijuana use registry identification card described in s. 381.986. (c) All personal identifying information pertaining to the physician certification for marijuana and the dispensing thereof.
(d) A qualified physician’s Drug Enforcement Administration number, residential address, and government-issued identification card.
(2) The department shall allow access to the confidential and exempt information in the medical marijuana use registry to:(a) A law enforcement agency that is investigating a violation of law regarding marijuana in which the subject of the investigation claims an exception established under s. 381.986, except for information related to the patient’s diagnosis. (b) A medical marijuana treatment center approved by the department pursuant to s. 381.986 which is attempting to verify the authenticity of a physician certification for marijuana, including whether the certification had been previously filled and whether the certification was issued for the person attempting to have it filled, except for information related to the patient’s diagnosis. (c) A physician who has issued a certification for marijuana for the purpose of monitoring the patient’s use of such marijuana or for the purpose of determining, before issuing a certification for marijuana, whether another physician has issued a certification for the patient’s use of marijuana. The physician may access the confidential and exempt information only for the patient for whom he or she has issued a certification or is determining whether to issue a certification for the use of marijuana pursuant to s. 381.986. (d) A practitioner licensed to prescribe prescription medications to ensure proper care of a patient before prescribing medication to that patient which may interact with marijuana.
(e) An employee of the department for the purposes of maintaining the registry and periodic reporting or disclosure of information that has been redacted to exclude personal identifying information.
(f) An employee of the department for the purposes of reviewing physician registration and the issuance of physician certifications to monitor practices that could facilitate unlawful diversion or the misuse of marijuana or a marijuana delivery device.
(g) The department’s relevant health care regulatory boards responsible for the licensure, regulation, or discipline of a physician if he or she is involved in a specific investigation of a violation of s. 381.986. If a health care regulatory board’s investigation reveals potential criminal activity, the board may provide any relevant information to the appropriate law enforcement agency. (h) The Consortium for Medical Marijuana Clinical Outcomes Research established in s. 1004.4351(4). (i) A person engaged in bona fide research if the person agrees:1. To submit a research plan to the department which specifies the exact nature of the information requested and the intended use of the information;
2. To maintain the confidentiality of the records or information if personal identifying information is made available to the researcher;
3. To destroy any confidential and exempt records or information obtained after the research is concluded; and
4. Not to contact, directly or indirectly, for any purpose, a patient or physician whose information is in the registry.
(3) The department shall allow access to the confidential and exempt information pertaining to the physician certification for marijuana and the dispensing thereof, whether in the registry or otherwise held by the department, to:(a) An employee of the department for the purpose of approving or disapproving a request for an exception to the daily dose amount limit for a qualified patient; and
(b) The Consortium for Medical Marijuana Clinical Outcomes Research pursuant to s. 381.986 for the purpose of conducting research regarding the medical use of marijuana. (4) All information released by the department under subsections (2) and (3) remains confidential and exempt, and a person who receives access to such information must maintain the confidential and exempt status of the information received.
(5) A person who willfully and knowingly violates this section commits a felony of the third degree, punishable as provided in s. 775.082 or s. 775.083. 
