Mass. Gen. Laws. Ann. ch. 175I, § 13 - Personal or privileged information from insurance transactions; disclosure

An insurance company may not disclose any personal or privileged information received in the course of business unless the individual has provided a written disclosure authorization to any of the following:

1. The insurance company; 
2. Medical institution or provider; 
3. A person other than an insurance institution;
4. Insurance regulatory authority; 
5. Law enforcement;
6. For research purposes (provided that the information does not identify the individual);
7. For marketing purposes; 
8. An insurance affiliate; 
9. A consumer reporting agency;
10. A professional peer review organization; 
11. A governmental authority.