32(3)A custodian shall limit the use of personal health information it maintains to those employees and agents of the custodian who need to know the information to carry out the purpose for which the information was collected or received or to carry out any of the permitted uses authorized under section 34.