35(3)A custodian shall limit the disclosure of personal health information it maintains to those employees and agents of the custodian who need to know the information to carry out the purpose for which the information was collected or received or to carry out a purpose authorized under section 37.