An operator must not permit a health and safety representative for a designated work group to have access to information of a confidential medical nature under the control of the operator, being information relating to a person who is or was an employee, unless:
(a) the person has given to the operator a written authority permitting the representative to have access to the information; or
(b) the information is in a form that does not identify the person or enable the identity of the person to be discovered.