A health care provider may disclose health records of a user, when it is necessary for any legitimate purpose within the ordinary course and scope of his or her duties where much access or disclosure is in the interests of the user.