Mental health professionals, mental health facilities and data collectors shall provide employees and agents who have lawful access to mental health information in the course of their employment with a written statement of the requirement of maintaining the security of records of mental health information and of the penalties provided in this chapter for unauthorized disclosure.