1. (a) A covered entity may not disclose an individual's protected health information to any other person in exchange for direct or indirect remuneration, except that a covered entity may disclose an individual's protected health information:

   1. (1) to another covered entity, as that term is defined by Section 181.001, or to a covered entity, as that term is defined by Section 602.001, Insurance Code, for the purpose of:

      1. (A) treatment;
      2. (B) payment;
      3. (C) health care operations; or
      4. (D) performing an insurance or health maintenance organization function described by Section 602.053, Insurance Code; or
   2. (2) as otherwise authorized or required by state or federal law.
2. (b) The direct or indirect remuneration a covered entity receives for making a disclosure of protected health information authorized by Subsection (a)(1)(D) may not exceed the covered entity's reasonable costs of preparing or transmitting the protected health information.

Added by Acts 2011, 82nd Leg., R.S., Ch. 1126 (H.B. 300), Sec. 7, eff. September 1, 2012.