(a) The data received by the department under this chapter shall be used by the department and commission only for the benefit of the public. Subject to specific limitations established by this chapter and department rule, the department shall make determinations on requests for information in favor of access.
(b) The executive commissioner by rule shall designate the characters to be used as uniform patient identifiers. The basis for assignment of the characters and the manner in which the characters are assigned are confidential.

(c) Unless specifically authorized by this chapter, the department may not release and a person or entity may not gain access to any data obtained under this chapter:
(1) that could reasonably be expected to reveal the identity of a patient;
(2) that could reasonably be expected to reveal the identity of a physician;
(3) disclosing provider discounts or differentials between payments and billed charges;
(4) relating to actual payments to an identified provider made by a payer; or
(5) submitted to the department in a uniform submission format that is not included in the public use data set established under Sections 108.006(f) and (g), except in accordance with § 108.0135.
(d) Except as provided by this section, all data collected and used by the department under this chapter is subject to the confidentiality provisions and criminal penalties of:
(1) § 311.037;
(2) § 81.103; and
(3) § 159.002, Occupations Code.
(e) Data on patients and compilations produced from the data collected that identify patients are not:
(1) subject to discovery, subpoena, or other means of legal compulsion for release to any person or entity except as provided by this section; or
(2) admissible in any civil, administrative, or criminal proceeding.
(f) Data on physicians and compilations produced from the data collected that identify physicians are not:
(1) subject to discovery, subpoena, or other means of legal compulsion for release to any person or entity except as provided by this section; or
(2) admissible in any civil, administrative, or criminal proceeding.
(g) Unless specifically authorized by this chapter, the department may not release data elements in a manner that will reveal the identity of a patient. The department may not release data elements in a manner that will reveal the identity of a physician.
(h) Subsections (c) and (g) do not prohibit the release of a uniform physician identifier in conjunction with associated public use data in accordance with § 108.011 or a provider quality report in accordance with § 108.010.
(i) Notwithstanding any other law and except as provided by this section, the department may not provide information made confidential by this section to any other agency of this state.
(j) The executive commissioner shall by rule develop and implement a mechanism to comply with Subsections (c)(1) and (2).
(k) The department may disclose data collected under this chapter that is not included in public use data to any department or commission program if the disclosure is reviewed and approved by the institutional review board under § 108.0135.
(l) Confidential data collected under this chapter that is disclosed to a department or commission program remains subject to the confidentiality provisions of this chapter and other applicable law. The department shall identify the confidential data that is disclosed to a program under Subsection (k). The program shall maintain the confidentiality of the disclosed confidential data.
(m) The following provisions do not apply to the disclosure of data to a department or commission program:
(1) § 81.103;
(2) Sections 108.010(g) and (h);
(3) Sections 108.011(e) and (f);
(4) § 311.037; and
(5) § 159.002, Occupations Code.
(n) Nothing in this section authorizes the disclosure of physician identifying data.