(a) Except as provided by Subsection (b), a health benefit plan issuer or pharmacy benefit manager may have access to an audit report of a pharmacist or pharmacy only if the report was prepared in connection with an audit conducted by the health benefit plan issuer or pharmacy benefit manager.
(b) A health benefit plan issuer or pharmacy benefit manager may have access to audit reports other than the reports described by Subsection (a) if, after reviewing claims data, written or oral statements of pharmacy staff, wholesalers, or others, or other investigative information, including patient referrals, anonymous reports, or postings on Internet websites, the plan issuer or the pharmacy benefit manager suspects the audited pharmacist or pharmacy committed fraud or made an intentional misrepresentation related to the pharmacy business.

(c) An auditor must conduct an on-site audit or a desk audit of similarly situated pharmacists or pharmacies under the same audit standards.