(a) In this section, “institution” means a general academic teaching institution, a medical and dental unit, or other agency of higher education, as those terms are defined by § 61.003.
(b) An institution shall adopt and implement a multihazard emergency operations plan for use at the institution. The plan must address mitigation, preparedness, response, and recovery. The plan must provide for:
(1) employee training in responding to an emergency;
(2) mandatory drills to prepare students, faculty, and employees for responding to an emergency;
(3) measures to ensure coordination with the Department of State Health Services, local emergency management agencies, law enforcement, health departments, and fire departments in the event of an emergency; and
(4) the implementation of a safety and security audit as required by Subsection (c).

(c) At least once every three years, an institution shall conduct a safety and security audit of the institution’s facilities. To the extent possible, an institution shall follow safety and security audit procedures developed in consultation with the division of emergency management of the office of the governor.
(d) An institution shall report the results of the safety and security audit conducted under Subsection (c) to the institution’s board of regents and the division of emergency management of the office of the governor.
(e) Except as provided by Subsection (f), any document or information collected, developed, or produced during a safety and security audit conducted under Subsection (c) is not subject to disclosure under Chapter 552, Government Code.
(f) A document relating to an institution’s multihazard emergency operations plan is subject to disclosure if the document enables a person to:
(1) verify that the institution has established a plan and determine the agencies involved in the development of the plan and the agencies coordinating with the institution to respond to an emergency, including the Department of State Health Services, local emergency services agencies, law enforcement agencies, health departments, and fire departments;
(2) verify that the institution’s plan was reviewed within the last 12 months and determine the specific review dates;
(3) verify that the plan addresses the four phases of emergency management under Subsection (b);
(4) verify that institution employees have been trained to respond to an emergency and determine the types of training, the number of employees trained, and the person conducting the training;
(5) verify that each campus has conducted mandatory emergency drills and exercises in accordance with the plan and determine the frequency of the drills;
(6) verify that the institution has completed a safety and security audit under Subsection (c) and determine the date the audit was conducted, the person conducting the audit, and the date the institution presented the results of the audit to the board of regents; and
(7) verify that the institution has addressed any recommendations by the board of regents for improvement of the plan and determine the institution’s progress within the last 12 months.
(g) The personal information of an individual maintained in an institution’s emergency notification system is confidential and is not subject to disclosure under Chapter 552, Government Code. In this subsection, “personal information” includes an e-mail address or telephone number maintained in order to notify an individual of an emergency.