(a) In this section, “compliance program” means a process to assess and ensure compliance by the institute’s committee members and employees with applicable laws, rules, and policies, including matters of:
(1) ethics and standards of conduct;
(2) financial reporting;
(3) internal accounting controls; and
(4) auditing.
(b) The institute shall establish a compliance program that operates under the direction of the institute’s chief compliance officer. The institute may establish procedures, such as a telephone hotline, to allow private access to the compliance program office and to preserve the confidentiality of communications and the anonymity of a person making a compliance report or participating in a compliance investigation.

(c) The following are confidential and are not subject to disclosure under Chapter 552, Government Code:
(1) information that directly or indirectly reveals the identity of an individual who made a report to the institute’s compliance program office, sought guidance from the office, or participated in an investigation conducted under the compliance program;
(2) information that directly or indirectly reveals the identity of an individual who is alleged to have or may have planned, initiated, or participated in activities that are the subject of a report made to the office if, after completing an investigation, the office determines the report to be unsubstantiated or without merit; and
(3) other information that is collected or produced in a compliance program investigation if releasing the information would interfere with an ongoing compliance investigation.
(d) Subsection (c) does not apply to information related to an individual who consents to disclosure of the information.
(e) Information made confidential or excepted from public disclosure by this section may be made available to the following on request in compliance with applicable laws and procedures:
(1) a law enforcement agency or prosecutor;
(2) a governmental agency responsible for investigating the matter that is the subject of a compliance report, including the Texas Workforce Commission civil rights division or the federal Equal Employment Opportunity Commission; or
(3) a committee member or institute employee who is responsible under institutional policy for a compliance program investigation or for a review of a compliance program investigation.
(f) A disclosure under Subsection (e) is not a voluntary disclosure for purposes of § 552.007, Government Code.