(a) A utilization review agent may not disclose individual medical records, personal information, or other confidential information about a patient obtained in the performance of utilization review without the patient’s prior written consent or except as otherwise required by law.
(b) If the prior written consent is submitted by anyone other than the patient who is the subject of the personal or confidential information requested, the consent must:
(1) be dated; and
(2) contain the patient’s signature.

(c) The patient’s signature for purposes of Subsection (b)(2) must have been obtained one year or less before the date the disclosure is sought or the consent is invalid.