(a) The commissioner shall adopt standards and rules for:
(1) the certification, selection, and operation of independent review organizations to perform independent review described by Subchapter I, Chapter 4201; and
(2) the suspension and revocation of the certification.
(b) The standards adopted under this section must ensure:
(1) the timely response of an independent review organization selected under this chapter;
(2) the confidentiality of medical records transmitted to an independent review organization for use in conducting an independent review;
(3) the qualifications and independence of each physician or other health care provider making a review determination for an independent review organization;
(4) the fairness of the procedures used by an independent review organization in making review determinations; and
(5) the timely notice to an enrollee of the results of an independent review, including the clinical basis for the review determination.

(c) In addition to the standards described by Subsection (b), the commissioner shall adopt standards and rules that:
(1) prohibit:
(A) more than one independent review organization from operating out of the same office or other facility;
(B) an individual or entity from owning more than one independent review organization;
(C) an individual from owning stock in or serving on the board of more than one independent review organization;
(D) an individual who has served on the board of an independent review organization whose certification was revoked for cause from serving on the board of another independent review organization before the fifth anniversary of the date on which the revocation occurred;
(E) an individual who serves as an officer, director, manager, executive, or supervisor of an independent review organization from serving as an officer, director, manager, executive, supervisor, employee, agent, or independent contractor of another independent review organization; and
(F) an independent review organization from:
(i) publicly disclosing patient information protected by the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. § 1320d et seq.); or
(ii) transmitting the information to a subcontractor involved in the independent review process that has not signed an agreement similar to the business associate agreement required by regulations adopted under the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. § 1320d et seq.); and
(2) require:
(A) an independent review organization to:
(i) maintain a physical address and a mailing address in this state;
(ii) be incorporated in this state;
(iii) be in good standing with the comptroller; and
(iv) be based and certified in this state and to locate the organization’s primary offices in this state;
(B) an independent review organization to surrender the organization’s certification as part of an agreed order; and
(C) an independent review organization to:
(i) notify the department of an agreement to sell the organization or shares in the organization;
(ii) not later than the 60th day before the date of the sale, submit the name of the purchaser and a complete and legible set of fingerprints for each officer of the purchaser and for each owner or shareholder of the purchaser or, if the purchaser is publicly held, each owner or shareholder described by Section 4202.004(a)(1), and any additional information necessary to comply with Section 4202.004(d); and
(iii) complete the transfer of ownership after the department has sent written confirmation in accordance with Subsection (d) that the requirements of this chapter have been satisfied.
(d) The department shall send the written confirmation required by Subsection (c)(2)(C)(iii) not later than the expiration of the fourth week after the date the department determines the requirements are satisfied.
(e) Standards to ensure the confidentiality of medical records transmitted to an independent review organization under Subsection (b)(2) must require organizations and utilization review agents to transmit and store records in compliance with the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. § 1320d et seq.) and the regulations and standards adopted under that Act.
(f) The commissioner shall adopt standards requiring that:
(1) on application for certification, an officer of the organization attest that the office is located at a physical address;
(2) the office be equipped with a computer system capable of:
(A) processing requests for independent review; and
(B) accessing all electronic records related to the review and the independent review process;
(3) all records be maintained electronically and made available to the department on request; and
(4) in the case of an office located in a residence, the working office be located in a room set aside for independent review business purposes and in a manner to ensure confidentiality in accordance with Subsection (e).