(a) Except as provided by Subsection (b), a health benefit plan issuer, life insurer, or person employed by or under contract with a health benefit plan issuer or life insurer may not release information relating to the status as a victim of family violence of an individual who is clearly a victim of family violence, including:
(1) information about specific acts of family violence directed at the individual;
(2) the individual’s address or telephone number at home or at work; and
(3) information about the individual’s employment, associations, family membership, or relationships.
(b) A health benefit plan issuer or life insurer may release information to which Subsection (a) applies only:
(1) to the individual;
(2) to another individual designated in writing by the individual;
(3) to a licensed physician designated by the individual;
(4) to a physician or other health care provider for the provision of health care services;
(5) to an attorney who needs the information to effectively represent the issuer or insurer, if the issuer or insurer notifies the attorney of the requirements of this subchapter and requests that the attorney exercise due diligence to protect the information consistent with the attorney’s obligation to represent the issuer or insurer;
(6) to an individual covered under, or the owner of, the health benefit plan or life insurance contract or policy that contains information about status as a victim of family violence;
(7) to an individual or entity to whom the commissioner considers the release appropriate;
(8) as required by other law or an order of the commissioner or a court; or
(9) as necessary for a valid business purpose if:
(A) the information cannot be segregated from other information about the individual without undue hardship to the issuer or insurer;
(B) the recipient of the information is:
(i) a reinsurer that seeks to indemnify or indemnifies all or part of a health benefit plan or life insurance contract or policy covering the individual if the reinsurer cannot underwrite or satisfy obligations under the reinsurance agreement without the release of the information;
(ii) a party to a proposed or consummated sale, transfer, merger, or consolidation of all or part of the business of the issuer or insurer;
(iii) medical or claims personnel under contract with the issuer or insurer, including a parent or affiliate company under a service agreement with the issuer or insurer, if the release of the information is necessary to process an application, to perform duties under the health benefit plan or life insurance contract or policy, or to protect the safety or privacy of a victim of family violence; or
(iv) an entity with which the issuer transacts business if the information is only the address or telephone number of the individual and the entity cannot transact the business without the address or telephone number; and
(C) the recipient of the information agrees in writing to be subject to the requirements of this subchapter.