(a) A health care entity may not collect or attempt to collect duplicate core credentials data from a physician if the information is already on file with the board. This section does not restrict the right of a health care entity to request additional information not included in the core credentials data on file with the board that is necessary for the entity to credential the physician. A health care entity or its designated credentials verification organization may collect any additional information required by the health care entity’s credentialing process from a primary source of that information.
(b) A state agency may not collect or attempt to collect duplicate core credentials data from a physician if the information is already on file with the board. This section does not restrict the right of a state agency to request additional information not included in the core credentials data on file with the board that the agency considers necessary for its specific credentialing purposes.

(c) The board by rule may except from Subsections (a) and (b) a request for core credentials data that is necessary for a health care entity to provide temporary privileges during the credentialing process.