SALE OF PROTECTED HEALTH INFORMATION PROHIBITED; EXCEPTIONS.

(a) A covered entity may not disclose an individual's protected health information to any other person in exchange for direct or indirect remuneration, except that a covered entity may disclose an individual's protected health information:

(1) to another covered entity, as that term is defined by Section 181.001, or to a covered entity, as that term is defined by Section 602.001, Insurance Code, for the purpose of:

(A) treatment;

(B) payment;

(C) health care operations; or

(D) performing an insurance or health maintenance organization function described by Section 602.053, Insurance Code; or

(2) as otherwise authorized or required by state or federal law.

(b) The direct or indirect remuneration a covered entity receives for making a disclosure of protected health information authorized by Subsection (a)(1)(D) may not exceed the covered entity's reasonable costs of preparing or transmitting the protected health information.