(a) A person may not:
(1) reidentify or attempt to reidentify personal identifying information about an individual who is the subject of covered information; or
(2) knowingly disclose or release covered information that was reidentified in violation of this section.
(b) It is a defense to a civil action or prosecution for a violation of this section that:
(1) the person:
(A) was reidentifying the covered information for the purpose of a study or other scholarly research, including performing an evaluation or test of software intended to deidentify information; and
(B) did not release or publish the names or other information identifying any subjects of the reidentified covered information; or
(2) the person obtained informed, written consent from the individual who is the subject of the covered information that specifically referenced the information to be reidentified, disclosed, or released, and authorized the reidentification, disclosure, or release of that information.