(a) Unless the health care provider acts with malice or gross negligence, a health care provider who provides patient information to a health information exchange is not liable for any damages, penalties, or other relief related to the obtainment, use, or disclosure of that information in violation of federal or state privacy laws by a health information exchange, another health care provider, or any other person.
(b) Nothing in this section may be construed to create a cause of action or to create a standard of care, obligation, or duty that forms the basis for a cause of action.