(a) A covered entity may not disclose an individual's protected health information to any other person in exchange for direct or indirect remuneration, except that a covered entity may disclose an individual's protected health information:
(1) to another covered entity, as that term is defined by Section 181.001, or to a covered entity, as that term is defined by Section 602.001, Insurance Code, for the purpose of:
(A) treatment;
(B) payment;
(C) health care operations; or
(D) performing an insurance or health maintenance organization function described by Section 602.053, Insurance Code; or
(2) as otherwise authorized or required by state or federal law.
(b) The direct or indirect remuneration a covered entity receives for making a disclosure of protected health information authorized by Subsection (a)(1)(D) may not exceed the covered entity's reasonable costs of preparing or transmitting the protected health information.