(a) The following data reported or submitted to the department under this subchapter is confidential:
(1) data regarding a specific patient; or
(2) financial data regarding a provider or facility submitted to the department before September 1, 1987. All financial data regarding a provider or facility submitted after September 1, 1987, are no longer confidential.
(b) Before the department may disclose confidential data under this subchapter, the department must remove any information that identifies a specific patient.
(c) A person commits an offense if the person:
(1) discloses, distributes, or sells confidential data obtained under this subchapter; or
(2) violates Subsection (b).
(d) An offense under Subsection (c) is a Class B misdemeanor.