(a) Except as provided by Subsection (b), an operator or other person may not disclose a customer record required to be kept by the department.
(b) An operator or other person may disclose a customer record if:
(1) the customer or a person authorized to act on behalf of the customer requests the record;
(2) the department, the Texas Medical Board, a health authority, or an authorized agent requests the record;
(3) the customer consents in writing to disclosure of the record to another person;
(4) the customer is a victim, witness, or defendant in a criminal proceeding and the record is relevant to that proceeding;
(5) the record is requested in a criminal or civil proceeding by court order or subpoena; or
(6) disclosure is otherwise required by law.