(a) A pharmacy benefit manager may not sell a list of patients that contains information through which the identity of an individual patient is disclosed.
(b) A pharmacy benefit manager shall maintain all data that identifies a patient in a confidential manner that prevents disclosure to a third party unless the disclosure is otherwise authorized by law or by the patient.
(c) This section does not prohibit:
(1) general advertising about a specific pharmaceutical product or service; or
(2) the request and receipt by a person of information regarding:
(A) a specific pharmaceutical product or service;
(B) the person's own records or claims; or
(C) the person's dependent's records or claims.