Texas Insurance Code - INS § 38.406. Data Privacy and Security

(a) Information that may identify a patient is confidential and subject to applicable state and federal law relating to records privacy and protected health information, including Chapter 181, Health and Safety Code, and is not subject to disclosure under Chapter 552, Government Code.  Except as provided by Subsection (b), any information that may identify a health care provider, health benefit plan, health benefit plan issuer, or other payor is confidential and subject to applicable state and federal law relating to records privacy and protected health information, including Chapter 181, Health and Safety Code, and is not subject to disclosure under Chapter 552, Government Code.

(b) A qualified research entity with access to data or information that is contained in the database but not accessible through the portal described in Section 38.405:

(c) A qualified research entity with access to information that is contained in the database but not accessible through the portal must execute an agreement with the center relating to the qualified research entity's compliance with the requirements of Subsections (a) and (b), including the confidentiality of information contained in the database but not accessible through the portal.

(d) Notwithstanding any provision of this subchapter, the department and the center may not disclose an individual's protected health information in violation of any state or federal law.

(e) The center shall include in the database only the minimum amount of protected health information identifiers necessary to link public and private data sources and the geographic and services data to undertake studies.

(f) The center shall maintain protected health information identifiers collected under this subchapter but excluded from the database under Subsection (e) in a separate database.  The separate database may not be aggregated with any other information and must use a proxy or encrypted record identifier for analysis.