(a) The board may not permit any person to have access to information submitted to the board under § 481.074(q) or 481.075 except:
(1) the board, the Texas Medical Board, the Texas Department of Licensing and Regulation, with respect to the regulation of podiatrists, the State Board of Dental Examiners, the State Board of Veterinary Medical Examiners, the Texas Board of Nursing, or the Texas Optometry Board for the purpose of:
(A) investigating a specific license holder; or
(B) monitoring for potentially harmful prescribing or dispensing patterns or practices under § 481.0762;
(2) an authorized employee of the board engaged in the administration, investigation, or enforcement of this chapter or another law governing illicit drugs in this state or another state;
(3) the department or other law enforcement or prosecutorial official engaged in the administration, investigation, or enforcement of this chapter or another law governing illicit drugs in this state or another state, if the board is provided a warrant, subpoena, or other court order compelling the disclosure;
(4) a medical examiner conducting an investigation;
(5) provided that accessing the information is authorized under the Health Insurance Portability and Accountability Act of 1996 (Pub. L. No. 104-191) and regulations adopted under that Act:
(A) a pharmacist or a pharmacist-intern, pharmacy technician, or pharmacy technician trainee, as defined by § 551.003, Occupations Code, acting at the direction of a pharmacist, who is inquiring about a recent Schedule II, III, IV, or V prescription history of a particular patient of the pharmacist; or
(B) a practitioner who:
(i) is a physician, dentist, veterinarian, podiatrist, optometrist, or advanced practice nurse or is a physician assistant described by § 481.002(39)(D) or an employee or other agent of a practitioner acting at the direction of a practitioner; and
(ii) is inquiring about a recent Schedule II, III, IV, or V prescription history of a particular patient of the practitioner;
(6) a pharmacist or practitioner who is inquiring about the person’s own dispensing or prescribing activity or a practitioner who is inquiring about the prescribing activity of an individual to whom the practitioner has delegated prescribing authority;
(7) one or more states or an association of states with which the board has an interoperability agreement, as provided by Subsection (j);
(8) a health care facility certified by the federal Centers for Medicare and Medicaid Services; or
(9) the patient, the patient’s parent or legal guardian, if the patient is a minor, or the patient’s legal guardian, if the patient is an incapacitated person, as defined by § 1002.017(2), Estates Code, inquiring about the patient’s prescription record, including persons who have accessed that record.
(a-1) A person authorized to receive information under Subsection (a)(4), (5), or (6) may access that information through a health information exchange, subject to proper security measures to ensure against disclosure to unauthorized persons.

(a-2) A person authorized to receive information under Subsection (a)(5) may include that information in any form in the medical or pharmacy record of the patient who is the subject of the information. Any information included in a patient’s medical or pharmacy record under this subsection is subject to any applicable state or federal confidentiality or privacy laws.
(a-3) Repealed by Acts 2019, 86th Leg., R.S., Ch. 1166 (H.B. 3284), Sec. 10, eff. September 1, 2019.
(a-4) Repealed by Acts 2019, 86th Leg., R.S., Ch. 1166 (H.B. 3284), Sec. 10, eff. September 1, 2019.
(a-5) Repealed by Acts 2019, 86th Leg., R.S., Ch. 1166 (H.B. 3284), Sec. 10, eff. September 1, 2019.
(a-6) A patient, the patient’s parent or legal guardian, if the patient is a minor, or the patient’s legal guardian, if the patient is an incapacitated person, as defined by § 1002.017(2), Estates Code, is entitled to a copy of the patient’s prescription record as provided by Subsection (a)(9), including a list of persons who have accessed that record, if a completed patient data request form and any supporting documentation required by the board is submitted to the board. The board may charge a reasonable fee for providing the copy. The board shall adopt rules to implement this subsection, including rules prescribing the patient data request form, listing the documentation required for receiving a copy of the prescription record, and setting the fee.
(b) This section does not prohibit the board from creating, using, or disclosing statistical data about information submitted to the board under this section if the board removes any information reasonably likely to reveal the identity of each patient, practitioner, or other person who is a subject of the information.
(c) The board by rule shall design and implement a system for submission of information to the board by electronic or other means and for retrieval of information submitted to the board under this section and Sections 481.074 and 481.075. The board shall use automated information security techniques and devices to preclude improper access to the information. The board shall submit the system design to the director and the Texas Medical Board for review and comment a reasonable time before implementation of the system and shall comply with the comments of those agencies unless it is unreasonable to do so.
(d) Information submitted to the board under this section may be used only for:
(1) the administration, investigation, or enforcement of this chapter or another law governing illicit drugs in this state or another state;
(2) investigatory, evidentiary, or monitoring purposes in connection with the functions of an agency listed in Subsection (a)(1);
(3) the prescribing and dispensing of controlled substances by a person listed in Subsection (a)(5); or
(4) dissemination by the board to the public in the form of a statistical tabulation or report if all information reasonably likely to reveal the identity of each patient, practitioner, or other person who is a subject of the information has been removed.
(e) The board shall remove from the information retrieval system, destroy, and make irretrievable the record of the identity of a patient submitted under this section to the board not later than the end of the 36th calendar month after the month in which the identity is entered into the system. However, the board may retain a patient identity that is necessary for use in a specific ongoing investigation conducted in accordance with this section until the 30th day after the end of the month in which the necessity for retention of the identity ends.
(f) If the board accesses information under Subsection (a)(2) relating to a person licensed or regulated by an agency listed in Subsection (a)(1), the board shall notify and cooperate with that agency regarding the disposition of the matter before taking action against the person, unless the board determines that notification is reasonably likely to interfere with an administrative or criminal investigation or prosecution.
(g) If the board provides access to information under Subsection (a)(3) relating to a person licensed or regulated by an agency listed in Subsection (a)(1), the board shall notify that agency of the disclosure of the information not later than the 10th working day after the date the information is disclosed.
(h) If the board withholds notification to an agency under Subsection (f), the board shall notify the agency of the disclosure of the information and the reason for withholding notification when the board determines that notification is no longer likely to interfere with an administrative or criminal investigation or prosecution.
(i) Information submitted to the board under § 481.074(q) or 481.075 is confidential and remains confidential regardless of whether the board permits access to the information under this section.
(j) The board may enter into an interoperability agreement with one or more states or an association of states authorizing the board to access prescription monitoring information maintained or collected by the other state or states or the association, including information maintained on a central database such as the National Association of Boards of Pharmacy Prescription Monitoring Program InterConnect. Pursuant to an interoperability agreement, the board may authorize the prescription monitoring program of one or more states or an association of states to access information submitted to the board under Sections 481.074(q) and 481.075, including by submitting or sharing information through a central database such as the National Association of Boards of Pharmacy Prescription Monitoring Program InterConnect.
(k) A person authorized to access information under Subsection (a)(4) or (5) who is registered with the board for electronic access to the information is entitled to directly access the information available from other states pursuant to an interoperability agreement described by Subsection (j).