(a) The information management, reporting, and tracking system provided in accordance with this chapter must meet confidentiality requirements in accordance with required state and federal privacy guidelines.
(b) Data obtained through the information management, reporting, and tracking system under this chapter are for the confidential use of the department, the department’s designee, and the persons or public or private entities that the department determines are necessary to carry out the functions of the tracking system.

(c) The executive commissioner by rule shall develop guidelines to protect the confidentiality of patients in accordance with Chapter 159, Occupations Code, and require the written or electronic consent of a parent or guardian of a patient before any individually identifying information is provided to the department or the primary statewide resource center established under § 30.051, Education Code, as set out in this chapter. The department and center shall permit a parent or guardian at any time to withdraw information provided to the department or center under this chapter.
(d) Statistical or aggregated information that is about activities conducted under this chapter and that could not be used to individually identify a newborn, infant, or patient or a parent or guardian of a newborn, infant, or patient is not confidential.