(a) Information that identifies an individual covered by a plan is confidential.
(b) During the time information described by Subsection (a) is in an administrator’s custody or control, the administrator shall take all reasonable precautions to prevent disclosure or use of the information for a purpose unrelated to administration of the plan.

(c) The administrator shall disclose information described by Subsection (a) only:
(1) in response to a court order;
(2) for an examination conducted by the commissioner under this chapter;
(3) for an audit or investigation conducted under the Employee Retirement Income Security Act of 1974 (29 U.S.C. § 1001 et seq.);
(4) to or at the request of the insurer or plan sponsor; or
(5) with the written consent of the identified individual or the individual’s legal representative.