Except pursuant to § 22.57 of this subchapter (relating to Exceptions) a covered entity must obtain an authorization to disclose any nonpublic personal health information about a consumer to another party before making such a disclosure.
28 Tex. Admin. Code § 22.53