(a) The following data received by the Department of State Health Services (department) from a hospital is confidential under authority of the Health and Safety Code, Chapters 104 and 311:(1) information relating to a specific patient; and(2) financial information relating to a provider or hospital that was submitted prior to September 1, 1987. All financial data regarding a provider or facility submitted after September 1, 1987, are no longer confidential.(b) The department will establish appropriate internal controls to maintain confidentiality of patient level data.(c) The department will disclose confidential patient information to a third party only upon receipt of appropriate written consent of the patient.