(a) Purpose. This subchapter governs the treatment by all covered entities of a consumer's nonpublic personal health information. This subchapter:(1) requires a covered entity to obtain an authorization prior to disclosing nonpublic personal health information about a consumer to any other person for any purpose other than as enumerated in §22.57 of this subchapter (relating to Exceptions); and(2) describes exceptions to the authorization requirement for certain insurance related transactions and other purposes enumerated in this subchapter.(b) Scope. This subchapter applies to all nonpublic personal health information held by a covered entity as defined in this subchapter.