A private review agent may not disclose or publish individual medical records or any other confidential medical information obtained in the performance of utilization review activities without the appropriate procedures for protecting the patient's confidentiality. However, nothing in this subchapter shall prohibit private review agents from providing patient information to a third party whom the private review agent is affiliated with, under contract with, or acting on behalf of.