The authority provides data only after the data recipient, as defined by this chapter, has signed a nondisclosure agreement. The authority may prohibit access to or use of the data by a data recipient who violates the nondisclosure agreement.