An entity that contracts with an independent third party to conduct audits may not:

(1) Agree to compensate the independent third party based on a percentage of the amount of overpayments recovered; or

(2) Disclose information obtained during an audit except to the contracting entity, the pharmacy subject to the audit, or the holder of the policy or certificate of insurance that paid the claim.