A private review agent may not: violate any provision of this subtitle or any rule or regulation adopted under this subtitle; fail to meet the requirements for certification under this subtitle; obtain or attempt to obtain certification based on inaccurate information; fraudulently or deceptively obtain or use a certificate; fail to make available the services of sufficient numbers of registered nurses, medical records technicians, or similarly qualified persons supported and supervised by appropriate physicians to carry out its utilization review activities; fail to meet any applicable regulations the Commissioner adopts under this subtitle relating to the qualifications of private review agents or the performance of utilization review; fail to protect the confidentiality of medical records in accordance with applicable State and federal laws; use criteria and standards to conduct utilization review unless the criteria and standards used by the private review agent are: objective; clinically valid; compatible with established principles of health care; or flexible enough to allow deviations from norms when justified on a case-by-case basis; or act as a private review agent without holding a certificate issued under this subtitle.