1. (a) Except as provided in (b) of this section or in 3 AAC 26.695(a), a licensee may not disclose nonpublic personal health information about a consumer unless authorization that complies with 3 AAC 26.685 is obtained from the consumer whose nonpublic personal health information the licensee seeks to disclose.

2. (b) A licensee may disclose a consumer's nonpublic personal health information without obtaining authorization from the consumer if the disclosure is

   1. (1) required by federal or state law or regulation or is otherwise allowed by law;
   2. (2) in response to an order issued by a governmental regulatory authority with jurisdiction over a licensee for examination, investigation, compliance, or other purposes authorized by law;
   3. (3) compelled by a subpoena, search warrant, or other order issued by a court or administrative agency of competent jurisdiction;
   4. (4) for detection, investigation, or reporting of fraud, misrepresentation, or another violation of law;

   5. (5) for the performance of the following insurance functions by or on behalf of the licensee:

      1. (A) claims administration;
      2. (B) claims adjustment or management;
      3. (C) underwriting;
      4. (D) policy placement or issuance;
      5. (E) loss control;
      6. (F) rate development;
      7. (G) guaranty fund functions;
      8. (H) reinsurance, stop-loss insurance, or excess loss insurance;
      9. (I) risk management;
      10. (J) case management;
      11. (K) disease management;
      12. (L) quality assurance or improvement;
      13. (M) performance evaluation;
      14. (N) verification of provider credentials;
      15. (O) utilization review;
      16. (P) peer review activities;
      17. (Q) actuarial, scientific, medical, or public policy research;
      18. (R) grievance procedures;
      19. (S) internal administration of compliance, managerial, and information systems;
      20. (T) policyholder service functions;
      21. (U) auditing;
      22. (V) reporting;
      23. (W) database security;
      24. (X) administration of consumer disputes and inquiries;
      25. (Y) external accreditation standards;
      26. (Z) replacement of a group benefit plan or workers' compensation policy or program;
      27. (AA) activities in connection with the sale, merger, transfer, or exchange of all or part of a business or operating unit;
   6. (6) required to enforce the licensee's rights or the rights of other licensees engaged in carrying out an insurance transaction or providing an insurance product or service that a consumer or customer requests or authorizes; or
   7. (7) allowed without requiring authorization under 45 C.F.R. Parts 160 and 164.

(Eff. 1/1/2005, Register 172)