N.Y. Insurance Law § 4905 – Required and prohibited practices

(a) Each utilization review agent shall have written procedures for assuring that patient-specific information obtained during the process of utilization review will be:
1. (1) kept confidential in accordance with applicable state and federal laws; and
2. (2) shared only with the insured, the insured's designee, the insured's health care provider and those who are authorized by law to receive such information.
(b) Summary data shall not be considered confidential if it does not provide information to allow identification of individual patients.
(c) Any health care professional who makes determinations regarding the medical necessity of health care services during the course of utilization review shall be appropriately licensed, registered or certified.
(d) A utilization review agent shall not, with respect to utilization review activities, permit or provide compensation or anything of value to its employees, agents, or contractors based on:
1. (1) either a percentage of the amount by which a claim is reduced for payment or the number of claims or the cost of services for which the person has denied authorization or payment; or
2. (2) any other method that encourages the rendering of an adverse determination.
(e) If a health care service has been specifically preauthorized or approved for an insured by a utilization review agent, a utilization review agent shall not pursuant to retrospective review revise or modify the specific standards, criteria or procedures used for the utilization review for procedures, treatment and services delivered to the insured, during the same course of treatment. * (f) Utilization review shall not be conducted more frequently than is reasonably required to assess whether the health care services under review are medically necessary. * NB Effective until January 1, 2027 * (f) Utilization review shall not be conducted more frequently than is reasonably required to assess whether the health care services under review are medically necessary provided, however, that utilization review shall not be conducted more than once per year for an outpatient course of treatment for a chronic health condition starting from the date of a pre-authorization approval for the course of treatment unless the insured's attending provider recommends a change to the course of treatment, then utilization review may be conducted for the new course of treatment. Any new treatment, testing or procedures related to the specific medical problem, condition, or illness being managed but not already included in the approved course of treatment may be subject to a separate pre-authorization. * NB Effective January 1, 2027
(g) When making prospective, concurrent and retrospective determinations, utilization review agents shall collect only such information as is necessary to make such determination and shall not routinely require health care providers to numerically code diagnoses or procedures to be considered for certification or routinely request copies of medical records of all patients reviewed. During prospective or concurrent review, copies of medical records shall only be required when necessary to verify that the health care services subject to such review are medically necessary. In such cases, only the necessary or relevant sections of the medical record shall be required. A utilization review agent may request copies of partial or complete medical records retrospectively.
(h) In no event shall information be obtained from the health care providers for the use of the utilization review agent by persons other than health care professionals, medical record technologists or administrative personnel who have received appropriate training.
(i) The utilization review agent shall not undertake utilization review at the site of the provision of health care services unless the utilization review agent:
1. (1) Identifies himself or herself by name and the name of his or her organization, including displaying photographic identification which includes the name of the utilization review agent and clearly identifies the individual as representative of the utilization review agent;
2. (2) Whenever possible, schedules review at least one business day in advance with the appropriate health care provider;
3. (3) If requested by a health care provider, assures that the on-site review staff register with the appropriate contact person, if available, prior to requesting any clinical information or assistance from the health care provider; and
4. (4) Obtains consent from the insured or the insured's designee before interviewing the patient's family, or observing any health care service being provided to the insured.
5. (5) This subsection shall not apply to health care professionals engaged in providing care or case management or making on-site discharge decisions.
(j) A utilization review agent shall not base an adverse determination on a refusal to consent to observing any health care service.
(k) A utilization review agent shall not base an adverse determination on lack of reasonable access to a health care provider's medical or treatment records unless the utilization review agent has provided reasonable notice to the insured, the insured's designee or the insured's health care provider, in which case the insured must be notified, and has complied with all provisions of subsection (i) of this section.
(l) Neither the utilization review agent nor the entity for which the agent provides utilization review shall take any action with respect to a patient or a health care provider that is intended to penalize such insured, the insured's designee, or the insured's health care provider for, or to discourage such insured, the insured's designee, or the insured's health care provider from undertaking an appeal, dispute resolution or judicial review of an adverse determination.
(m) In no event shall an insured, an insured's designee, an insured's health care provider, any other health care provider, or any other person or entity be required to inform or contact the utilization review agent prior to the provision of emergency care, including emergency treatment or emergency admission.
(n) No contract or agreement between a utilization review agent and a health care provider shall contain any clause purporting to transfer to the health care provider by indemnification or otherwise any liability relating to activities, actions or omissions of the utilization review agent as opposed to the health care provider.
(o) A health care professional providing health care services to an insured shall be prohibited from serving as the clinical peer reviewer for such insured in connection with the health care services being provided to the insured.