Ohio Rev. Code Ann. § 3901.89 – Health plan issuers release claim information to group plan policyholders

(A) As used in this section:
1. (1) "Full-time employee" means an employee working an average of at least thirty hours of service per week during a calendar month, or at least one hundred thirty hours of service during the calendar month.
2. (2) "Group policyholder" means a policyholder for a health insurance policy covering fifty or more full-time employees. "Group policyholder" includes an authorized representative of a group policyholder.
3. (3) "Health plan issuer" has the same meaning as in section 3922.01 of the Revised Code.
(B)
1. (1)
  1. (a) A health plan issuer shall, upon request, release to each group policyholder monthly claims data and shall provide this data within thirty business days of receipt of the request.
  2. (b) A health plan issuer shall not be required to release claims information as required in division (B)(1)(a) of this section more than once per calendar year per group policyholder.
2. (2) The data released shall include all of the following with regard to the policy in question for the policy period immediately preceding or the current policy period, as requested by the policyholder:
  1. (a) The net claims paid or incurred by month;
  2. (b)
    1. (i) If the group policyholder is an employer, the monthly enrollment data by employee only, employee and spouse, and employee and family;
    2. (ii) If the group policyholder is not an employer, the monthly enrollment data shall be provided and organized in a relevant manner.
  3. (c) Monthly prescription claims information;
  4. (d) Paid claims over thirty thousand dollars, including claim identifier other than name and the date of occurrence, the amount paid toward each claim, and claimant health condition or diagnosis.
(C) A health plan issuer that discloses data or information in compliance with division (B) of this section may condition any such disclosure upon the execution of an agreement with the policyholder absolving the health plan issuer from civil liability related to the use of such data or information.
(D) A health plan issuer that provides data or information in compliance with division (B) of this section shall be immune from civil liability for any acts or omissions of any person's subsequent use of such data or information.
(E) This section shall not be construed as authorizing the disclosure of the identity of a particular individual covered under the group policy, nor the disclosure of any covered individual's particular health insurance claim, condition, or diagnosis, which would violate federal or state law.
(F) A group policyholder is entitled to receive protected health information under this section only after an appropriately authorized representative of the group policyholder makes to the health plan issuer a certification substantially similar to the following: "I hereby certify and have demonstrated that the plan documents comply with the requirements of 45 C.F.R. 164.504(f)(2) and that the group policyholder will safeguard and limit the use and disclosure of protected health information that the policyholder may receive from the group health plan to perform plan administration functions."
(G) A group policyholder that does not provide the certification required in division (F) of this section is not entitled to receive the protected health information described in division (B)(2)(d) of this section, but is entitled to receive a report of claim information that includes the other information described under division (B) of this section.
(H) Committing a series of violations of this section that, taken together, constitute a practice or pattern shall be considered an unfair or deceptive practice under sections 3901.19 to 3901.26 of the Revised Code.
(I) Nothing in this section shall be construed as prohibiting a health plan issuer from disclosing additional claims information beyond what is required by this section.