Section 18. When Authorization Required for Disclosure of Nonpublic Personal Health Information.

A. A licensee shall not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer whose nonpublic personal health information is sought to be disclosed.

B. Nothing in this section shall prohibit, restrict or require an authorization for the disclosure of nonpublic personal health information by a licensee for the performance of the following insurance functions by or on behalf of the licensee: claims administration; claims adjustment and management; detection, investigation or reporting of actual or potential fraud, misrepresentation or criminal activity; underwriting; policy placement or issuance; loss control; ratemaking and guaranty fund functions; reinsurance and excess loss insurance; risk management; case management; disease management; quality assurance; quality improvement; performance evaluation; provider credentialing verification; utilization review; peer review activities; actuarial, scientific, medical or public policy research; grievance procedures; internal administration of compliance, managerial, and information systems; policyholder service functions; auditing; reporting; database security; administration of consumer disputes and inquiries; external accreditation standards; the replacement of a group benefit plan or workers compensation policy or program; activities in connection with a sale, merger, transfer or exchange of all or part of a business or operating unit; any activity that permits disclosure without authorization pursuant to the federal Health Insurance Portability and Accountability Act privacy rules promulgated by the U.S. Department of Health and Human Services; disclosure that is required, or is one of the lawful or appropriate methods, to enforce the licensee’s rights or the rights of other persons engaged in carrying out a transaction or providing a product or service that a consumer requests or authorizes; and any activity otherwise permitted by law, required pursuant to governmental reporting authority, or to comply with legal process. Additional insurance functions may be added with the approval of the Director to the extent they are necessary for appropriate performance of insurance functions and are fair and reasonable to the interest of consumers.

HISTORY: Added by State Register Volume 25, Issue No. 7, eff July 27, 2001. Former R 69-58 Sections 17 transferred and amended by SCSR 42-1 Doc. No. 4805, eff January 26, 2018.

Section 19. Authorizations.

A. A valid authorization to disclose nonpublic personal health information pursuant to this Article V shall be in written or electronic form and shall contain all of the following:

(1) The identity of the consumer or customer who is the subject of the nonpublic personal health information;

(2) A general description of the types of nonpublic personal health information to be disclosed;

(3) General descriptions of the parties to whom the licensee discloses nonpublic personal health information, the purpose of the disclosure and how the information will be used;

(4) The signature of the consumer or customer who is the subject of the nonpublic personal health information or the individual who is legally empowered to grant authority and the date signed; and

(5) Notice of the length of time for which the authorization is valid and that the consumer or customer may revoke the authorization at any time and the procedure for making a revocation.

B. An authorization for the purposes of this Article V shall specify a length of time for which the authorization shall remain valid, which in no event shall be for more than twenty-four (24) months.

C. A consumer or customer who is the subject of nonpublic personal health information may revoke an authorization provided pursuant to this Article V at any time, subject to the rights of an individual who acted in reliance on the authorization prior to notice of the revocation.

D. A licensee shall retain the authorization or revocation or a copy thereof in the record of the individual who is the subject of nonpublic personal health information.

HISTORY: Added by State Register Volume 25, Issue No. 7, eff July 27, 2001. Former R 69-58 Sections 18 transferred and amended by SCSR 42-1 Doc. No. 4805, eff January 26, 2018.

Section 20. Authorization Request Delivery.

A request for authorization and an authorization form may be delivered to a consumer or a customer as part of an opt-out notice pursuant to Section 11, provided that the request and the authorization form are clear and conspicuous. An authorization form is not required to be delivered to the consumer or customer or included in any other notices unless the licensee intends to disclose protected health information and nonpublic personal health information pursuant to Section 18A.

HISTORY: Added by State Register Volume 25, Issue No. 7, eff July 27, 2001. Former R 69-58 Sections 19 transferred and amended by SCSR 42-1 Doc. No. 4805, eff January 26, 2018.

Section 21. Relationship to Federal Rules.

Irrespective of whether a licensee is subject to the federal Health Insurance Portability and Accountability Act privacy rule as promulgated by the U.S. Department of Health and Human Services 45 CFR Part 160 (the “federal rule”), if a licensee complies with all requirements of the federal rule except for its effective date provision, the licensee shall not be subject to the provisions of this Article V.

HISTORY: Added by State Register Volume 25, Issue No. 7, eff July 27, 2001. Former R 69-58 Sections 20 transferred and amended by SCSR 42-1 Doc. No. 4805, eff January 26, 2018.

Section 22. Relationship to State Laws.

Nothing in this article shall preempt or supersede existing state law related to medical records, health or insurance information privacy.

HISTORY: Added by State Register Volume 25, Issue No. 7, eff July 27, 2001. Former R 69-58 Sections 21 transferred and amended by SCSR 42-1 Doc. No. 4805, eff January 26, 2018.