1. (a) A utilization review agent shall preserve the confidentiality of individual medical records to the extent required by law.

2. (b) A utilization review agent may not disclose or publish individual medical records, personal information, or other confidential information about an injured employee obtained in the performance of utilization review without the prior written consent of the injured employee or as otherwise required by law. Personal information shall include, at a minimum, name, address, phone number, social security number, and financial information. If such authorization is submitted by anyone other than the individual who is the subject of the personal or confidential information requested, such authorization must:

   1. (1) be dated; and
   2. (2) contain the signature of the individual who is the subject of the personal or confidential information requested. The signature must have been obtained one year or less prior to the date the disclosure is sought or the authorization is invalid.
3. (c) A utilization review agent may provide confidential information to a third party under contract or affiliated with the utilization review agent for the sole purpose of performing or assisting with utilization review. Information provided to third parties shall remain confidential.

4. (d) If an individual submits a written request to the utilization review agent for access to recorded personal information about the individual, the utilization review agent shall within 10 business days from the date such request is received:

   1. (1) inform the individual submitting the request of the nature and substance of the recorded personal information in writing; and
   2. (2) permit the individual to see and copy, in person, the recorded personal information pertaining to the individual or to obtain a copy of the recorded personal information by mail, at the discretion of the individual, unless the recorded personal information is in coded form, in which case an accurate translation in plain language shall be provided in writing.
5. (e) A utilization review agent's charges for providing a copy of recorded personal information to individuals shall not exceed ten cents per page and may not include any costs that are otherwise recouped as part of the charge for utilization review.
6. (f) The utilization review agent may not publish data which identifies a particular doctor or other health care provider, including any quality review studies or performance tracking data, without prior written notice to the involved health care provider. This prohibition does not apply to internal systems or reports used by the utilization review agent.
7. (g) Documents in the custody of the utilization review agent that contain confidential injured employee information or doctor or other health care provider financial data shall be destroyed by a method which induces complete destruction of the information when the agent determines the information is no longer needed.
8. (h) All injured employee, doctor, and other health care provider data shall be maintained by the utilization review agent in a confidential manner which prevents unauthorized disclosure to third parties. Nothing in this article shall be construed to allow a utilization review agent to take actions that violate a state or federal statute or regulation concerning confidentiality of injured employee records and the confidentiality provisions in the Texas Workers' Compensation Act.
9. (i) To assure confidentiality, a utilization review agent must, when contacting a doctor's office or hospital, provide its certification number, the caller's name, and professional qualifications to the provider's named utilization review representative in the health care provider's office.
10. (j) Upon request by the provider, the utilization review agent shall present written documentation that it is acting as an agent of the insurance carrier for the relevant injured employee.
11. (k) The utilization review agent's procedures shall specify that specific information exchanged for the purpose of conducting reviews will be considered confidential, be used by the review agent solely for the purposes of utilization review, and shared by the utilization review agent with only those third parties who have authority to receive such information. The utilization review agent's process shall specify that procedures are in place to assure confidentiality and that the utilization review agent agrees to abide by the confidentiality provisions of the Texas Workers' Compensation Act and any other federal and state laws governing the issue of confidentiality. Summary data which does not provide sufficient information to allow identification of individual injured employees or health care providers need not be considered confidential.
12. (l) Medical records and injured employee specific information shall be maintained by the utilization review agent in a secure area with access limited to essential personnel only.
13. (m) Information generated and obtained by the utilization review agents in the course of utilization review shall be retained for at least two years from the date of the final decision in the utilization review.
14. (n) Notwithstanding the provisions in subsections (a)-(m) of this section, the utilization review agent shall provide to the commissioner and/or the Texas Workers' Compensation Commission on request individual medical records or other confidential information for determination of compliance with this subchapter. The information is confidential and privileged and is not subject to the open records law, Government Code, Chapter 552, or to subpoena, except to the extent necessary to enable the commissioner to enforce this subchapter.

Source Note:The provisions of this §19.2014 adopted to be effective September 20, 1998, 23 TexReg 9560.