1. (1) A licensee may not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer before the disclosure.

2. (2) This Section R590-206-18 does not prohibit, restrict, or require an authorization for the disclosure of nonpublic personal health information by a licensee for the performance of the following:

   1. (a) claims administration, adjustment, or management;
   2. (b) detecting, investigating, or reporting fraud, misrepresentation, or criminal activity;
   3. (c) underwriting;
   4. (d) policy placement or issuance;
   5. (e) loss control;
   6. (f) ratemaking or guaranty fund functions;
   7. (g) reinsurance or excess loss insurance;

   8. (h) risk management;

      1. (i) case management;
   9. (j) disease management;

   10. (k) quality assurance or quality improvement;

       1. (l) performance evaluation;
   11. (m) provider credentialing verification;
   12. (n) utilization review;
   13. (o) peer review activities;
   14. (p) actuarial, scientific, medical, or public policy research;
   15. (q) grievance procedures;
   16. (r) internal administration of compliance, managerial, or information systems;
   17. (s) policyholder service functions;
   18. (t) auditing;

   19. (u) reporting;

       1. (v) database security;

   20. (w) administration of consumer disputes and inquiries;

       1. (x) external accreditation standards;
   21. (y) replacement of a group benefit plan or workers compensation policy or program;
   22. (z) activities in connection with a sale, merger, transfer, or exchange of all or part of a business or operating unit;
   23. (aa) an activity that permits disclosure without authorization pursuant to the Health Insurance Portability and Accountability Act;
   24. (bb) disclosure that is required to enforce a licensee's rights or the rights of other persons engaged in carrying out a transaction or providing a product or service that a consumer requests or authorizes; and
   25. (cc) an activity permitted by law, required by a governmental reporting authority, or to comply with legal process.

KEY: insurance law

Date of Last Change: November 21, 2023

Notice of Continuation: May 19, 2026

Authorizing, and Implemented or Interpreted Law: 31A-2-201; 31A-23a-417; 15 U.S.C. 6801-6820