HB 690 - AS AMENDED BY THE HOUSE
03may01...0863h
03may01...1005h
2001 SESSION
09/01
HOUSE BILL 690
AN ACT relative to disclosure of nonpublic personal health information.
This bill requires an insurance licensee to obtain certain authorization before disclosing nonpublic personal health information about consumers or customers. The bill grants the insurance commissioner rulemaking authority to administer the provisions of the bill.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Explanation: Matter added to current law appears in bold italics.
Matter removed from current law appears [in brackets and struckthrough.]
Matter which is either (a) all new or (b) repealed and reenacted appears in regular type.
03may01...0863h
03may01...1005h
01-0377
09/01
STATE OF NEW HAMPSHIRE
In the Year of Our Lord Two Thousand One
AN ACT relative to disclosure of nonpublic personal health information.
Be it Enacted by the Senate and House of Representatives in General Court convened:
1 New Chapter; Disclosure of Nonpublic Personal Health Information. Amend RSA by inserting after chapter 406-C the following new chapter:
CHAPTER 406-D
DISCLOSURE OF NONPUBLIC PERSONAL HEALTH INFORMATION
406-D:1 Definitions. In this chapter:
I. "Clear and conspicuous" means that a notice is reasonably understandable and designed to call attention to the nature and significance of the information in the notice.
II. "Commissioner" means the insurance commissioner.
III. "Consumer" means an individual who in this state seeks to obtain, obtains, or has obtained a health insurance product or service from a licensee.
IV. "Customer" means a consumer who has a customer relationship with a licensee.
V. "Customer relationship" means a continuing relationship between a consumer and a licensee under which the licensee provides health insurance products or services to the consumer.
VI. "Department" means the insurance department.
VII. "Health information" means any information or data except age or gender, whether oral or recorded in any form or medium, created by or derived from a health care provider or the consumer that relates to:
(a) The past, present or future physical, mental or behavioral health or condition of an individual;
(b) The provision of health care to an individual; or
(c) Payment for the provisions of health care to an individual.
VIII. "Licensee" means all licensed health insurers, and producers licensed or authorized or required to be authorized, or registered or required to be registered pursuant to the provisions of Title XXXVII.
IX. "Nonpublic personal health information" means health information:
(a) That identifies an individual who is the subject of the information; or
(b) With respect to which there is a reasonable basis to believe that the information could be used to identify an individual.
406-D:2 Authorization Required for Disclosure of Nonpublic Personal Health Information.
I. A licensee shall not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer whose nonpublic personal health information is sought to be disclosed.
II. Nothing in this chapter shall prohibit, restrict or require an authorization for the disclosure of nonpublic personal health information by a licensee for the performance of the following insurance functions by or on behalf of the licensee: claims administration; claims adjustment and management; detection, investigation or reporting of actual or potential fraud, misrepresentation or criminal activity; underwriting; policy placement or issuance; loss control; ratemaking and guaranty fund functions; reinsurance and excess loss insurance; risk management; case management; disease management; quality assurance; quality improvement; performance evaluation; provider credentialing verification; utilization review; peer review activities; actuarial research; grievance procedures; internal administration of compliance, managerial, and information systems; policyholder service functions; auditing; reporting; database security; administration of consumer disputes and inquiries; external accreditation standards; the replacement of a group benefit plan or workers' compensation policy or program; activities in connection with a sale, merger, transfer or exchange of all or part of a business or operating unit; disclosure that is required, or is one of the lawful or appropriate methods, to enforce the licensee's rights or the rights of other persons engaged in carrying out a transaction or providing a product or service that a consumer requests or authorizes; and any activity otherwise required by law, required pursuant to governmental reporting authority, or to comply with legal process. Additional insurance functions may be added with the approval of the commissioner to the extent they are necessary for appropriate performance of insurance functions and are fair and reasonable to the interest of consumers.
406-D:3 Authorizations.
I. A valid authorization to disclose nonpublic personal health information pursuant to this chapter shall be in written or electronic form and shall contain all of the following:
(a) The identity of the consumer or customer who is the subject of the nonpublic personal health information;
(b) A general description of the types of nonpublic personal health information to be disclosed;
(c) General descriptions of the parties to whom the licensee discloses nonpublic personal health information, the purpose of the disclosure and how the information will be used;
(d) The signature of the consumer or customer who is the subject of the nonpublic personal health information or the individual who is legally empowered to grant authority and the date signed; and
(e) Notice of the length of time for which the authorization is valid and that the consumer or customer may revoke the authorization at any time and the procedure for making a revocation.
II. An authorization for the purposes of this section shall specify a length of time for which the authorization shall remain valid, which in no event shall be for more than 24 months.
III. A consumer or customer who is the subject of nonpublic personal health information may revoke an authorization provided pursuant to this section at any time, subject to the rights of an individual who acted in reliance on the authorization prior to notice of the revocation.
IV. A licensee that is subject to examination by the department shall retain the authorization or a copy thereof in the record of the individual who is the subject of nonpublic personal health information for a period of 6 years from the date the authorization ends or until the examination is completed, whichever is greater.
406-D:4 Authorization Request Delivery. A request for authorization and an authorization form may be delivered to a consumer or a customer as part of an opt-out notice, provided that the request and the authorization form are clear and conspicuous. An authorization form is not required to be delivered to the consumer or customer or included in any other notices unless the licensee intends to disclose protected health information.
406-D:5 Applicability. Nothing in this chapter shall preempt or supercede existing state law related to medical records, health or insurance information privacy.
406-D:6 Rulemaking. The commissioner shall adopt rules, pursuant to RSA 541-A, relative to the administration of this chapter.
406-D:7 Violation. A violation of this chapter shall be deemed to be an unfair method of competition or an unfair or deceptive act and practice in this state, in violation of RSA 417.
2 Effective Date. This act shall take effect 60 days after its passage.