Pennsylvania Code › Title 31 - INSURANCE › Part VIII - Miscellaneous Provisions › Chapter 146b - PRIVACY OF CONSUMER HEALTH INFORMATION › Subchapter B - RULES FOR DISCLOSURE OF NONPUBLIC PERSONAL HEALTH INFORMATION › Section 146b.11 - Authorization required for disclosure of nonpublic personal health information

Current through Register Vol. 54, No. 28, July 13, 2024
(a)
Authorization required.
A licensee may not disclose nonpublic
				  personal health information about a consumer unless an authorization is
				  obtained from the consumer whose nonpublic personal health information is
				  sought to be disclosed.
(b)
Insurance function exception.
Nothing in this section
				  prohibits, restricts or requires an authorization for the disclosure of
				  nonpublic personal health information by a licensee to the extent that the
				  disclosure of nonpublic personal health information is necessary for the
				  performance of one or more of the following insurance functions by or on behalf
				  of the licensee:
(1) Claims administration,
				  including coordination of benefits and subrogation.
(2) Claims adjustment, investigation,
				  negotiation, settlement and management.
(3) Detection, prevention, investigation or
				  reporting of actual or potential fraud, misrepresentation or criminal
				  activity.
(4)
				  Underwriting.
(5) Policy placement
				  or issuance.
(6) Loss
				  control.
(7) Ratemaking and
				  guaranty fund functions.
(8)
				  Reinsurance and excess loss insurance.
(9) Risk management.
(10) Case management.
(11) Disease management and wellness
				  programs.
(12) Quality
				  assurance.
(13) Quality
				  improvement.
(14) Performance
				  evaluation.
(15) Provider training,
				  accreditation or certification by a recognized accrediting or certifying body,
				  license and credential verification.
(16) Utilization review.
(17) Peer review activities.
(18) Actuarial, scientific, medical or public
				  policy research.
(19) Grievance and
				  complaint procedures.
(20) Internal
				  administration of compliance, managerial and information systems.
(21) Policyholder service
				  functions.
(22) Auditing.
(23) Reporting (examples include reporting to
				  medical index or consumer reporting bureaus and legally required reporting of
				  disease, injury, vital statistics, child or adult abuse, neglect or domestic
				  violence).
(24) Database
				  security.
(25) Administration of
				  consumer disputes and inquiries.
(26) External accreditation
				  standards.
(27) The replacement of
				  a group benefit plan or workers compensation policy or program.
(28) Activities in connection with a sale,
				  merger, transfer or exchange of all or part of a business or operating
				  unit.
(29) An activity that permits
				  disclosure without authorization under the Federal regulation.
(30) Disclosure that is required, or is one
				  of the lawful or appropriate methods, to enforce the licensee's rights or the
				  rights of other persons engaged in carrying out a transaction or providing a
				  product or service that a consumer requests or authorizes.
(31) An activity otherwise permitted by law,
				  required under governmental regulatory or reporting authority, or to comply
				  with legal process.
(32) Compliance
				  with qualified medical child support Orders.
(33) Preventive service reminders that do not
				  require disclosure of nonpublic personal health information that a consumer has
				  not previously disclosed directly to the recipient of the
				  information.