Background:

Under federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes nationwide standards for the use, disclosure, storage, and transfer of protected health information by covered entities. Covered entities include health care providers, health plans, and health care clearinghouses. Covered entities must have patient authorization to use or disclose health care information, unless there is a specified exception.

Under the HIPAA, covered entities must permit an individual to request that the covered entities restrict uses and disclosures of protected health information to carry out treatment, payment, or health care operations. Covered entities are not required to agree to the restriction, unless the disclosure is for the purpose of carrying out payment or health care operations, the disclosure is not otherwise required by law, and the protected health information relates to a health care item or service that has been paid to the covered entity in full. Health plans must accommodate reasonable requests by individuals to receive protected health information by alternative means or at alternative locations if the individual clearly states that disclosure could endanger the individual.

In Washington, the Uniform Health Care Information Act (UHCIA) governs the disclosure of health care information by health care providers and their agents and employees, as well as third-party payors. The UHCIA provides that these entities may not disclose health care information about a patient without the written authorization of the individual, unless there is a statutory exception.

State insurance regulations require that licensed health carriers limit the disclosure of information, including health information, about a person who is the subject of the information if the person states in writing that the disclosure to specified individuals could jeopardize the safety of the person. Upon the request of the person who is the subject of the information, health carriers may not disclose nonpublic personal health information concerning health services related to reproductive health, sexually-transmitted diseases, substance use disorders, and mental health. The limitation applies to mailing appointment notices, calling the home to confirm appointments, or mailing a bill or explanation of benefits to a policyholder.

In the case of a minor who may obtain health care services without the consent of a parent or guardian, a health carrier must recognize the right of the minor to exercise rights related to health information. In addition, the health carrier may not disclose nonpublic personal health information related to health care services to which the minor consented, without the minor's express authorization. The limitation applies to mailing appointment notices, calling the home to confirm appointments, or mailing a bill or explanation of benefits to a policyholder.

Health carriers may not require an adult or a minor who may obtain health care without the consent of a parent or guardian to obtain the authorization of the policyholder or other covered person to receive health care services or to submit a claim.

Summary of Bill:

A "protected individual" is defined as an adult covered as a dependent on an enrollee's health benefit plan or a minor who may obtain health care without the consent of a parent or guardian. The term does not include people who are not competent to provide informed consent for health care. "Sensitive health care services" are defined as health services related to reproductive health, sexually-transmitted diseases, substance use disorder, gender dysphoria, gender-affirming care, domestic violence, and mental health.

Health carriers are prohibited from requiring that protected individuals obtain the authorization of the policyholder or primary subscriber before receiving health care services or submitting a claim.

Upon request of a protected individual, health carriers must direct communications containing any information about a protected individual, including personal health information, to either: (1) the protected individual; or (2) a physical or electronic mail address or telephone number specified by the protected individual. The communication standard applies to information about the receipt of sensitive health care services whether or not a request for such a limitation is made. In the case of sensitive health care services, the communication restrictions apply to:

bills and attempts to collect payments;
notices of adverse benefits determinations;
explanation of benefits notices;
carrier requests for additional information about a claim;
notices of contested claims;
names and addresses of providers, descriptions of services provided, and other visit information; and
any written, oral, or electronic communication from a carrier contains protected health information.

Health carriers must limit the disclosure of any information, including personal health information, about a protected individual if the individual requests a limitation. Health carriers are prohibited from disclosing nonpublic personal health information about sensitive health care services provided to the protected individuals to any person other than the protected individual receiving the care, unless the protected individual has provided written consent or verbal recorded authorization. A protected individual may request that health carrier communications related to the appeal of adverse benefit determinations regarding the receipt of sensitive health care services be sent to another person, including the policyholder or primary subscriber.

Health carriers must limit the disclosure of information consistent with the protected individual's request and ensure that nondisclosure requests remain in effect until the protected individual revokes or modifies them. When a person request an annual accounting of all payments made by the health carrier which count against a person's coverage limits, the person may only receive information about that person's care and not any information about protected individuals who have requested confidential communications.

The Insurance Commissioner must develop and make available a standardized form that protected individuals may submit to a health carrier to make a confidential communications request. The form must inform protected individuals about their right to confidential communications, allow protected individuals to indicate where to redirect communications, and include a disclaimer that it may take up to three business days to process the form. Health carriers must allow protected individuals to use the form to direct communications and to make the request by telephone, email, or the Internet.

The Insurance Commissioner must develop a process for ensuring and monitoring compliance with requests for confidential communications, including monitoring the effectiveness of the process for protected individuals to redirect insurance communications, the extent to which protected individuals are using the process, and whether or not the process is working properly. In addition, the Insurance Commissioner must monitor the education and outreach activities conducted by health carriers to inform protected individuals about their right to confidential communications.

Legislative findings and declarations are made related to the right of people to choose health care services, have confidential access to health care services, the benefits of having the assurance of confidential access to health care services, and the disadvantages of not having confidential access to health care services.