Brief Summary of Substitute Bill

(As Amended by Committee)

Directs the Insurance Commissioner to develop a form for certain persons who are covered as dependents on an enrollee's health benefit plan to indicate where the person would like to direct health carrier communications containing information about the person, including personal health information.
Requires health carriers to direct all communications containing information about a person, including personal health information and the receipt of sensitive health care services, directly to the person receiving the care.
Prohibits health carriers from requiring that certain protected individuals obtain the authorization of the primary subscriber before receiving health care services.
Prohibits health carriers from requiring a policyholder to pay for charges for health care services if the services were not authorized by the policyholder and the person receiving the services instructed the health carrier to direct communications about the receipt of the services to an address other than that of the policyholder.

Background:

Under federal law, the Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes nationwide standards for the use, disclosure, storage, and transfer of protected health information by covered entities. Covered entities include health care providers, health plans, and health care clearinghouses. Covered entities must have patient authorization to use or disclose health care information, unless there is a specified exception.

Under the HIPAA, covered entities must permit an individual to request that the covered entities restrict uses and disclosures of protected health information to carry out treatment, payment, or health care operations. Covered entities are not required to agree to the restriction, unless the disclosure is for the purpose of carrying out payment or health care operations, the disclosure is not otherwise required by law, and the protected health information relates to a health care item or service that has been paid to the covered entity in full. Health plans must accommodate reasonable requests by individuals to receive protected health information by alternative means or at alternative locations if the individual clearly states that disclosure could endanger the individual.

In Washington, the Uniform Health Care Information Act (UHCIA) governs the disclosure of health care information by health care providers and their agents and employees, as well as third-party payors. The UHCIA provides that these entities may not disclose health care information about a patient without the written authorization of the individual, unless there is a statutory exception.

State insurance regulations require that licensed health carriers limit the disclosure of information, including health information, about a person who is the subject of the information if the person states in writing that the disclosure to specified individuals could jeopardize the safety of the person. Upon the request of the person who is the subject of the information, health carriers may not disclose nonpublic personal health information concerning health services related to reproductive health, sexually transmitted diseases, substance use disorders, and mental health. The limitation applies to mailing appointment notices, calling the home to confirm appointments, or mailing a bill or explanation of benefits to a policyholder.

In the case of a minor who may obtain health care services without the consent of a parent or guardian, a health carrier must recognize the right of the minor to exercise rights related to health information. In addition, the health carrier may not disclose nonpublic personal health information related to health care services to which the minor consented, without the minor's express authorization. The limitation applies to mailing appointment notices, calling the home to confirm appointments, or mailing a bill or explanation of benefits to a policyholder.

Health carriers may not require an adult or a minor who may obtain health care without the consent of a parent or guardian to obtain the authorization of the policyholder or other covered person to receive health care services or to submit a claim.

–––––––––––––––––––––––––––––––––

Summary of Amended Bill:

A "protected individual" is defined as an adult covered as a dependent on an enrollee's health benefit plan or a minor who may obtain health care without the consent of a parent or guardian. The term does not include people who are not competent to provide informed consent for health care. "Sensitive health care services" are defined as health services related to reproductive health, sexually transmitted diseases, substance use disorder, gender dysphoria, gender-affirming care, domestic violence, and mental health.

Health carriers are prohibited from requiring that protected individuals obtain the authorization of the policyholder or primary subscriber before receiving health care services or submitting a claim.

Upon request of a protected individual, health carriers must direct communications containing any information about a protected individual, including personal health information, to either: (1) the protected individual; or (2) a physical or electronic mail address or telephone number specified by the protected individual. The communication standard applies to information about the receipt of sensitive health care services whether or not a request for such a limitation is made. In the case of sensitive health care services, the communication restrictions apply to:

bills and attempts to collect payments;
notices of adverse benefits determinations;
explanation of benefits notices;
carrier requests for additional information about a claim;
notices of contested claims;
names and addresses of providers, descriptions of services provided, and other visit information; and
any written, oral, or electronic communication from a carrier that contains protected health information.

Health carriers must limit the disclosure of any information, including personal health information, about a protected individual if the individual requests a limitation. Health carriers are prohibited from disclosing nonpublic personal health information about sensitive health care services provided to the protected individuals to any person other than the protected individual receiving the care, unless the protected individual has provided written consent or verbal recorded authorization. A protected individual may request that health carrier communications related to the appeal of adverse benefit determinations regarding the receipt of sensitive health care services be sent to another person, including the policyholder or primary subscriber.

Health carriers must limit the disclosure of information consistent with the protected individual's request and ensure that nondisclosure requests remain in effect until the protected individual revokes or modifies them. When a person request an annual accounting of all payments made by the health carrier which count against a person's coverage limits, the person may only receive information about that person's care and not any information about protected individuals who have requested confidential communications.

Health carriers are prohibited from requiring a policyholder or primary subscriber to pay for charges for health care services if the policyholder or primary subscriber has not authorized the receipt of health care services for a protected individual and the protected individual has instructed the health carrier to direct communications to an address other than that of the policyholder or primary subscriber.

The Insurance Commissioner must develop and make available a standardized form that protected individuals may submit to a health carrier to make a confidential communications request. The form must inform protected individuals about their right to confidential communications, allow protected individuals to indicate where to redirect communications, and include a disclaimer that it may take up to three business days to process the form. Health carriers must allow protected individuals to use the form to direct communications and to make the request by telephone, electronic mail, or the Internet.

The Insurance Commissioner must develop a process for ensuring and monitoring compliance with requests for confidential communications, including monitoring the effectiveness of the process for protected individuals to redirect insurance communications, the extent to which protected individuals are using the process, and whether or not the process is working properly. In addition, the Insurance Commissioner must monitor the education and outreach activities conducted by health carriers to inform protected individuals about their right to confidential communications.

Legislative findings and declarations are made related to the right of people to choose health care services, have confidential access to health care services, the benefits of having the assurance of confidential access to health care services, and the disadvantages of not having confidential access to health care services.

Staff Summary of Public Testimony:

(In support) When a patient is covered on another person's policy, communications about claims often go to the policyholder which potentially discloses the patient's confidential health information. With children now able to stay on their parent's insurance policies until age 26, it raises issues about what adult offspring want their parents to know. All people should be able to confidentially access health care, but this is not a reality for many who are insured as dependents, such as young people or people on their spouse's plan, even if they have a legal right to access and consent to care. Confidentiality remains a problem because stigma is still a problem in behavioral health. A 2014 survey found that 61 percent of women ages 18 to 44 years old, and 71 percent of women 18 to 25 years old, reported that it is vital that information about their health care visits be kept confidential from a parent or spouse.

Existing confidentiality protections are inadequate, unclear, and have been inconsistently implemented and enforced which has led to inadvertent disclosure of sensitive information throughout the insurance billing and claims process. Privacy violations could have severe consequences, especially for young people and people experiencing domestic violence.

The Office of the Insurance Commissioner has been working on this issue through the rulemaking process and concluded that a legislative solution is necessary to adequately protect consumers. This bill was drafted with substantial input from a wide range of stakeholders. Other states have already implemented similar protections. The Governor's Interagency Council on Health Disparities, the Bree Collaborative, and the Department of Health's 2017 Unintended Pregnancy report have identified confidentiality concerns for people insured as dependents as a significant health care barrier.

This bill will provide strong and clear protections that will allow more people to safely use their insurance to get care. This bill will decrease the burden on state programs and safety net providers by ensuring that individuals who have private insurance can use that coverage safely to get the care they need. This bill can make all treatment more widely available and accessed, including mental health, physical health, and chemical dependency treatment.

About one-third of students in their first year of college have expressed experiencing a symptom that could indicate a serious mental illness, although not many reach out to get the care that they need and one of the barriers that they identify is the lack of confidentiality. Three students at one university in Washington have taken their lives this year and this bill could give students the confidence to seek treatment. This bill will help with the growing college suicide problem.

(Opposed) None.