(1)(a) Notwithstanding other provisions of this chapter, a licensee shall limit disclosure of any information, including health information, about an individual who is the subject of the information if the individual clearly states in writing that disclosure to specified individuals of all or part of that information could jeopardize the safety of the individual. Disclosure of information under this subsection shall be limited consistent with the individual's request, such as a request for the licensee to not release any information to a spouse to prevent domestic violence.

(b) Whenever the licensee is a health carrier, as defined in WAC 284-43-0160, and the request relates to a protected individual, as defined in RCW 48.43.005, the health carrier must follow RCW 48.43.505.

(2)(a) Notwithstanding any insurance law requiring the disclosure of information, a licensee shall not disclose nonpublic personal health information concerning health services related to reproductive health, sexually transmitted diseases, chemical dependency and mental health, including mailing appointment notices, calling the home to confirm appointments, or mailing a bill or explanation of benefits to a policyholder or certificate holder, if the individual who is the subject of the information makes a written request. In addition, a licensee shall not require an adult individual to obtain the policyholder's or other covered person's authorization to receive health care services or to submit a claim.

(b) Whenever the licensee is also a health carrier, as defined in WAC 284-43-0610, and the request relates to a protected individual, as defined in RCW 48.43.005, the health carrier must follow RCW 48.43.505.

(3)(a) A licensee shall recognize the right of any minor who may obtain health care without the consent of a parent or legal guardian pursuant to state or federal law, to exclusively exercise rights granted under this section regarding health information; and

(b) Shall not disclose any nonpublic personal health information related to any health care service to which the minor has lawfully consented, including mailing appointment notices, calling the home to confirm appointments, or mailing a bill or explanation of benefits to a policyholder or other covered person, without the express authorization of the minor. In addition, a licensee shall not require the minor to obtain the policyholder's or other covered person's authorization to receive health care services or to submit a claim as to health care which the minor may obtain without parental consent under state or federal law; and

(c) Whenever the licensee is also a health carrier, as defined in WAC 284-43-0610, the health carrier must follow RCW 48.43.505.

(4) When requesting nondisclosure, the individual shall include in the request:

(a) Their name and address;

(b) Description of the type of information that should not be disclosed;

(d) The identity or description of the types of persons from whom information should be withheld;

(e) Information as to how payment will be made for any benefit cost sharing;

(f) A phone number or email address where the individual may be reached if additional information or clarification is necessary to satisfy the request.

(5) Where the licensee is required to follow RCW 48.43.505, the nondisclosure request shall be made using the form in RCW 48.43.505(4).

(1) A health carrier must direct all communication regarding sensitive health care services, including communications subject to confidentiality, directly to the protected individual. To facilitate communication of these services, a carrier must allow the protected individual to select their preferred communication format unless the format is otherwise specified by law or regulation and may provide sensitive health services communications to the protected individual by:

(a) Health care portal that is only accessible to the protected individual;

(b) Email address, if provided by the protected individual;

(d) Mail to the address requested by a protected individual, and if no address has been requested, then mail to the known address if the communication and envelope are addressed only to the protected individual.

(2) When a protected individual provides their express written consent or verbal authorization on a recorded line, a health carrier may disclose information concerning sensitive health care services for that protected individual as specified by the protected individual.

(3) A health carrier must establish a process for informing enrollees, including protected individuals, of how communications regarding sensitive health care services are managed, including the process to update the protected individual's contact information.

(a) Health carriers must post a confidentiality request form clearly and conspicuously on its website for individuals to change their communication preferences regarding sensitive health information, such as updating their address, or to select another means of communication. When carriers post the form on their website, or make the form available through other means, the form must accompany clear instructions about how a protected individual or enrollee may submit the form including other means available to change the contact information regarding sensitive health care information. If carriers utilize their own confidentiality request form, then carriers must also provide a link to the form specified for use and made available on the office of the insurance commissioner's website. Carriers must accept the form specified by the commissioner when submitted by an enrollee, authorized representative, or provider acting on behalf of the enrollee.

(b) Health carriers must implement the request and any subsequent request for changes within three business days from receipt of the request. If a request is incomplete or missing information, the carrier must implement as much of the request as possible, and contact the enrollee to obtain a complete request within three business days.

(4) For the purposes of appealing an adverse benefit determination, a protected individual may request that a health carrier direct sensitive health care communications and communications subject to confidentiality to another individual including, but not limited to, the policyholder, primary subscriber, or health care provider.

(5) Confidentiality of sensitive health care services does not prevent a health carrier from communicating with a provider, health care benefit manager, third-party administrator, another carrier and other HIPAA covered entities when necessary to process claims, state or federal mandated reporting, or for other activities necessary to ensure coverage including, but not limited to, coordination of benefits. If a carrier needs to communicate with a health care benefit manager or third-party administrator, then the health care benefit manager or third-party administrator must first ensure continued confidentiality, including continuing to communicate with the protected individual using their selected method of communication. If a carrier has a need to discuss services with another carrier or insurer, they must notify the other carrier or insurer of these requirements or ensure that they are aware of these requirements and any existing confidentiality requests.

(6) Communications and confidentiality required by this section must be provided according to the terms and requirements set forth in RCW 48.43.505.

(1) When requested by an enrollee, a health carrier must limit disclosure of that enrollee's information, including personal health information and communications subjected to confidentiality. Once limited, a health carrier must communicate directly with the enrollee through the identified physical address, email, telephone number, or carrier portal.

(2) Health carriers must establish a process for informing enrollees, including protected individuals, of the ability to request confidentiality, limit disclosure, and update their contact information. Enrollees must be able to provide a request telephonically, or submit it by email or online, such as through a portal or on the carrier's webpage.

(a) Health carriers must post a confidentiality request form clearly and conspicuously on their website for individuals limit disclosure or to change their limits regarding communication preferences, such as updating their address, or selecting another means of communication. When carriers post the form on their website, or make the form available through other means, carriers must ensure that the form is accompanied by clear instructions about how a protected individual or enrollee may submit the form and the process, including other means available to change the enrollee's contact information. If carriers utilize their own confidentiality request form, then carriers must also provide a link to the form specified for use and made available on the office of the insurance commissioner's website. Carriers must accept the form specified by the commissioner when submitted by an enrollee, authorized representative, or provider acting on behalf of the enrollee.

(b) Carriers must implement the request and any subsequent request for changes within three business days from receipt of the request. If a request is incomplete or missing information, the carrier must implement as much of the request as possible, and contact the enrollee to obtain a complete request within three business days.

(3) Requests to limit disclosure do not prevent a health carrier from communicating with a provider, health care benefit manager, third-party administrator, another carrier and other HIPAA covered entities when necessary to process claims, state or federal mandated reporting, or for other activities necessary to ensure coverage including, but not limited to, coordination of benefits. If a carrier needs to communicate with a health care benefit manager or third-party administrator, then the benefit manager or third-party administrator must first ensure continued confidentiality, including continuing to communicate with the enrollee using their selected method of communication. If a carrier has a need to discuss services with another carrier or insurer, they must notify the other carrier or insurer of these requirements or ensure that they are aware of these requirements and any existing confidentiality requests.

(4) Confidentiality required by this section must be provided according to the terms and requirements set forth in RCW 48.43.505.

(5) Carriers must have processes and procedures in place to track information related to confidentiality requests made under the requirements of this subchapter and RCW 48.43.505, including the number of requests received by the carrier and the related time frames for processing the request. Carriers will submit this information to the commissioner when requested.

(1) This section applies to health benefit plans as defined in RCW 48.43.005, contracts for limited health care services as defined in RCW 48.44.035, and stand-alone dental and stand-alone vision plans. This section applies to plans issued or renewed on or after January 1, 2018. Unless stated otherwise, this section does not apply to prescription drug services.

(2) A carrier or its designated or contracted representative must maintain a documented prior authorization program description and use evidence-based clinical review criteria. A carrier or its designated or contracted representative must make determinations in accordance with the carrier's current clinical review criteria and use the medical necessity definition stated in the enrollee's plan. The prior authorization program must include a method for reviewing and updating clinical review criteria. A carrier is obligated to ensure compliance with prior authorization requirements, even if they use a third-party contractor. A carrier is not exempt from these requirements because it relied upon a third-party vendor or subcontracting arrangement for its prior authorization program. A carrier or its designated or contracted representative is not required to use medical evidence or standards in its prior authorization of religious nonmedical treatment or religious nonmedical nursing care.

(3) A prior authorization program must meet standards set forth by a national accreditation organization including, but not limited to, National Committee for Quality Assurance (NCQA), URAC, Joint Commission, and Accreditation Association for Ambulatory Health Care in addition to the requirements of this chapter. A prior authorization program must have staff who are properly qualified, trained, supervised, and supported by explicit written, current clinical review criteria and review procedures.

(4) Effective November 1, 2019, a carrier or its designated or contracted representative must have a current and accurate online prior authorization process. All parts of the process that utilize personally identifiable information must be accessed through a secure online process. The online process must be accessible to a participating provider and facility so that, prior to delivering a service, a provider and facility will have enough information to determine if a service is a benefit under the enrollee's plan and the information necessary to submit a complete prior authorization request. A carrier with an integrated delivery system is not required to comply with this subsection for the employees participating in the integrated delivery system. The online process must provide the information required for a provider or facility to determine for an enrollee's plan for a specific service:

(a) If a service is a benefit;

(b) If a prior authorization request is necessary;

(d) If a prior authorization request is necessary, the following information:

(i) The clinical review criteria used to evaluate the request; and

(ii) Any required documentation.

(5) Effective November 1, 2019, in addition to other methods to process prior authorization requests, a carrier or its designated or contracted representative that requires prior authorization for services must have a secure online process for a participating provider or facility to complete a prior authorization request and upload documentation if necessary. A carrier with an integrated delivery system is not required to comply with this subsection for the employees participating in the integrated delivery system.

(6) Except for an integrated delivery system, a carrier or its designated or contracted representative must have a method that allows an out-of-network provider or facility to:

(a) Have access to any preservice requirements; and

(b) Request a prior authorization if prior authorization is required for an out-of-network provider or facility.

(7) A carrier or its designated or contracted representative that requires prior authorization for any service must allow a provider or facility to submit a request for a prior authorization at all times, including outside normal business hours.

(8) A carrier or its designated or contracted representative is responsible for maintaining a system of documenting information and supporting evidence submitted by a provider or facility while requesting prior authorization. This information must be kept until the claim has been paid or the appeals process has been exhausted.

(a) Upon request of the provider or facility, a carrier or its designated or contracted representative must remit to the provider or facility written acknowledgment of receipt of each document submitted by a provider or facility during the processing of a prior authorization request.

(b) When information is transmitted telephonically, a carrier or its designated or contracted representative must provide written acknowledgment of the information communicated by the provider or facility.

(9) A carrier or its designated or contracted representative must have written policies and procedures to assure that prior authorization determinations for a participating provider or facility are made within the appropriate time frames.

(a) Time frames must be appropriate to the severity of the enrollee condition and the urgency of the need for treatment, as documented in the prior authorization request.

(b) If the request from the participating provider or facility is not accompanied by all necessary information, the carrier or its designated or contracted representative must inform the provider or facility what additional information is needed and the deadline for its submission as set forth in this section.

(10) The time frames for carrier prior authorization determination and notification to a participating provider or facility are as follows:

(a) For standard prior authorization requests:

(i) The carrier or its designated or contracted representative must make a decision and provide notification within five calendar days.

(ii) If insufficient information has been provided to a carrier or its designated or contracted representative to make a decision, the carrier or its designated or contracted representative has five calendar days to request additional information from the provider or facility.

(A) The carrier or its designated or contracted representative must give a provider or facility five calendar days to give the necessary information to the carrier or its designated or contracted representative.

(B) The carrier or its designated or contracted representative must then make a decision and give notification within four calendar days of the receipt of the information or the deadline for receiving information, whichever is sooner.

(b) For expedited prior authorization requests:

(i) The carrier or its designated or contracted representative must make a decision and provide notification within two calendar days.

(ii) If insufficient information has been provided to a carrier or its designated or contracted representative to make a decision, the carrier or its designated or contracted representative has one calendar day to request additional information from the provider or facility.

(A) The carrier or its designated or contracted representative must give a provider or facility two calendar days to give the necessary information to the carrier or its designated or contracted representative.

(B) The carrier or its designated or contracted representative must then make a decision and give notification within two calendar days of the receipt of the information or the deadline for receiving information, whichever is sooner.

(iii) If the time frames for the approval of an expedited prior authorization are insufficient for a provider or facility to receive approval prior to the preferred delivery of the service, the prior authorization should be considered an extenuating circumstance as defined in WAC 284-43-2060.

(11) A carrier or its designated or contracted representative when conducting prior authorization must:

(a) Accept any evidence-based information from a provider or facility that will assist in the authorization process;

(b) Collect only the information necessary to authorize the service and maintain a process for the provider or facility to submit such records;

(c) If medical records are requested, require only the section(s) of the medical record necessary in that specific case to determine medical necessity or appropriateness of the service to be delivered, to include admission or extension of stay, frequency or duration of service; and

(d) Base review determinations on the medical information in the enrollee's records and obtained by the carrier up to the time of the review determination.

(12) When a provider or facility makes a request for the prior authorization, the response from the carrier or its designated or contracted representative must state if it is approved or denied. If the request is denied, the response must give the specific reason for the denial in clear and simple language. If the reason for the denial is based on clinical review criteria, the criteria must be provided. Written notice of the decision must be communicated to the provider or facility, and the enrollee. A decision may be provided orally, but subsequent written notice must also be provided. A denial must include the department and credentials of the individual who has the authorizing authority to approve or deny the request. A denial must also include a phone number to contact the authorizing authority and a notice regarding the enrollee's appeal rights and process.

Whenever the prior authorization relates to a protected individual, as defined in RCW 48.43.005, the health carrier must follow RCW 48.43.505.

(13) A prior authorization approval notification for all services must inform the requesting provider or facility, and the enrollee, whether the prior authorization is for a specific provider or facility. The notification must also state if the authorized service may be delivered by an out-of-network provider or facility and if so, disclose to the enrollee the financial implications for receiving services from an out-of-network provider or facility.

Whenever the notification relates to a protected individual, as defined in RCW 48.43.005, the health carrier must follow RCW 48.43.505.

(14) A provider or facility may appeal a prior authorization denial to the carrier or its designated or contracted representative.

(15) Prior authorization determinations shall expire no sooner than forty-five days from date of approval. This requirement does not supersede RCW 48.43.039.

(16) In limited circumstances when an enrollee has to change plans due to a carrier's market withdrawal as defined in RCW 48.43.035 (4)(d) and 48.43.038 (3)(d), the subsequent carrier or its designated or contracted representative must recognize the prior authorization of the previous carrier until the new carrier's prior authorization process has been completed and its authorized treatment plan has been initiated. The subsequent carrier or its designated or contracted representative must ensure that the enrollee receives the previously authorized initial service as an in-network service. Enrollees must present proof of the prior authorization.

(a) For medical services, a carrier or its designated or contracted representative must recognize a prior authorization for at least thirty days or the expiration date of the original prior authorization, whichever is shorter.

(b) For pharmacy services, a carrier or its designated or contracted representative must recognize a prior authorization for the initial fill, or until the prior authorization process of the new carrier or its designated or contracted representative has been completed.

(17) Prior authorization for a facility-to-facility transport that requires prior authorization can be performed after the service is delivered. Authorization can only be based on information available to the carrier or its designated or contracted representative at the time of the prior authorization request.

(18) A carrier or its designated or contracted representative must have a prior authorization process that allows specialists the ability to request a prior authorization for a diagnostic or laboratory service based upon a review of medical records in advance of seeing the enrollee.

(19) A carrier or its designated or contracted representative must have a method that allows an enrollee, provider or facility to make a predetermination request when provided for by the plan.

(20) Predetermination notices must clearly disclose to the enrollee and requesting provider or facility, that the determination is not a prior authorization and does not guarantee services will be covered. The notice must state "A predetermination notice is not a prior authorization and does not guarantee services will be covered." Predetermination notices must be delivered within five calendar days of receipt of the request. Predetermination notices will disclose to a provider or facility for an enrollee's plan:

(a) If a service is a benefit;

(b) If a prior authorization request is necessary;

(d) If a prior authorization request is necessary or if a medical necessity review will be performed after the service has been delivered, the following information:

(i) The clinical review criteria used to evaluate the request; and

(ii) Any required documentation.

(e) Whenever a predetermination notice relates to a protected individual, as defined in RCW 48.43.005, the health carrier must follow RCW 48.43.505.

(1) A carrier must notify enrollees of an adverse benefit determination either electronically or by U.S. mail. The notification must be provided:

(a) To an appellant or their authorized representative; ((and))

(b) To the provider if the adverse benefit determination involves the preservice denial of treatment or procedure prescribed by the provider; and

(c) Whenever an adverse benefit determination relates to a protected individual, as defined in RCW 48.43.005, the health carrier must follow RCW 48.43.505.

(2) A carrier or health plan's notice must include the following information, worded in plain language:

(a) The specific reasons for the adverse benefit determination;

(b) The specific health plan policy or contract sections on which the determination is based, including references to the provisions;

(c) The plan's review procedures, including the appellant's right to a copy of the carrier and health plan's records related to the adverse benefit determination;

(d) The time limits applicable to the review; and

(e) The right of appellants and their providers to present evidence as part of a review of an adverse benefit determination.

(3) If an adverse benefit determination is based on medical necessity, decisions related to experimental treatment, or a similar exclusion or limit involving the exercise of professional judgment, the notification must contain either an explanation of the scientific or clinical basis for the determination, the manner in which the terms of the health plan were applied to the appellant's medical circumstances, or a statement that such explanation is available free of charge upon request.

(4) If an internal rule, guideline, protocol, or other similar criterion was relied on in making the adverse benefit determination, the notice must contain either the specific rule, guideline, protocol, or other similar criterion; or a statement that a copy of the rule, guideline, protocol, or other criterion will be provided free of charge to the appellant on request.

(5) The notice of an adverse benefit determination must include an explanation of the right to review the records of relevant information, including evidence used by the carrier or the carrier's representative that influenced or supported the decision to make the adverse benefit determination.

(a) For purposes of this subsection, "relevant information" means information relied on in making the determination, or that was submitted, considered, or generated in the course of making the determination, regardless of whether the document, record, or information was relied on in making the determination.

(b) Relevant information includes any statement of policy, procedure, or administrative process concerning the denied treatment or benefit, regardless of whether it was relied on in making the determination.

(6) If the carrier and health plan determine that additional information is necessary to perfect the denied claim, the carrier and health plan must provide a description of the additional material or information that they require, with an explanation of why it is necessary, as soon as the need is identified.

(7) An enrollee or covered person may request that a carrier identify the medical, vocational, or other experts whose advice was obtained in connection with the adverse benefit determination, even if the advice was not relied on in making the determination. The carrier may satisfy this requirement by providing the job title, a statement as to whether the expert is affiliated with the carrier as an employee, and the expert's specialty, board certification status, or other criteria related to the expert's qualification without providing the expert's name or address. The carrier must be able to identify for the commissioner upon request the name of each expert whose advice was obtained in connection with the adverse benefit determination.

(8) The notice must include language substantially similar to the following:

"If you request a review of this adverse benefit determination, (Company name) will continue to provide coverage for the disputed benefit pending outcome of the review if you are currently receiving services or supplies under the disputed benefit. If (Company name) prevails in the appeal, you may be responsible for the cost of coverage received during the review period. The decision at the external review level is binding unless other remedies are available under state or federal law."