(1) When requested by an enrollee, a health carrier must limit disclosure of that enrollee's information, including personal health information and communications subjected to confidentiality. Once limited, a health carrier must communicate directly with the enrollee through the identified physical address, email, telephone number, or carrier portal.

(2) Health carriers must establish a process for informing enrollees, including protected individuals, of the ability to request confidentiality, limit disclosure, and update their contact information. Enrollees must be able to provide a request telephonically, or submit it by email or online, such as through a portal or on the carrier's webpage.

(a) Health carriers must post a confidentiality request form clearly and conspicuously on their website for individuals limit disclosure or to change their limits regarding communication preferences, such as updating their address, or selecting another means of communication. When carriers post the form on their website, or make the form available through other means, carriers must ensure that the form is accompanied by clear instructions about how a protected individual or enrollee may submit the form and the process, including other means available to change the enrollee's contact information. If carriers utilize their own confidentiality request form, then carriers must also provide a link to the form specified for use and made available on the office of the insurance commissioner's website. Carriers must accept the form specified by the commissioner when submitted by an enrollee, authorized representative, or provider acting on behalf of the enrollee.

(b) Carriers must implement the request and any subsequent request for changes within three business days from receipt of the request. If a request is incomplete or missing information, the carrier must implement as much of the request as possible, and contact the enrollee to obtain a complete request within three business days.

(c) The request must remain in effect until the enrollee revokes or modifies the request in writing.

(3) Requests to limit disclosure do not prevent a health carrier from communicating with a provider, health care benefit manager, third-party administrator, another carrier and other HIPAA covered entities when necessary to process claims, state or federal mandated reporting, or for other activities necessary to ensure coverage including, but not limited to, coordination of benefits. If a carrier needs to communicate with a health care benefit manager or third-party administrator, then the benefit manager or third-party administrator must first ensure continued confidentiality, including continuing to communicate with the enrollee using their selected method of communication. If a carrier has a need to discuss services with another carrier or insurer, they must notify the other carrier or insurer of these requirements or ensure that they are aware of these requirements and any existing confidentiality requests.

(4) Confidentiality required by this section must be provided according to the terms and requirements set forth in RCW 48.43.505.

(5) Carriers must have processes and procedures in place to track information related to confidentiality requests made under the requirements of this subchapter and RCW 48.43.505, including the number of requests received by the carrier and the related time frames for processing the request. Carriers will submit this information to the commissioner when requested.