(1) A health carrier must direct all communication regarding sensitive health care services, including communications subject to confidentiality, directly to the protected individual. To facilitate communication of these services, a carrier must allow the protected individual to select their preferred communication format unless the format is otherwise specified by law or regulation and may provide sensitive health services communications to the protected individual by:

(a) Health care portal that is only accessible to the protected individual;

(b) Email address, if provided by the protected individual;

(c) Telephone of the protected individual; or

(d) Mail to the address requested by a protected individual, and if no address has been requested, then mail to the known address if the communication and envelope are addressed only to the protected individual.

(2) When a protected individual provides their express written consent or verbal authorization on a recorded line, a health carrier may disclose information concerning sensitive health care services for that protected individual as specified by the protected individual.

(3) A health carrier must establish a process for informing enrollees, including protected individuals, of how communications regarding sensitive health care services are managed, including the process to update the protected individual's contact information.

(a) Health carriers must post a confidentiality request form clearly and conspicuously on its website for individuals to change their communication preferences regarding sensitive health information, such as updating their address, or to select another means of communication. When carriers post the form on their website, or make the form available through other means, the form must accompany clear instructions about how a protected individual or enrollee may submit the form including other means available to change the contact information regarding sensitive health care information. If carriers utilize their own confidentiality request form, then carriers must also provide a link to the form specified for use and made available on the office of the insurance commissioner's website. Carriers must accept the form specified by the commissioner when submitted by an enrollee, authorized representative, or provider acting on behalf of the enrollee.

(b) Health carriers must implement the request and any subsequent request for changes within three business days from receipt of the request. If a request is incomplete or missing information, the carrier must implement as much of the request as possible, and contact the enrollee to obtain a complete request within three business days.

(4) For the purposes of appealing an adverse benefit determination, a protected individual may request that a health carrier direct sensitive health care communications and communications subject to confidentiality to another individual including, but not limited to, the policyholder, primary subscriber, or health care provider.

(5) Confidentiality of sensitive health care services does not prevent a health carrier from communicating with a provider, health care benefit manager, third-party administrator, another carrier and other HIPAA covered entities when necessary to process claims, state or federal mandated reporting, or for other activities necessary to ensure coverage including, but not limited to, coordination of benefits. If a carrier needs to communicate with a health care benefit manager or third-party administrator, then the health care benefit manager or third-party administrator must first ensure continued confidentiality, including continuing to communicate with the protected individual using their selected method of communication. If a carrier has a need to discuss services with another carrier or insurer, they must notify the other carrier or insurer of these requirements or ensure that they are aware of these requirements and any existing confidentiality requests.

(6) Communications and confidentiality required by this section must be provided according to the terms and requirements set forth in RCW 48.43.505.