Original Notice.
Preproposal statement of inquiry was filed as WSR 19-15-129.
Title of Rule and Other Identifying Information: Confidential communication.
Hearing Location(s): On January 24, 2020, at 11:00 a.m., at 5000 Capitol Boulevard, Tumwater, WA.
Date of Intended Adoption: January 28, 2020.
Submit Written Comments to: Meg L. Jones, P.O. Box 40260, Olympia, WA 98504-0260, email rulescoordinator@oic.wa.gov, fax 360-586-3109, by January 24, 2020.
Assistance for Persons with Disabilities: Contact Melanie Watness, phone 360-725-7013, fax 360-586-2023, TTY 360-586-0241, email melaniew@oic.wa.gov, by January 23, 2020.
Purpose of the Proposal and Its Anticipated Effects, Including Any Changes in Existing Rules: The commissioner proposes the rules to harmonize the provisions in ESSB 5889 (chapter 56, Laws of 2019) with federal and state requirements governing communication about health care coverage, and establish a form as required for enrollees to use to direct issuers where to send communication to the enrollee about the health services referenced in the law.
Reasons Supporting Proposal: Numerous federal and state laws require issuers to communicate about health care coverage with their members. These laws are constructed around an industry norm that directs these communications to the subscriber. Covered dependents may ask that those communications be sent to a different address than the subscriber's under state and federal law, but for some types of information, specific reasons must be provided, such as domestic violence concerns. ESSB 5889 (chapter 56, Laws of 2019) establishes a specific category of services (sensitive health services) for which communication must be sent to the dependent enrollee when they are a 'protected individual' under the law and not to the subscriber. The business requirements of HIPAA and other laws related to health plan operations are unchanged unless they relate to a communication to the subscriber or enrollee. These rules are intended to provide guidance for issuers as to how to administer the nondisclosure directive requirements of ESSB 5889 in alignment with information release required to administer coverage effectively on the member's behalf.
Statute Being Implemented: ESSB 5889 (chapter 56, Laws of 2019).
Rule is not necessitated by federal law, federal or state court decision.
Name of Proponent: Mike Kreidler, insurance commissioner, governmental.
Name of Agency Personnel Responsible for Drafting: Meg L. Jones, P.O. Box 40260, Olympia, WA 98504, 360-725-7169; Implementation: Molly Nollette, P.O. Box 40255, Olympia, WA 98504, 360-725-7117; and Enforcement: Toni Hood, P.O. Box 40255, Olympia, WA 98504, 360-725-7050.
This rule proposal, or portions of the proposal, is exempt from requirements of the Regulatory Fairness Act because the proposal:
As used in this chapter, unless the context requires otherwise:
(1) "Affiliate" means any company that controls, is controlled by or is under common control with another company.
(2) "Clear and conspicuous" means that a notice is reasonably understandable and designed to call attention to the nature and significance of the information in the notice.
Examples.
(a) Reasonably understandable. A licensee makes its notice reasonably understandable if it:
(i) Presents the information in the notice in clear, concise sentences, paragraphs, and sections;
(ii) Uses short explanatory sentences or bullet lists whenever possible;
(iii) Uses definite, concrete, everyday words and active voice whenever possible;
(iv) Avoids multiple negatives;
(v) Avoids legal and highly technical business terminology whenever possible; and
(vi) Avoids explanations that are imprecise and readily subject to different interpretations.
(b) Designed to call attention. A licensee designs its notice to call attention to the nature and significance of the information in it if the licensee:
(i) Uses a plain-language heading to call attention to the notice;
(ii) Uses a typeface and type size that are easy to read;
(iii) Provides wide margins and ample line spacing;
(iv) Uses boldface or italics for key words; and
(v) In a form that combines the licensee's notice with other information, uses distinctive type size, style, and graphic devices, such as shading or sidebars.
(c) Notices on websites. If a licensee provides a notice on a web page, the licensee designs its notice to call attention to the nature and significance of the information in it if the licensee uses text or visual cues to encourage scrolling down the page if necessary to view the entire notice and ensure that other elements on the website (such as text, graphics, hyperlinks or sound) do not distract attention from the notice, and the licensee either:
(i) Places the notice on a screen that consumers frequently access, such as a page on which transactions are conducted; or
(ii) Places a link on a screen that consumers frequently access, such as a page on which transactions are conducted, that connects directly to the notice and is labeled appropriately to convey the importance, nature, and relevance of the notice.
This requirement applies to the nondisclosure directive that issuers must provide to enrollees to comply with RCW 48.43.505 as referenced in WAC 284-04-510 and 284-04-515. (3) "Collect" means to obtain information that the licensee organizes or can retrieve by the name of an individual or by identifying number, symbol or other identifying particular assigned to the individual, irrespective of the source of the underlying information.
(4) "Commissioner" means the insurance commissioner of the state.
(5) "Company" means a corporation, limited liability company, business trust, general or limited partnership, association, sole proprietorship or similar organization.
(6) "Consumer" means an individual who seeks to obtain, obtains or has obtained an insurance product or service from a licensee that is to be used primarily for personal, family or household purposes and about whom the licensee has nonpublic personal information, or that individual's legal representative.
Examples.
(a) An individual who provides nonpublic personal information to a licensee in connection with obtaining or seeking to obtain financial, investment or economic advisory services relating to an insurance product or service is a consumer regardless of whether the licensee establishes an ongoing advisory relationship.
(b) An applicant for insurance prior to the inception of insurance coverage is a licensee's consumer.
(c) An individual who is a consumer of another financial institution is not a licensee's consumer solely because the licensee is acting as agent for, or provides processing or other services to, that financial institution.
(d) An individual is a licensee's consumer if:
(i) The individual is a beneficiary of a life insurance policy underwritten by the licensee;
(ii) The individual is a claimant under an insurance policy issued by the licensee;
(iii) The individual is an insured or an annuitant under an insurance policy or an annuity, respectively, issued by the licensee; or
(iv) The individual is a mortgagor of a mortgage covered under a mortgage insurance policy; and
(v) The licensee discloses nonpublic personal financial information about the individual to a nonaffiliated third party other than as permitted under WAC 284-04-400, 284-04-405, and 284-04-410.
(e) Provided that the licensee provides the initial, annual and revised notices under WAC 284-04-200, 284-04-205, and 284-04-220 to the plan sponsor, group or blanket insurance policy holder or group annuity contract holder, workers' compensation plan participant and further provided that the licensee does not disclose to a nonaffiliated third party nonpublic personal financial information about such an individual other than as permitted under WAC 284-04-400, 284-04-405, and 284-04-410, an individual is not the consumer of such licensee solely because he or she is:
(i) A participant or a beneficiary of an employee benefit plan that the licensee administers or sponsors or for which the licensee acts as a trustee, insurer or fiduciary;
(ii) Covered under a group or blanket insurance policy or annuity contract issued by the licensee; or
(iii) A beneficiary in a workers' compensation plan.
(f) The individuals described in (e)(i) through (iii) of this subsection are consumers of a licensee if the licensee does not meet all the conditions of (e) of this subsection.
(g) In no event shall such individuals, solely by virtue of the status described in (e)(i) through (iii) of this subsection, be deemed to be customers for purposes of this chapter.
(i) An individual is not a licensee's consumer solely because he or she is a beneficiary of a trust for which the licensee is a trustee.
(ii) An individual is not a licensee's consumer solely because he or she has designated the licensee as trustee for a trust.
(7) "Consumer reporting agency" has the same meaning as in section 603(f) of the Federal Fair Credit Reporting Act (15 U.S.C. 1681a(f)).
(8) "Control" means:
(a) Ownership, control or power to vote twenty-five percent or more of the outstanding shares of any class of voting security of the company, directly or indirectly, or acting through one or more other persons;
(b) Control in any manner over the election of a majority of the directors, trustees or general partners (or individuals exercising similar functions) of the company; or
(c) The power to exercise, directly or indirectly, a controlling influence over the management or policies of the company, as the commissioner determines.
(9) "Customer" means a consumer who has a customer relationship with a licensee.
(10) "Customer relationship" means continuing relationship between a consumer and a licensee under which the licensee provides one or more insurance products or services to the consumer that are to be used primarily for personal, family or household purposes.
Examples.
(a) A consumer has a continuing relationship with a licensee if:
(i) The consumer is a current policyholder of an insurance product issued by or through the licensee; or
(ii) The consumer obtains financial, investment or economic advisory services relating to an insurance product or service from the licensee for a fee.
(b) A consumer does not have a continuing relationship with a licensee if:
(i) The consumer applies for insurance but does not purchase the insurance;
(ii) The licensee sells the consumer airline travel insurance in an isolated transaction;
(iii) The individual no longer is a current policyholder of an insurance product or no longer obtains insurance services with or through the licensee;
(iv) The consumer is a beneficiary or claimant under a policy and has submitted a claim under a policy choosing a settlement option involving an ongoing relationship with the licensee;
(v) The consumer is a beneficiary or a claimant under a policy and has submitted a claim under that policy choosing a lump sum settlement option;
(vi) The customer's policy is lapsed, expired, paid up or otherwise inactive or dormant under the licensee's business practices, and the licensee has not communicated with the customer about the relationship for a period of twelve consecutive months, other than annual privacy notices, material required by law or regulation, communication at the direction of state or federal authority or promotional materials;
(vii) The individual is an insured or an annuitant under an insurance policy or annuity, respectively, but is not the policyholder or owner of the insurance policy or annuity; or
(viii) For the purposes of this chapter, if the individual's last known address according to the licensee's records is deemed invalid. An address of record is deemed invalid if mail sent to that address by the licensee has been returned by the postal authorities as undeliverable and if subsequent attempts by the licensee to obtain a current valid address for the individual have been unsuccessful.
(11) "Financial institution" means any institution the business of which is engaging in activities that are financial in nature or incidental to such financial activities as described in section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)).
Financial institution does not include:
(a) Any person or entity with respect to any financial activity that is subject to the jurisdiction of the Commodity Futures Trading Commission under the Commodity Exchange Act (7 U.S.C. 1 et seq.);
(b) The Federal Agricultural Mortgage Corporation or any entity charged and operating under the Farm Credit Act of 1971 (12 U.S.C. 2001 et seq.); or
(c) Institutions chartered by Congress specifically to engage in securitizations, secondary market sales (including sales of servicing rights) or similar transactions related to a transaction of a consumer, as long as such institutions do not sell or transfer nonpublic personal information to a nonaffiliated third party.
(12) "Financial product or service" means any product or service that a financial holding company could offer by engaging in an activity that is financial in nature or incidental to such a financial activity under section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)).
Financial service includes a financial institution's evaluation or brokerage of information that the financial institution collects in connection with a request or an application from a consumer for a financial product or service.
(13) "Health care" means: Preventive, diagnostic, therapeutic, rehabilitative, maintenance or palliative care, services, procedures, tests or counseling that:
(a) Relates to the physical, mental or behavioral condition of an individual; or
(b) Affects the structure or function of the human body or any part of the human body, including the banking of blood, sperm, organs or any other tissue; or
(c) Prescribing, dispensing or furnishing to an individual drugs or biologicals, or medical devices or health care equipment and supplies.
(14) "Health care provider" means a physician or other health care practitioner licensed, accredited or certified to perform specified health services consistent with state law or a health care facility.
(15) "Health information" means any information or data, except age or gender, whether oral or recorded in any form or medium, created by or derived from a health care provider or the consumer that relates to:
(a) The past, present or future physical, mental or behavioral health or condition of an individual;
(b) The provision of health care to an individual; or
(c) Payment for the provision of health care to an individual.
(16) "Insurer" includes health care service contractor, HMO, and fraternal benefit society.
(17) "Insurance product or service" means any product or service that is offered by a licensee pursuant to the insurance laws of this state.
Insurance service includes a licensee's evaluation, brokerage or distribution of information that the licensee collects in connection with a request or an application from a consumer for an insurance product or service.
(18) "Licensee" means all licensed insurers, health care service contractors, HMO's, and fraternal benefit societies, producers and other persons licensed or required to be licensed, or authorized or required to be authorized, or registered or required to be registered pursuant to the insurance law of this state.
(a) A licensee is not subject to the notice and opt out requirements for nonpublic personal financial information set forth in WAC 284-04-100 through 284-04-400 or the notice and policy development and implementation procedures of WAC 284-04-500 if the licensee is an employee, agent or other representative of another licensee ("the principal") and:
(i) The principal otherwise complies with, and provides the notices required by, the provisions of this regulation; and
(ii) The licensee complies with the principal's privacy policies and does not disclose any nonpublic personal information to any person other than the principal or its affiliates in a manner permitted by this regulation.
(b)(i) Subject to (b)(ii) of this subsection, "licensee" shall also include an unauthorized insurer that accepts business placed through a licensed excess lines broker in this state, but only in regard to the excess lines placements placed pursuant to chapters
48.15 RCW and 284-15 WAC.
(ii) An excess lines broker or excess lines insurer shall be deemed to be in compliance with the notice and opt out requirements for nonpublic personal financial information set forth in WAC 284-04-100 through 284-04-400 provided:
(A) The broker or insurer does not disclose nonpublic personal information of a consumer or a customer to nonaffiliated third parties for any purpose, including joint servicing or marketing under WAC 284-04-405, except as permitted by WAC 284-04-410 and 284-04-415; and
(B) The broker or insurer delivers a notice to the consumer at the time a customer relationship is established on which the following is printed in 16-point type:
PRIVACY NOTICE |
"NEITHER THE U.S. BROKERS THAT HANDLED THIS INSURANCE NOR THE INSURERS THAT HAVE UNDERWRITTEN THIS INSURANCE WILL DISCLOSE NONPUBLIC PERSONAL INFORMATION CONCERNING THE BUYER TO NONAFFILIATES OF THE BROKERS OR INSURERS EXCEPT AS PERMITTED BY LAW" |
(19) "Licensee" shall also include an unauthorized insurer that places business through a licensed excess line broker in this state, but only in regard to the excess line placements placed pursuant to of this state's laws.
(20) "Nonaffiliated third party" means any person except:
(a) A licensee's affiliate; or
(b) A person employed jointly by a licensee and any company that is not the licensee's affiliate (but nonaffiliated third party includes the other company that jointly employs the person).
Nonaffiliated third party includes any company that is an affiliate solely by virtue of the direct or indirect ownership or control of the company by the licensee or its affiliate in conducting merchant banking or investment banking activities of the type described in section 4 (k)(4)(H) or insurance company investment activities of the type described in section 4 (k)(4)(I) of the Federal Bank Holding Company Act (12 U.S.C. 1843 (k)(4)(H) and (I).)
(21) "Nonpublic personal information" means nonpublic personal financial information and nonpublic personal health information.
(22)(a) "Nonpublic personal financial information" means:
(i) Personally identifiable financial information; and
(ii) Any list, description or other grouping of consumers (and publicly available information pertaining to them) that is derived using any personally identifiable financial information that is not publicly available.
(b) Nonpublic personal financial information does not include:
(i) Health information;
(ii) Publicly available information, except as included on a list described in (a)(i) of this subsection; or
(iii) Any list, description or other grouping of consumers (and publicly available information pertaining to them) that is derived without using any personally identifiable financial information that is not publicly available.
Examples of lists.
Nonpublic personal financial information includes any list of individuals' names and street addresses that is derived in whole or in part using personally identifiable financial information that is not publicly available, such as account numbers.
Nonpublic personal financial information does not include any list of individuals' names and addresses that contains only publicly available information, is not derived in whole or in part using personally identifiable financial information that is not publicly available, and is not disclosed in a manner that indicates that any of the individuals on the list is a consumer of a financial institution.
(23) "Nonpublic personal health information" means health information:
(a) That identifies an individual who is the subject of the information; or
(b) With respect to which there is a reasonable basis to believe that the information could be used to identify an individual.
(24) "Personally identifiable financial information" means any information:
(a) A consumer provides to a licensee to obtain an insurance product or service from the licensee;
(b) About a consumer resulting from any transaction involving an insurance product or service between a licensee and a consumer; or
(c) The licensee otherwise obtains about a consumer in connection with providing an insurance product or service to that consumer.
Examples.
(i) Information included. Personally identifiable financial information includes:
(A) Information a consumer provides to a licensee on an application to obtain an insurance product or service;
(B) Account balance information and payment history;
(C) The fact that an individual is or has been one of the licensee's customers or has obtained an insurance product or service from the licensee;
(D) Any information about the licensee's consumer if it is disclosed in a manner that indicates that the individual is or has been the licensee's consumer;
(E) Any information that a consumer provides to a licensee or that the licensee or its agent otherwise obtains in connection with collecting on a loan or servicing a loan;
(F) Any information the licensee collects through an internet "cookie" (an information collecting device from a web server); and
(G) Information from a consumer report.
(ii) Information not included. Personally identifiable financial information does not include:
(A) Health information;
(B) A list of names and addresses of customers of an entity that is not a financial institution; and
(C) Information that does not identify a consumer, such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names or addresses.
(25)(a) "Publicly available information" means any information that a licensee has a reasonable basis to believe is lawfully made available to the general public from:
(i) Federal, state or local government records;
(ii) Widely distributed media; or
(iii) Disclosures to the general public that are required to be made by federal, state or local law.
(b) Reasonable basis. A licensee has a reasonable basis to believe that information is lawfully made available to the general public if the licensee has taken steps to determine:
(i) That the information is of the type that is available to the general public; and
(ii) Whether an individual can direct that the information not be made available to the general public and, if so, that the licensee's consumer has not done so.
(c) Examples.
(i) Government records. Publicly available information in government records includes information in government real estate records and security interest filings.
(ii) Widely distributed media. Publicly available information from widely distributed media includes information from a telephone book, a television or radio program, a newspaper or a website that is available to the general public on an unrestricted basis. A website is not restricted merely because an internet service provider or a site operator requires a fee or a password, so long as access is available to the general public.
(iii) Reasonable basis.
(A) A licensee has a reasonable basis to believe that mortgage information is lawfully made available to the general public if the licensee has determined that the information is of the type included on the public record in the jurisdiction where the mortgage would be recorded.
(B) A licensee has a reasonable basis to believe that an individual's telephone number is lawfully made available to the general public if the licensee has located the telephone number in the telephone book or the consumer has informed you that the telephone number is not unlisted.
(1) Notwithstanding other provisions of this chapter, a licensee shall limit disclosure of any information, including health information, about an individual who is the subject of the information if the individual clearly states in writing that disclosure to specified individuals of all or part of that information could jeopardize the safety of the individual. Disclosure of information under this subsection shall be limited consistent with the individual's request, such as a request for the licensee to not release any information to a spouse to prevent domestic violence.
(2) For licensees that offer health benefit coverage, the licensee must make the nondisclosure directive form specified by the commissioner clearly and conspicuously available on its website. The form must also be accessible through a mobile friendly configuration of the licensee's website. The form must be presented so that it can be completed online and submitted. A licensee must also accept printed hard copies of the form and must make staff available by phone to complete a protected individual's directive over a recorded line.
(a) A licensee offering health benefit coverage must post clear instructions about how an enrollee may provide the same directive by calling the licensee on a recorded phone line.
(b) The opportunity to complete a nondisclosure directive must be made available to anyone who qualifies as a protected individual. When receiving a directive over a recorded phone line, the carrier must take reasonable steps to confirm the caller is a protected individual. A protected individual is an adult who is covered as a dependent, including as a registered domestic partner, under the licensee's health plan or a minor who may obtain health care without the consent of a parent or legal guardian pursuant to state or federal law, and who is competent to provide informed consent for care.
(c) For purposes of this requirement, in addition to nonpublic personal health information, when a request is made, a health carrier must apply the protected individual's restriction to the following associated types of communication:
(i) Bills from and attempts to collect payment by the licensee;
(ii) A notice of adverse benefit determination;
(iii) Explanation of benefit notices;
(iv) Requests for additional information regarding a claim for sensitive health care services;
(v) A notice of a contested claim; and
(vi) The name and address of a provider, a description of services provided or other visit information.
(d) A licensee offering health benefit coverage must apply a protected individual's directive to the entirety of the individual's nonpublic health information and associated communication if the protected individual makes such a request. For sensitive health services information, regardless of the address associated with the enrollee, a carrier must ensure that the protected individual is the addressee, and must not address the communication to the subscriber.
(3) Notwithstanding any insurance law requiring the disclosure of information, a licensee shall not disclose nonpublic personal health information concerning health services related to reproductive health, sexually transmitted diseases, chemical dependency and mental health, including mailing appointment notices, calling the home to confirm appointments, or mailing a bill or explanation of benefits to a policyholder or certificate holder, if the individual who is the subject of the information makes a written request. In addition, a licensee shall not require an adult individual to obtain the policyholder's or other covered person's authorization to receive health care services or to submit a claim.
(((3)))(4)(a) A licensee shall recognize the right of any minor who may obtain health care without the consent of a parent or legal guardian pursuant to state or federal law, to exclusively exercise rights granted under this section regarding health information; and
(b) Shall not disclose any nonpublic personal health information related to any health care service to which the minor has lawfully consented, including mailing appointment notices, calling the home to confirm appointments, or mailing a bill or explanation of benefits to a policyholder or other covered person, without the express authorization of the minor. In addition, a licensee shall not require the minor to obtain the policyholder's or other covered person's authorization to receive health care services or to submit a claim as to health care which the minor may obtain without parental consent under state or federal law.
(((4)))(5) When requesting nondisclosure, the individual shall include in the request:
(a) Their name and address;
(b) Description of the type of information that should not be disclosed;
(c) In the case of reproductive health information, the type of services subject to nondisclosure, unless the individual is enrolled in a licensee's health plan, in which case the requirements in subsection (2) of this section apply;
(d) The identity or description of the types of persons from whom information should be withheld;
(e) Information as to how payment will be made for any benefit cost sharing;
(f) A phone number or email address where the individual may be reached if additional information or clarification is necessary to satisfy the request.