Background: Federal Law. The Health Insurance Portability and Accountability Act of 1996 (HIPAA) establishes nationwide standards for using, disclosing, storing, and transferring protected health information. Entities covered by HIPAA must have a patient's authorization to use or disclose health care information, unless there is a specified exception. Some exceptions pertain to disclosures for treatment, payment, and health care operations; public health activities; judicial proceedings; law enforcement purposes; and research purposes. HIPAA allows a state to establish standards that are more stringent than its provisions.

Under HIPAA, a patient, including a minor who has consented to their own care, may request restrictions on the disclosure of their personal health information, including billing information. Health care providers and health plans are not required to agree to these requests.

State Law. Health carriers and insurers must adopt policies and procedures that conform administrative, business, and operational practices to protect an enrollee's right to privacy or right to confidential health care services granted under state and federal laws.

Upon the request of any person, including a current enrollee, prospective enrollee, or the insurance commissioner, a health carrier must provide written information regarding any health care plan it offers, including:

documents, instruments, or other information referred to in the medical coverage agreement;

a full description of the procedures to be followed by an enrollee for consulting a provider other than the primary care provider and whether the enrollee's primary care provider, the carrier's medical director, or another entity must authorize the referral;

procedures an enrollee must first follow for obtaining prior authorization for health care services;

a written description of any reimbursement or payment arrangements;

descriptions and justifications for provider compensation programs;

an annual accounting of all payments made by the carrier which have been counted against any payment limitations, visit limitations, or other overall limitations on a person's coverage under a plan; and

a copy of the carrier's review of adverse benefit determinations grievance process for claim or service denial and its grievance process for dissatisfaction with care.

Summary of Bill: A protected individual is an adult covered as a dependent on an enrollee's health benefit plan, including a registered domestic partner, or a minor who may obtain health care without the consent of a parent or legal guardian.

Sensitive health care services are health services related to reproductive health, sexually transmitted diseases, substance use disorder, gender dysphoria, gender affirming care, domestic violence, and mental health.

Health carriers are prohibited from requiring protected individuals to obtain a policyholder, primary subscriber, or other covered person's authorization to receive health care services or to submit a claim if they have the right to consent to care. A health carrier must direct all communication regarding a protected individual's receipt of sensitive health care services directly to the protected individual. A carrier may not disclose nonpublic personal health information concerning sensitive health care services to any person other than the protected individual, without their consent.

Protected individuals may request that a carrier send communications regarding sensitive health care services to another individual for the purposes of appealing adverse benefits determinations.

Health carriers must:

limit disclosure of any information about a protected individual who is the subject of the information and shall direct communications containing such information directly to the individual regardless of whether the information pertains to sensitive services, if the protected individual requests such a limitation;
ensure requests for nondisclosure remain in effect until the protected individual revokes or modifies the request in writing; and
ensure requests for nondisclosure are implemented no later than three days after receipt of a request.

Health carriers may not require protected individuals to waive a right to limit disclosure as a condition of eligibility for coverage.

All communications from a health carrier relating to the provision of health care services, if the communications disclose protected health information relating to receipt of sensitive services, must be provided in a form and format requested by the individual patient receiving care.

Upon the request of any person, a carrier must provide an annual accounting of all payments made by the carrier which have been counted against any payment limitations, visit limitations, or other overall limitations on a person's coverage under the plan, however the individual requesting the accounting may only receive information about that individual's own care, and may not receive information pertaining to protected individuals who have requested confidential communications.

Health carrier and health plan notices of decisions to deny, modify, reduce, or terminate payment, coverage, authorization, or provision of health care services or benefits, including the admission to or continued stay in a health care facility, must be sent directly to a protected individual receiving care when accessing sensitive health care services or when a protected individual has requested confidential communication

The insurance commissioner is directed to develop a process for the regular collection of information from carriers on requests for confidential communications for purposes of monitoring compliance. The insurance commissioner must work with stakeholders to develop and make available to the public a standardized form that a protected individual may submit to a carrier to make a confidential communications request.