33-19-204. Content, use, and disclosure of authorization forms. Notwithstanding any other provision of law of this state, an insurance institution, insurance producer, except as provided in subsection (10), or insurance-support organization may not collect personal or privileged information about an individual in connection with insurance transactions except in conformance with a form or statement that authorizes the disclosure of personal or privileged information about the individual to the insurance institution, insurance producer, or insurance-support organization and the form or statement:
     (1) is written in plain language;
     (2) is dated and signed by the individual or a person authorized to act on behalf of the individual;
     (3) specifies the types of persons authorized to disclose information about the individual;
     (4) specifies the nature of the information authorized to be disclosed;
     (5) names the insurance institution or insurance producer and identifies by generic reference representatives of the insurance institution to whom the individual is authorizing information to be disclosed;
     (6) specifies the purposes for which the information is collected;
     (7) specifies the length of time that the authorization remains valid, which may be no longer than:
     (a) in the case of authorizations signed for the purpose of collecting information in connection with an application for an insurance policy, a policy reinstatement, or a request for change in policy benefits:
     (i) 30 months from the date the authorization is signed if the application or request involves life, health, or disability insurance;
     (ii) 1 year from the date the authorization is signed if the application or request involves property or casualty insurance;
     (b) in the case of authorizations signed for the purpose of collecting information in connection with a claim for benefits under an insurance policy:
     (i) the term of coverage of the policy if the claim is for a health insurance benefit;
     (ii) the duration of the claim if the claim is not for a health insurance benefit; and
     (8) advises the individual or a person authorized to act on behalf of the individual that, subject to the exception provided in subsection (9), the individual or the individual's authorized representative is entitled to receive a copy of the authorization form and, upon request, a record of any subsequent disclosures of personal or privileged information pursuant to 33-19-306(2) through (17) that must include:
     (a) the name, address, and institutional affiliation, if any, of each person receiving or examining the recorded health care information during the preceding 3 years;
     (b) the date of the receipt or examination; and
     (c) to the extent practicable, a description of the information disclosed.
     (9) The provisions of subsection (8) do not require disclosure to the individual or person authorized to act on behalf of the individual when the disclosure has been made to a person whose identity could not be discovered under the applicable rules of civil procedure.
     (10) An individual insurance producer may collect personal information from an applicant before obtaining a signed authorization form or statement from the applicant. However, the individual insurance producer may not disclose the personal information to any person before obtaining a signed authorization form or statement from the applicant.

     History: En. Sec. 8, Ch. 580, L. 1981; amd. Sec. 1, Ch. 713, L. 1989; amd. Sec. 3, Ch. 212, L. 1999.