33-19-306. Disclosure limitations and conditions. (1) Except as provided in this section, an insurance institution, insurance producer, or insurance-support organization may not disclose any personal or privileged information about an individual collected or received in connection with an insurance transaction.
     (2) Disclosure may be made with the written authorization of the individual but:
     (a) if the authorization is submitted by another insurance institution, insurance producer, or insurance-support organization, the authorization must meet the requirements of 33-19-204; or
     (b) if the authorization is submitted by a person other than an insurance institution, insurance producer, or insurance-support organization, the authorization must be:
     (i) dated;
     (ii) signed by the individual;
     (iii) sufficient to identify the nature of the information to be disclosed and the person to whom the information is to be disclosed; and
     (iv) obtained 1 year or less prior to the date a disclosure is sought pursuant to this subsection.
     (3) Disclosure may be made to a person other than an insurance institution, insurance producer, or insurance-support organization, provided that the disclosure is limited to that which is reasonably necessary:
     (a) to enable the person to perform an insurance function for the disclosing insurance institution, insurance producer, or insurance-support organization and the person agrees not to further disclose the information without the individual's separate, written authorization; or
     (b) to enable the person that has agreed not to further disclose the information without the individual's separate, written authorization to provide information to the disclosing insurance institution, insurance producer, or insurance-support organization for the purpose of:
     (i) determining an individual's eligibility for an insurance benefit or payment; or
     (ii) detecting or preventing criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with an insurance transaction.
     (4) Disclosure may be made to an insurance institution, insurance producer, insurance-support organization, or self-insurer that has agreed not to further disclose the information without the individual's separate, written authorization if the information disclosed is limited to that which is reasonably necessary:
     (a) to detect or prevent criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with insurance transactions; or
     (b) for either the disclosing or receiving insurance institution, insurance producer, or insurance-support organization to perform its insurance function in connection with an insurance transaction involving the individual.
     (5) Disclosure may be made to a medical care institution or medical professional of that information reasonably necessary for the following purposes:
     (a) verifying insurance coverage or benefits;
     (b) informing an individual of a medical problem of which the individual may not be aware; or
     (c) conducting an operations or services audit.
     (6) Disclosure may be made to an insurance regulatory authority that agrees not to further disclose the information without the individual's separate, written authorization.
     (7) Disclosure may be made to a law enforcement or other government authority:
     (a) to protect the interests of the insurance institution, insurance producer, or insurance-support organization in preventing or prosecuting the perpetration of fraud upon it; or
     (b) if the insurance institution, insurance producer, or insurance-support organization reasonably believes that illegal activities have been conducted by the individual.
     (8) Disclosure that is limited to that which is reasonably necessary may be made as otherwise permitted or required by law.
     (9) Disclosure that is limited to that which is reasonably necessary may be made in response to a facially valid administrative or judicial order, including a search warrant or subpoena.
     (10) (a) Except as provided in subsection (10)(b), disclosure that is limited to that which is reasonably necessary may be made for the purpose of conducting actuarial or research studies, provided that:
     (i) no individual is identified in any actuarial or research report;
     (ii) materials allowing the individual to be identified are returned or destroyed as soon as they are no longer needed; and
     (iii) the actuarial or research organization agrees not to further disclose the information without the individual's separate, written authorization.
     (b) Disclosure of information may be made for:
     (i) health research that is subject to the approval of an institutional review board and the requirements of federal law and regulations governing biomedical research; or
     (ii) epidemiological or drug therapy outcomes research that requires information that has been made anonymous to protect the identity of the patient through coding or encryption.
     (11) Disclosure may be made to a party or a representative of a party to a proposed or consummated sale, transfer, merger, or consolidation of all or part of the business of the insurance institution, insurance producer, or insurance-support organization, if:
     (a) prior to the consummation of the sale, transfer, merger, or consolidation only information is disclosed that is reasonably necessary to enable the recipient to make business decisions about the purchase, transfer, merger, or consolidation; and
     (b) the recipient agrees not to further disclose the information without the individual's separate, written authorization.
     (12) (a) Disclosure that is limited to that which is reasonably necessary may be made to any affiliate whose only use of the information will be in connection with an audit of the insurance institution or insurance producer if the affiliate agrees not to disclose the information for any other purpose or to unaffiliated persons.
     (b) Disclosure of personal information that is limited to an individual's name, age, sex, family composition, address, telephone number, occupation, and avocations may be made to any affiliate whose only use of the information is in connection with the marketing of insurance or financial products if the affiliate agrees not to disclose the information for any other purpose or to unaffiliated persons.
     (13) Except for medical record information, disclosure may be made by a consumer reporting agency to a person other than an insurance institution or insurance producer.
     (14) Disclosure may be made to a group policyholder for the purpose of reporting claims experience or conducting an audit of the insurance institution's or insurance producer's operations or services if the information disclosed is reasonably necessary for the group policyholder to conduct the review or audit and the group policyholder agrees not to further disclose the information without the individual's separate, written authorization.
     (15) Disclosure that is limited to that which is reasonably necessary may be made to a professional peer review organization for the purpose of reviewing the service or conduct of a medical care institution or medical professional if the professional peer review organization agrees not to further disclose the information without the individual's separate, written authorization.
     (16) Disclosure that is limited to that which is reasonably necessary may be made to a governmental authority as required by federal or state law or for the purpose of determining the individual's eligibility for health benefits for which the governmental authority may be liable.
     (17) Disclosure that is limited to that which is reasonably necessary may be made to a certificate holder or policyholder for the purpose of providing information regarding the status of an insurance transaction.
     (18) The commissioner may, after notice and hearing, adopt rules to carry out the provisions of this section. The rules may not define the recordkeeping requirements regarding authorized disclosures of personal or privileged information pursuant to subsections (2) through (17) but may define the requirements of any agreement obtained by an insurance institution, insurance producer, or insurance-support organization regarding disclosures of personal or privileged information.

     History: En. Sec. 15, Ch. 580, L. 1981; amd. Sec. 1, Ch. 713, L. 1989; amd. Sec. 4, Ch. 212, L. 1999.