SENATE BILL NO. 465
INTRODUCED BY E. FRANKLIN
AN ACT AMENDING THE INSURANCE INFORMATION AND PRIVACY PROTECTION ACT; PROVIDING FOR EXEMPTION FROM THE ACT FOR PERSONS COMPLYING WITH FEDERAL REGULATIONS THAT ARE INCONSISTENT WITH THE ACT AND NOT LESS PROTECTIVE OF PRIVACY THAN THE ACT; AUTHORIZING THE COMMISSIONER OF INSURANCE TO ADOPT RULES; REVISING DEFINITIONS; REVISING REQUIREMENTS FOR NOTICE OF INSURANCE INFORMATION PRACTICES; REVISING STATUTES RELATING TO DISCLOSURE AUTHORIZATION FORMS; REVISING PROVISIONS RELATING TO EXCEPTIONS FROM PROHIBITED DISCLOSURES; PROVIDING RESTRICTIONS ON THE USE OF PERSONAL INFORMATION FOR MARKETING PURPOSES; REVISING CIVIL PENALTIES AND INDIVIDUAL REMEDIES APPLICABLE TO DISCLOSURE VIOLATIONS; AMENDING SECTIONS 33-19-102, 33-19-104, 33-19-202, 33-19-306, 33-19-405, AND 33-19-407, MCA; REPEALING SECTIONS 33-19-204, 33-19-402, 33-19-404, AND 33-19-406, MCA; AND PROVIDING EFFECTIVE DATES AND A RETROACTIVE APPLICABILITY DATE.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MONTANA:
Section 1. Section 33-19-102, MCA, is amended to read:
"33-19-102. Purpose. The purpose of this chapter is to establish standards for the collection, use, and disclosure of
information gathered in connection with insurance transactions by insurance institutions, insurance producers, or
insurance-support organizations; to maintain a balance between the need for information by those conducting the business
of insurance and the public's need for fairness in insurance information practices, including the need to minimize
intrusiveness; to establish a regulatory mechanism to enable natural persons to ascertain what information is being or has
been collected about them in connection with insurance transactions and to have access to such that information for the
purpose of verifying or disputing its accuracy; to limit the disclosure of information collected in connection with insurance
transactions; and to enable insurance applicants and policyholders to obtain the reasons for any adverse underwriting
decision. The purpose of this chapter is also to provide privacy protection consistent with federal regulations governing the
privacy of medical records when this chapter is consistent with those federal regulations. In those instances in which this
chapter and the federal privacy regulations are inconsistent and this chapter provides privacy protection beyond that offered
by the federal regulations, the purpose of this chapter is to provide that additional privacy protection."
Section 2. Section 33-19-104, MCA, is amended to read:
"33-19-104. Definitions. As used in this chapter, the following definitions apply:
(1) (a) "Adverse underwriting decision" means any of the following actions with respect to insurance transactions involving insurance coverage that are individually underwritten:
(i) a declination of insurance coverage;
(ii) a termination of insurance coverage;
(iii) failure of an insurance producer to apply for insurance coverage with a specific insurance institution that the insurance producer represents and that is requested by an applicant;
(iv) in the case of a property or casualty insurance coverage:
(A) placement by an insurance institution or insurance producer of a risk with a residual market mechanism, an unauthorized insurer, or an insurance institution that specializes in substandard risks; or
(B) the charging of a higher rate on the basis of information that differs from that which the applicant or policyholder furnished;
(v) in the case of a life, health, or disability insurance coverage, an offer to insure at higher than standard rates.
(b) The following actions are not adverse underwriting decisions, but the insurance institution or insurance producer responsible for their occurrence shall nevertheless provide the applicant or policyholder with the specific reason or reasons for their occurrence:
(i) the termination of an individual policy form on a class or statewide basis;
(ii) a declination of insurance coverage solely because the coverage is not available on a class or statewide basis; or
(iii) the rescission of a policy.
(2) "Affiliate" or "affiliated" means a person who directly, or indirectly through one or more intermediaries, controls, is controlled by, or is under common control with another person.
(3) "Applicant" means a person who seeks to contract for insurance coverage other than a person seeking group insurance that is not individually underwritten.
(4) "Consumer report" means any written, oral, or other communication of information bearing on a natural person's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living that is used or expected to be used in connection with an insurance transaction.
(5) "Consumer reporting agency" means a person who:
(a) regularly engages, in whole or in part, in the practice of assembling or preparing consumer reports for a monetary fee;
(b) obtains information primarily from sources other than insurance institutions; and
(c) furnishes consumer reports to other persons.
(6) "Control", including the terms "controlled by" or "under common control with", means the possession, direct or indirect, of the power to direct or cause the direction of the management and policies of a person, whether through the ownership of voting securities, by contract other than a commercial contract for goods or nonmanagement services, or otherwise, unless the power is the result of an official position with or corporate office held by the person.
(7) "Declination of insurance coverage" means a denial, in whole or in part, by an insurance institution or insurance producer of requested insurance coverage.
(8) "Individual" means a natural person who:
(a) regarding property or casualty insurance, is a past, present, or proposed named insured or certificate holder;
(b) regarding life, health, or disability insurance, is a past, present, or proposed principal insured or certificate holder;
(c) is a past, present, or proposed policyowner;
(d) is a past or present applicant;
(e) is a past or present claimant; or
(f) derived, derives, or is proposed to derive insurance coverage under an insurance policy or certificate subject to this chapter.
(9) "Institutional source" means a person or governmental entity that provides information about an individual to an insurance producer, insurance institution, or insurance-support organization, other than:
(a) an insurance producer;
(b) the individual who is the subject of the information; or
(c) a natural person acting in a personal capacity rather than a business or professional capacity.
(10) "Insurance function" means claims administration, claims adjustment and management, fraud investigation, underwriting, loss control, ratemaking functions, reinsurance, risk management, case management, disease management, quality assessment, quality improvement, provider credentialing verification, utilization review, peer review activities, subrogation, grievance procedures, insurance transactions, and internal administration of compliance and policyholder service functions.
(11) (a) "Insurance institution" means a corporation, association, partnership, reciprocal exchange, interinsurer, Lloyd's insurer, fraternal benefit society, or other person engaged in the business of insurance, including health maintenance organizations, and health service corporations as defined in 33-30-101.
(b) Insurance institution does not include insurance producers or insurance-support organizations.
(12) "Insurance producer" means an insurance producer as defined in 33-17-102 and 33-30-311.
(13) (a) "Insurance-support organization" means a person who assembles or collects information about natural persons for the purpose of providing the information to an insurance institution or insurance producer for insurance transactions, including:
(i) the furnishing of consumer reports or investigative consumer reports to an insurance institution or insurance producer for use in connection with an insurance transaction; or
(ii) the collection of personal information from insurance institutions, insurance producers, or other insurance-support organizations for the purpose of detecting or preventing fraud, material misrepresentation, or material nondisclosure in connection with insurance underwriting or insurance claim activity.
(b) The following persons are not insurance-support organizations for purposes of this chapter: insurance producers, government institutions, medical care institutions, and medical professionals.
(14) "Insurance transaction" means a transaction involving insurance primarily for personal, family, or household needs, rather than for business or professional needs, that entails:
(a) the determination of an individual's eligibility for an insurance coverage, benefit, or payment; or
(b) the servicing of an insurance application, policy, contract, or certificate.
(15) "Investigative consumer report" means a consumer report or portion of a consumer report containing information about a natural person's character, general reputation, personal characteristics, or mode of living obtained through personal interviews with the person's neighbors, friends, associates, acquaintances, or others who may have knowledge concerning this type of information.
(16) "Licensee" means:
(a) an insurance institution, insurance producer, or other person who is licensed or required to be licensed, authorized or required to be authorized, or registered or required to be registered pursuant to this title; or
(b) a surplus lines insurer.
(16)(17) "Medical care institution" means a facility or institution that is licensed to provide health care services to
natural persons, including but not limited to health maintenance organizations, home health agencies, hospitals, medical
clinics, public health agencies, rehabilitation agencies, and skilled nursing facilities.
(17)(18) "Medical professional" means a person who is licensed or certified to provide health care services to natural
persons, including but not limited to a chiropractor, clinical dietitian, clinical psychologist, dentist, nurse, occupational
therapist, optometrist, pharmacist, physical therapist, physician, podiatrist, psychiatric social worker, or speech-language
pathologist.
(18)(19) "Medical record information" means personal information that:
(a) relates to an individual's physical or mental condition, medical history, medical claims history, or medical treatment; and
(b) is obtained from a medical professional or medical care institution, from the individual, or from the individual's spouse, parent, or legal guardian.
(19)(20) "Person" means a natural person, corporation, association, partnership, or other legal entity.
(20)(21) "Personal information" means any individually identifiable information gathered in connection with an
insurance transaction from which judgments can be made about an individual's character, habits, avocations, finances,
occupation, general reputation, credit, health, or any other personal characteristics. Personal information includes an
individual's name and address and medical record information but does not include privileged information.
(21)(22) "Policyholder" means a person who:
(a) in the case of individual property or casualty insurance, is a present named insured;
(b) in the case of individual life, health, or disability insurance, is a present policyowner; or
(c) in the case of group insurance that is individually underwritten, is a present group certificate holder.
(22)(23) "Pretext interview" means an interview during which a person, in an attempt to obtain information about a
natural person, performs one or more of the following acts:
(a) pretends to be someone else;
(b) pretends to represent a person not in fact being represented;
(c) misrepresents the true purpose of the interview; or
(d) refuses to provide identification upon request.
(23)(24) "Privileged information" means any individually identifiable information that:
(a) relates to a civil or criminal proceeding involving an individual; and
(b) is collected in connection with or in reasonable anticipation of a claim for insurance benefits or civil or criminal proceeding involving an individual. Information otherwise meeting the requirements of privileged information under this subsection is considered personal information under this chapter if it is disclosed in violation of 33-19-306.
(24)(25) "Residual market mechanism" means an association, organization, or other entity defined or described in
61-6-144.
(25)(26) (a) "Separate, written authorization" means an individual's written authorization that is:
(i)(a) given to the recipient of personal or privileged information that has been disclosed pursuant to 33-19-306(3)
through (17) (22); and
(ii)(b) separate from any written authorization obtained by the disclosing insurance institution, insurance producer, or
insurance-support organization pursuant to 33-19-204.
(b) The term does not include the insurance institution, insurance producer, or insurance-support organization that
discloses personal or privileged information pursuant to 33-19-306(3) through (17) .
(26)(27) "Termination of insurance coverage" or "termination of an insurance policy" means either a cancellation or
nonrenewal of an insurance policy, in whole or in part, for any reason other than the failure to pay a premium as required by
the policy.
(27)(28) "Unauthorized insurer" means an insurance institution that has not been granted a certificate of authority by the
commissioner to transact the business of insurance in this state."
Section 3. Exemption based on federal medical privacy rules -- notice to commissioner required. (1) If a licensee is subject to and in compliance with a federal rule that is part of the federal health insurance portability and accountability privacy rules, 45 CFR, parts 160 and 164, and the federal rule with which the licensee complies is inconsistent with a provision of this chapter and not less protective of consumer privacy, the licensee is exempt from compliance with the inconsistent provision of this chapter.
(2) If a licensee considers itself exempt from a provision of this chapter for the reason provided in subsection (1), the licensee shall give written notice to the commissioner of that exemption. The notice must include a statement of the reason for the claimed exemption.
Section 4. Rulemaking authorized. The commissioner may adopt rules to carry out the provisions of this chapter.
Section 5. Section 33-19-202, MCA, is amended to read:
"33-19-202. Notice of insurance information practices -- delivery of notice. (1) An insurance institution or
insurance producer A licensee shall provide a clear and conspicuous notice of information practices that accurately reflects
its privacy policies and practices to all applicants or policyholders individuals about whom personal information is
collected by the licensee in connection with insurance transactions as provided below: follows:
(a) in (1) (a) Except as provided in subsection (2), in the case of an application for insurance a policyholder or
certificate holder, a notice must be provided no later than delivered by an insurance institution:
(i)(i) in the case of policies issued after [the effective date of this section], no later than at the time of the delivery of the
insurance policy or certificate when personal information is collected only from the applicant or from public records; or
(ii) at the time the collection of personal information is initiated when personal information is collected from a source
other than the applicant or public records, unless the notice delivered to the policyholder or certificate holder pursuant to
subsection (4)(a) when the policyholder or certificate holder was an applicant is still accurate;
(ii) at least annually, the 12-month period for which may be defined by the insurance institution and must be used
consistently;. The notice to certificate holders required in this subsection (1)(a)(ii) is not required if the insurance institution
has not had any communication, including receiving a claim, from a certificate holder since the initial or last annual notice
provided to the certificate holder.
(b)(iii) in in the case of a policy renewal renewed after [the effective date of this section], a notice must be provided no
later than the policy renewal date, except that notice is not required in connection with a policy renewal if:
(i)(A) personal information is collected only from the policyholder or from public records; or
(ii)(B) a notice meeting the requirements of this section has been given within the previous 24 12 months; or.
(c)(b) in the case of a policy reinstatement or change in insurance benefits, a When a policyholder or certificate holder
obtains a new insurance product or service or when a policy is reinstated and any notices already provided are no longer
accurate with respect to the new product, service, or reinstatement, a new or revised and accurate notice must be provided
delivered to the policyholder or certificate holder no later than the time a request for a policy reinstatement or change in
insurance benefits is received by the insurance institution that the product or service is provided by the licensee or at the
time of reinstatement, except that notice is not required if personal information is collected only from the policyholder or
from public records.
(2) (a) An insurance institution is not required to meet the requirements of this section with respect to certificate holders until the insurance institution has personally identifiable information regarding the certificate holder.
(b) Until the notice requirements of subsection (1) are met, a third party administrator or other agent or representative of an insurance institution may not disclose personal information, except as allowed in 33-19-306(2).
(2)(3) The notice required in subsection (1) must be in writing and must state:
(a) whether the categories of personal information that may be collected from persons other than the individual or
individuals proposed for coverage covered;
(b) the types of personal information that may be collected and the types of sources and investigative techniques that
may be used to collect the information;
(c) the types of disclosures identified in subsections (3), (4), (5), (6), (7), (10), (12), and (14) of 33-19-306 and the
circumstances under which the disclosures may be made without prior authorization. However, only those circumstances
that occur with such frequency as to indicate a general business practice must be described. if a licensee discloses personal
or privileged information to a third party without an authorization pursuant to an exception in 33-19-306 or [section 8], a
separate description of the categories of information and the categories of third parties to whom the licensee discloses
personal information;
(c) the categories of personal information about a former policyholder or certificate holder that the licensee discloses pursuant to 33-19-306 and [section 8] and the categories of persons to whom the disclosure may be made;
(d) any disclosure that the licensee makes pursuant to section 603(d)(2)(A)(iii) of the Fair Credit Reporting Act, 15 U.S.C. 1681, et seq.;
(e) the licensee's policies and practices with respect to protecting the confidentiality and security of personal and privileged information;
(d)(f) a description of the rights established under 33-19-301 and 33-19-302 and the manner in which those rights may
be exercised; and
(e)(g) that information obtained from a report prepared by an insurance-support organization may be retained by the
insurance-support organization and disclosed to other persons.
(3) In lieu of the notice prescribed in subsection (2), the insurance institution or insurance producer may provide an
abbreviated notice informing the applicant or policyholder that if the licensee collects or uses information from an
insurance-support organization; and
(h) that an individual is entitled to receive, upon written request to the licensee, a record of any subsequent disclosures of medical record information made by the licensee pursuant to 33-19-306 that must include:
(i) the name, address, and institutional affiliation, if any, of each person receiving or examining the medical information during the preceding 3 years;
(ii) the date of the receipt or examination; and
(iii) to the extent practicable, a description of the information disclosed.
(4) In the case of individuals who are not policyholders or certificate holders:
(a) except as provided in subsection (7), in the case of an applicant, an insurance institution shall provide a notice as described in subsection (3) when the applicant submits an application;
(b) for all other individuals, a notice must be given when a licensee seeks an authorization pursuant to 33-19-306(2) to make a disclosure that is not allowed by a disclosure exception provided for in 33-19-306(3) through (22) or [section 8]. A notice given pursuant to this subsection (4)(b) may be in an abbreviated form and must state that:
(a)(i) personal information may be collected from persons other than the individual or individuals proposed for
coverage;
(b)(ii) the information as well as other personal or privileged information subsequently collected by the insurance
institution or insurance producer may in certain circumstances be disclosed to third parties without authorization;
(c)(iii) a right of access and correction exists with respect to all personal information collected; and
(d)(iv) the notice prescribed in subsection (2) (3) must be furnished to the applicant or policyholder upon request. The
abbreviated notice provided for in this subsection (4)(b) must explain a reasonable means by which an individual may
obtain that notice.
(4)(5) The obligations imposed by this section upon an insurance institution or insurance producer a licensee may be
satisfied:
(a) by another insurance institution or insurance producer licensee authorized to act on its behalf;
(b) by sending a notice to the primary policyholder of an individual policy or to the primary certificate holder..
(6) A licensee shall provide a notice required by this section so that an intended recipient can reasonably be expected to receive actual notice in writing or, if the intended recipient agrees, electronically, as follows:
(a) by hand-delivering a printed copy of the notice to the intended recipient;
(b) by mailing a printed copy of the notice to the last-known address of the individual separately or in a policy, billing, or other written communication; or
(c) for an individual who has agreed to conduct transactions electronically, as provided in applicable law, by posting the notice on the electronic site and requiring the individual to acknowledge receipt of the notice as a necessary step to obtaining a particular insurance product or service.
(7) An insurance institution may provide the notice required in subsection (4)(a) telephonically if an application is submitted by telephone. A telephone notice under this subsection may be in abbreviated form as provided for in subsections (4)(b)(i) through (4)(b)(iv).
(8) If a licensee is required to provide notice concerning privacy in addition to the notice required by this section, the licensee may satisfy the notice requirements in this section through the use of combined or separate notices. If more than one notice form is used, a notice containing provisions specific to Montana must conspicuously refer to any other notice form."
Section 6. Disclosure authorizations -- content -- conditions prohibited. If a disclosure authorization is required by this chapter, the following requirements apply:
(1) A valid authorization to disclose personal information must be in written form, or in electronic form as provided by applicable law, and must contain the following:
(a) the identity of the individual who is the subject of the personal information;
(b) a description of the types of personal information to be disclosed;
(c) a description of the entity or type of entity to which the licensee discloses personal information, the purpose of the disclosure, and how the information will be used;
(d) the signature of the individual who is the subject of the personal information or the individual who may by law allow the disclosure and the date on which the authorization is signed; and
(e) notice of the length of time for which the authorization is valid, notice that the individual may revoke the authorization at any time, and notice of the procedure for revocation.
(2) An authorization remains valid for a period stated in the authorization that does not exceed 24 contiguous months.
(3) An individual who is the subject of personal information and has signed an authorization may revoke the authorization at any time.
(4) A licensee shall retain the original authorization or a copy of it in the record of the individual who is the subject of personal information.
(5) A licensee may not condition enrollment, coverage, benefits, or rates on an individual's signing of a disclosure authorization unless the disclosure sought through the authorization is necessary for the licensee to perform an insurance function.
Section 7. Section 33-19-306, MCA, is amended to read:
"33-19-306. Disclosure limitations and conditions. (1) Except as provided in this section, an insurance institution,
insurance producer, or insurance-support organization a licensee may not disclose any personal or privileged information
about an individual collected or received in connection with an insurance transaction collected or received in connection
with an insurance transaction.
(2) Disclosure may be made with the written authorization of the individual but:
(a) if the authorization is submitted by another insurance institution, insurance producer, or insurance-support
organization, the authorization must meet the requirements of 33-19-204; or
(b) if the authorization is submitted by a person other than an insurance institution, insurance producer, or
insurance-support organization, the authorization must be:
(i) dated;
(ii) signed by the individual;
(iii) sufficient to identify the nature of the information to be disclosed and the person to whom the information is to be
disclosed; and
(iv) obtained 1 year or less prior to the date a disclosure is sought pursuant to this subsection. The authorization must be
in the form provided in [section 6].
(3) Disclosure limited to that which is reasonably necessary may be made to a person other than an insurance
institution, insurance producer, or insurance-support organization, provided that the disclosure is limited to that which is
reasonably necessary:
(a) to enable the person to perform an insurance function for the disclosing insurance institution, insurance producer, or
insurance-support organization and the person agrees not to further disclose the information without the individual's
separate, written authorization; or
(b) to enable the person that has agreed not to further disclose the information without the individual's separate, written
authorization to provide information to the disclosing insurance institution, insurance producer, or insurance-support
organization for the purpose of:
(i) determining an individual's eligibility for an insurance benefit or payment; or
(ii) to enable the person to provide information to the disclosing licensee for the purpose of detecting or preventing
criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with an insurance transaction.
A person to whom information is disclosed pursuant to this subsection shall agree in writing not to further disclose the
information, but this requirement for an agreement does not prevent disclosure of information that is necessary to obtain
further information for the purposes set forth in this subsection.
(4) (a) Disclosure may be made to an insurance institution, insurance producer, insurance-support organization, or
self-insurer that has agreed not to further disclose the information without the individual's separate, written authorization
between licensees if the information disclosed is limited to that which is reasonably necessary:
(a)(i) to detect or prevent criminal activity, fraud, material misrepresentation, or material nondisclosure in connection
with insurance transactions; or
(b)(ii) for either the disclosing or receiving insurance institution, insurance producer, or insurance-support organization
licensee to perform its insurance function in connection with an insurance transaction involving the an individual.
(b) A licensee receiving information pursuant to this subsection (4) may not further disclose the information unless otherwise permitted by this section.
(5) Disclosure may be made to a medical care institution or, a medical professional of, or the individual to whom the
information pertains if that information is reasonably necessary for the following purposes:
(a) verifying insurance coverage or benefits;
(b) informing an individual of a medical problem of which the individual may not be aware; or
(c) conducting an operations or services audit; or
(d) determining the reasonableness or necessity of medical services.
(6) Disclosure:
(a) may be made to an insurance regulatory authority that agrees not to further disclose the information without the individual's separate, written authorization;
(b) must be made as required by law; and
(c) must be or may be made to the commissioner as required or permitted by law.
(7) Disclosure may be made by a licensee or an insurance-support organization to a law enforcement or other government authority or to an insurance regulatory agency:
(a) to protect the interests of the insurance institution, insurance producer, or insurance-support organization a licensee
in preventing, investigating, or prosecuting the perpetration of fraud upon it a licensee; or
(b) if the insurance institution, insurance producer, or insurance-support organization licensee or insurance-support
organization reasonably believes that illegal activities have been conducted by the individual.
(8) Disclosure that is limited to that which is reasonably necessary may be made as otherwise permitted or required by law.
(9) Disclosure that is limited to that which is reasonably necessary may be made in response to a facially valid administrative or judicial order, including a search warrant or subpoena.
(10) (a) Except as provided in subsection (10)(b), disclosure that is limited to that which is reasonably necessary may be
made for the purpose of conducting actuarial or research studies, provided that if:
(i) no an individual is not identified in any actuarial or research report;
(ii) materials allowing the individual to be identified are returned or destroyed as soon as they are no longer needed; and
(iii) the actuarial or research organization agrees not to further disclose the information without the individual's separate, written authorization.
(b) Disclosure of information may be made for:
(i) health research that is subject to the approval of an institutional review board and the requirements of federal law and regulations governing biomedical research; or
(ii) epidemiological or drug therapy outcomes research that requires information that has been made anonymous to protect the identity of the patient through coding or encryption.
(11) Disclosure may be made to a party or a representative of a party to a proposed or consummated sale, transfer,
merger, or consolidation of all or part of the business of the insurance institution, insurance producer, licensee or
insurance-support organization, if:
(a) prior to the consummation of the sale, transfer, merger, or consolidation only information is disclosed that is reasonably necessary to enable the recipient to make business decisions about the purchase, transfer, merger, or consolidation; and
(b) the recipient agrees not to further disclose the information without the individual's separate, written authorization.
(12) (a) Disclosure that is limited to that which is reasonably necessary may be made to any a licensee's affiliate whose
only as follows:
(i) to allow use of the information will be in connection with an audit of the insurance institution or insurance producer
if the affiliate agrees not to disclose the information for any other purpose or to unaffiliated persons licensee;
(ii) to enable a licensee to perform an insurance function; or
(iii) as allowed by [section 8].
(b) Disclosure of personal information that is limited to an individual's name, age, sex, family composition, address,
telephone number, occupation, and avocations may be made to any affiliate whose only use of the information is in
connection with the marketing of insurance or financial products if the affiliate agrees not to disclose the information for
any other purpose or to unaffiliated persons A licensee disclosing pursuant to this section must have a written agreement
with the affiliate that the affiliate will not use or further disclose information received except to carry out the purposes set
forth in subsection (12) (a) and that if further disclosure is necessary to meet those purposes, the disclosure will be made
only to the licensee or to a person who agrees in writing to be bound by the same prohibition on use and disclosure. A
disclosure allowed by [section 8] is governed by that section.
(13) Except for medical record information, disclosure may be made by a consumer reporting agency to a person other
than an insurance institution or insurance producer Disclosure that is limited to that which is reasonably necessary may be
made to an insurance-support organization to perform insurance-support services for the licensee. The insurance-support
organization may redisclose the information to the extent necessary to provide its services to its member or subscriber
licensees and other insurance-support organizations or as otherwise permitted by law, but not for a marketing purpose.
(14) Disclosure Notwithstanding any other provision of this section, disclosure may be made to a group policyholder for
the purpose of reporting claims experience or conducting an audit of the insurance institution's or insurance producer's
licensee's operations or services if the information disclosed is reasonably necessary for the group policyholder to conduct
the review or audit and the group policyholder agrees not to further disclose the information without the individual's
separate, written authorization. Information disclosed pursuant to this subsection must be edited to prevent the
identification of the applicant, policyholder, or certificate holder.
(15) Disclosure that is limited to that which is reasonably necessary may be made to a professional peer review organization for the purpose of reviewing the service or conduct of a medical care institution or medical professional if the professional peer review organization agrees not to further disclose the information without the individual's separate, written authorization.
(16) Disclosure that is limited to that which is reasonably necessary may be made to a governmental authority as required by federal or state law or for the purpose of determining the individual's eligibility for health benefits for which the governmental authority may be liable.
(17) Disclosure that is limited to that which is reasonably necessary may be made to a certificate holder or policyholder for the purpose of providing information regarding the status of an insurance transaction. Disclosure pursuant to this subsection may not be made to a group policyholder without a separate, written authorization from the individual.
(18) Disclosure may be made to a person contractually engaged to provide services to enable a licensee to perform an insurance function, or to perform an insurance function on behalf of a licensee, if the person agrees in writing that the person will not use or further disclose information obtained or developed pursuant to the engagement except to carry out the limited purpose of the engagement and that if further disclosure is necessary to perform the insurance function, that disclosure will be made only to the licensee or to a person who agrees in writing to be bound by the same prohibitions on use and disclosure.
(19) If a licensee has to disclose personal information in order to perform an insurance function and disclosure is not permitted under another exception in this section, disclosure may be made to a person other than a licensee if the disclosure is limited to that which is reasonably necessary to enable the person to perform services or an insurance function for the disclosing licensee and if the person is notified by the licensee that the person is prohibited from:
(a) using the information other than to carry out the limited purpose for which the information is disclosed; and
(b) disclosing the information other than to the licensee and as allowed in subsection (3).
(20) Notwithstanding any other provision of this chapter, disclosure for a marketing purpose may be made only as allowed by [section 8].
(21) Nothing in this section may be construed to prevent the disclosure of personal information that is otherwise discoverable pursuant to the Montana Rules of Civil Procedure.
(18)(22) The commissioner may, after notice and hearing, adopt rules creating additional exceptions to disclosure
restrictions for the purpose of allowing a licensee or insurance-support organization to carry out the provisions of this
section. The rules may not define the recordkeeping requirements regarding authorized disclosures of personal or privileged
information pursuant to subsections (2) through (17) but may define the requirements of any agreement obtained by an
insurance institution, insurance producer, or insurance-support organization regarding disclosures of personal or privileged
information a necessary insurance function. The commissioner shall adopt rules establishing the methods that must be used
by licensees to prevent identification as described in subsection (14)."
Section 8. Personal information used for marketing purposes -- restrictions. (1) Except as permitted in this section, a licensee may not use or disclose personal information for a marketing purpose. For the purposes of this section, an insurance producer who describes to the producer's clients products or services available through the producer is not engaged in marketing.
(2) A licensee may use or disclose to another licensee personal information that is reasonably necessary to enable the licensee to market insurance products or services. A licensee may use or disclose to another licensee personal information, excluding medical record information, that is reasonably necessary to enable the licensee to market financial products and services. A licensee that receives personal information under this section from a disclosing licensee may not further disclose the information or use the information for any purpose other than marketing insurance and financial products and services.
(3) A licensee may disclose personal information that is reasonably necessary to enable an affiliate that is not a licensee to market insurance products and services. A licensee may disclose to an affiliate that is not a licensee personal information, excluding medical record information, that is reasonably necessary to enable the affiliate to market financial products and services. Disclosures under this subsection may be made only with a written agreement with the affiliate that the affiliate will not further disclose the information and will use it only for marketing insurance or financial products and services.
(4) A licensee may disclose personal information that is reasonably necessary to enable a person contractually engaged to provide services for or on behalf of the licensee to market insurance or financial products or services if the person agrees in writing that the person will not use or further disclose information obtained or developed pursuant to the engagement except to carry out the limited purpose of the engagement. A licensee shall adopt, maintain, and monitor policies and procedures reasonably designed to ensure that third parties with whom the licensee contracts under this subsection comply with the requirements of this section.
(5) A licensee may use or disclose personal information for purposes other than those specified in subsections (2) and (3) only with an individual's separate written authorization. In addition to meeting the requirements of [section 6], the authorization must:
(a) clearly and conspicuously state that the disclosed information is intended to be used for marketing purposes;
(b) specify each entity or type of entity to which the licensee intends to disclose the information;
(c) specify what information the licensee intends to disclose; and
(d) specify the type of marketing that the individual might receive pursuant to the disclosure.
Section 9. Section 33-19-405, MCA, is amended to read:
"33-19-405. Civil penalties penalty. If a hearing pursuant to 33-19-402 results in the finding of a knowing violation of
A person who violates this chapter, the commissioner may order payment of a is subject to the civil penalty of not more
than $500 for each violation but not to exceed $10,000 in the aggregate for multiple violations provided in 33-1-317."
Section 10. Section 33-19-407, MCA, is amended to read:
"33-19-407. Individual remedies. (1) If any insurance institution, insurance producer, or insurance-support organization fails to comply with 33-19-301, 33-19-302, or 33-19-303 with respect to the rights granted under those sections, any person whose rights are violated may apply to the district court of this state or any other court of competent jurisdiction for appropriate equitable relief.
(2) An insurance institution, insurance producer, or insurance-support organization that discloses information in
violation of 33-19-306 or [section 8] is liable for damages sustained by the individual to whom the information relates.
However, an individual is not entitled to a monetary award which that exceeds the actual damages sustained by the
individual as a result of a violation of 33-19-306 or [section 8].
(3) In any an action brought pursuant to this section, the court may award the cost of the action and reasonable
attorney's attorney fees to the prevailing party.
(4) An action under this section must be brought within 2 years from the date the alleged violation is or should have been discovered.
(5) Except as specifically provided in this section, there is no remedy or recovery available to individuals, in law or in equity, for occurrences constituting a violation of any provision of this chapter."
Section 11. Repealer. (1) Section 33-19-204, MCA, is repealed.
(2) Sections 33-19-402, 33-19-404, and 33-19-406, MCA, are repealed.
Section 12. Codification instruction. [Sections 3, 4, 6, and 8] are intended to be codified as an integral part of Title 33, chapter 19, and the provisions of Title 33, chapter 19, apply to [sections 3, 4, 6, and 8].
Section 13. Severability. If a part of [this act] is invalid, all valid parts that are severable from the invalid part remain in effect. If a part of [this act] is invalid in one or more of its applications, the part remains in effect in all valid applications that are severable from the invalid applications.
Section 14. Effective dates. (1) Except as provided in subsection (2), [this act] is effective July 1, 2001.
(2) [Sections 4, 7(22), 11(1), 12, and 13 and this section] are effective on passage and approval.
Section 15. Retroactive applicability. [Section 11(1)] applies retroactively, within the meaning of 1-2-109, to all insurance policies in force, issued, or renewed on or after January 1, 2000.
- END -
Latest Version of SB 465 (SB0465.ENR)
Processed for the Web on April 6, 2001 (4:08PM)
New language in a bill appears underlined, deleted material appears stricken.
Sponsor names are handwritten on introduced bills, hence do not appear on the bill until it is reprinted. See the status of this bill for the bill's primary sponsor.
Status of this Bill | 2001 Legislature | Leg. Branch Home
All versions of this bill (PDF Format)
Authorized print version w/line numbers (PDF format)
(406)444-3064