SENATE BILL NO. 103
INTRODUCED BY E. FRANKLIN
BY REQUEST OF THE STATE AUDITOR
AN ACT AMENDING THE INSURANCE INFORMATION AND PRIVACY PROTECTION ACT; CLARIFYING THE DEFINITION OF INSURANCE FUNCTION AND MEDICAL RECORD INFORMATION; REQUIRING CONSENT BEFORE AN INSURANCE INSTITUTION, INSURANCE PRODUCER, OR INSURANCE-SUPPORT ORGANIZATION COLLECTS PERSONAL OR PRIVILEGED INFORMATION ABOUT AN INDIVIDUAL; PROVIDING AN EXCEPTION FOR INDIVIDUAL INSURANCE PRODUCERS; RESTRICTING DISCLOSURE OF MEDICAL RECORD INFORMATION; ALLOWING DISCLOSURE OF INFORMATION THAT IS NOT MEDICAL RECORD INFORMATION ABOUT AN INDIVIDUAL BY AN INSURANCE INSTITUTION, INSURANCE PRODUCER, OR INSURANCE-SUPPORT ORGANIZATION TO ANY AFFILIATE FOR MARKETING OF INSURANCE OR FINANCIAL PRODUCTS; PROVIDING INDIVIDUALS ACCESS TO RECORDS OF UNAUTHORIZED DISCLOSURE OF THEIR PERSONAL OR PRIVILEGED INFORMATION BY AN INSURANCE INSTITUTION, INSURANCE PRODUCER, OR INSURANCE-SUPPORT ORGANIZATION; AMENDING SECTIONS 33-19-104, 33-19-202, 33-19-204, AND 33-19-306, MCA; AND PROVIDING A DELAYED EFFECTIVE DATE.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MONTANA:
Section 1. Section 33-19-104, MCA, is amended to read:
"33-19-104. Definitions. As used in this chapter, the following definitions apply:
(1) (a) "Adverse underwriting decision" means any of the following actions with respect to insurance transactions involving insurance coverage that are individually underwritten:
(i) a declination of insurance coverage;
(ii) a termination of insurance coverage;
(iii) failure of an insurance producer to apply for insurance coverage with a specific insurance institution that the insurance producer represents and that is requested by an applicant;
(iv) in the case of a property or casualty insurance coverage:
(A) placement by an insurance institution or insurance producer of a risk with a residual market mechanism, an unauthorized insurer, or an insurance institution that specializes in substandard risks; or
(B) the charging of a higher rate on the basis of information that differs from that which the applicant or policyholder furnished;
(v) in the case of a life, health, or disability insurance coverage, an offer to insure at higher than standard rates.
(b) The following actions are not adverse underwriting decisions, but the insurance institution or insurance producer responsible for their occurrence shall nevertheless provide the applicant or policyholder with the specific reason or reasons for their occurrence:
(i) the termination of an individual policy form on a class or statewide basis;
(ii) a declination of insurance coverage solely because the coverage is not available on a class or statewide basis; or
(iii) the rescission of a policy.
(2) "Affiliate" or "affiliated" means a person who directly, or indirectly through one or more intermediaries, controls, is controlled by, or is under common control with another person.
(3) "Applicant" means a person who seeks to contract for insurance coverage other than a person seeking group insurance that is not individually underwritten.
(4) "Consumer report" means any written, oral, or other communication of information bearing on a natural person's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living that is used or expected to be used in connection with an insurance transaction.
(5) "Consumer reporting agency" means a person who:
(a) regularly engages, in whole or in part, in the practice of assembling or preparing consumer reports for a monetary fee;
(b) obtains information primarily from sources other than insurance institutions; and
(c) furnishes consumer reports to other persons.
(6) "Control", including the terms "controlled by" or "under common control with", means the possession, direct or indirect, of the power to direct or cause the direction of the management and policies of a person, whether through the ownership of voting securities, by contract other than a commercial contract for goods or nonmanagement services, or otherwise, unless the power is the result of an official position with or corporate office held by the person.
(7) "Declination of insurance coverage" means a denial, in whole or in part, by an insurance institution or insurance producer of requested insurance coverage.
(8) "Individual" means a natural person who:
(a) regarding property or casualty insurance, is a past, present, or proposed named insured or certificate holder;
(b) regarding life, health, or disability insurance, is a past, present, or proposed principal insured or certificate holder;
(c) is a past, present, or proposed policyowner;
(d) is a past or present applicant;
(e) is a past or present claimant; or
(f) derived, derives, or is proposed to derive insurance coverage under an insurance policy or certificate subject to this chapter.
(9) "Institutional source" means a person or governmental entity that provides information about an individual to an insurance producer, insurance institution, or insurance-support organization, other than:
(a) an insurance producer;
(b) the individual who is the subject of the information; or
(c) a natural person acting in a personal capacity rather than a business or professional capacity.
(10) "Insurance function" means claims administration, claims adjustment and management, fraud investigation, underwriting, loss control, ratemaking functions, reinsurance, risk management, case management, disease management, quality assessment, quality improvement, provider credentialing verification, utilization review, peer review activities, grievance procedures, and internal administration of compliance and policyholder service functions.
(10)(11) (a) "Insurance institution" means a corporation, association, partnership, reciprocal exchange, interinsurer,
Lloyd's insurer, fraternal benefit society, or other person engaged in the business of insurance, including health maintenance
organizations, and health service corporations as defined in 33-30-101.
(b) Insurance institution does not include insurance producers or insurance-support organizations.
(11)(12) "Insurance producer" means an insurance producer as defined in 33-17-102 and 33-30-311.
(12)(13) (a) "Insurance-support organization" means a person who assembles or collects information about natural
persons for the purpose of providing the information to an insurance institution or insurance producer for insurance
transactions, including:
(i) the furnishing of consumer reports or investigative consumer reports to an insurance institution or insurance producer for use in connection with an insurance transaction; or
(ii) the collection of personal information from insurance institutions, insurance producers, or other insurance-support organizations for the purpose of detecting or preventing fraud, material misrepresentation, or material nondisclosure in connection with insurance underwriting or insurance claim activity.
(b) The following persons are not insurance-support organizations for purposes of this chapter: insurance producers, government institutions, medical care institutions, and medical professionals.
(13)(14) "Insurance transaction" means a transaction involving insurance primarily for personal, family, or household
needs, rather than for business or professional needs, that entails:
(a) the determination of an individual's eligibility for an insurance coverage, benefit, or payment; or
(b) the servicing of an insurance application, policy, contract, or certificate.
(14)(15) "Investigative consumer report" means a consumer report or portion of a consumer report containing
information about a natural person's character, general reputation, personal characteristics, or mode of living obtained
through personal interviews with the person's neighbors, friends, associates, acquaintances, or others who may have
knowledge concerning this type of information.
(15)(16) "Medical care institution" means a facility or institution that is licensed to provide health care services to natural
persons, including but not limited to health maintenance organizations, home health agencies, hospitals, medical clinics,
public health agencies, rehabilitation agencies, and skilled nursing facilities.
(16)(17) "Medical professional" means a person who is licensed or certified to provide health care services to natural
persons, including but not limited to a chiropractor, clinical dietitian, clinical psychologist, dentist, nurse, occupational
therapist, optometrist, pharmacist, physical therapist, physician, podiatrist, psychiatric social worker, or speech-language
pathologist.
(17)(18) "Medical record information" means personal information that:
(a) relates to an individual's physical or mental condition, medical history, medical claims history, or medical treatment; and
(b) is obtained from a medical professional or medical care institution, from the individual, or from the individual's spouse, parent, or legal guardian.
(18)(19) "Person" means a natural person, corporation, association, partnership, or other legal entity.
(19)(20) "Personal information" means any individually identifiable information gathered in connection with an
insurance transaction from which judgments can be made about an individual's character, habits, avocations, finances,
occupation, general reputation, credit, health, or any other personal characteristics. Personal information includes an
individual's name and address and medical record information but does not include privileged information.
(20)(21) "Policyholder" means a person who:
(a) in the case of individual property or casualty insurance, is a present named insured;
(b) in the case of individual life, health, or disability insurance, is a present policyowner; or
(c) in the case of group insurance that is individually underwritten, is a present group certificate holder.
(21)(22) "Pretext interview" means an interview during which a person, in an attempt to obtain information about a
natural person, performs one or more of the following acts:
(a) pretends to be someone else;
(b) pretends to represent a person not in fact being represented;
(c) misrepresents the true purpose of the interview; or
(d) refuses to provide identification upon request.
(22)(23) "Privileged information" means any individually identifiable information that:
(a) relates to a civil or criminal proceeding involving an individual; and
(b) is collected in connection with or in reasonable anticipation of a claim for insurance benefits or civil or criminal proceeding involving an individual. Information otherwise meeting the requirements of privileged information under this subsection is considered personal information under this chapter if it is disclosed in violation of 33-19-306.
(23)(24) "Residual market mechanism" means an association, organization, or other entity defined or described in
61-6-144.
(25) (a) "Separate, written authorization" means an individual's written authorization that is:
(i) given to the recipient of personal or privileged information that has been disclosed pursuant to 33-19-306(3) through (17); and
(ii) separate from any written authorization obtained by the disclosing insurance institution, insurance producer, or insurance-support organization pursuant to 33-19-204.
(b) The term does not include the insurance institution, insurance producer, or insurance-support organization that discloses personal or privileged information pursuant to 33-19-306(3) through (17).
(24)(26) "Termination of insurance coverage" or "termination of an insurance policy" means either a cancellation or
nonrenewal of an insurance policy, in whole or in part, for any reason other than the failure to pay a premium as required by
the policy.
(25)(27) "Unauthorized insurer" means an insurance institution that has not been granted a certificate of authority by the
commissioner to transact the business of insurance in this state."
Section 2. Section 33-19-202, MCA, is amended to read:
"33-19-202. Notice of insurance information practices. (1) An insurance institution or insurance producer shall provide a notice of information practices to all applicants or policyholders in connection with insurance transactions as provided below:
(a) in the case of an application for insurance, a notice shall must be provided no later than:
(i) at the time of the delivery of the insurance policy or certificate when personal information is collected only from the applicant or from public records; or
(ii) at the time the collection of personal information is initiated when personal information is collected from a source other than the applicant or public records;
(b) in the case of a policy renewal, a notice shall must be provided no later than the policy renewal date, except that no
notice is not required in connection with a policy renewal if:
(i) personal information is collected only from the policyholder or from public records; or
(ii) a notice meeting the requirements of this section has been given within the previous 24 months; or
(c) in the case of a policy reinstatement or change in insurance benefits, a notice shall must be provided no later than the
time a request for a policy reinstatement or change in insurance benefits is received by the insurance institution, except that
no notice is not required if personal information is collected only from the policyholder or from public records.
(2) The notice must be in writing and must state:
(a) whether personal information may be collected from persons other than the individual or individuals proposed for coverage;
(b) the types of personal information that may be collected and the types of sources and investigative techniques that
may be used to collect such the information;
(c) the types of disclosures identified in subsections (3), (4), (5), (6), (7), (10), (12), (13), and (15) (14) of 33-19-306
and the circumstances under which such the disclosures may be made without prior authorization. However, only those
circumstances that occur with such frequency as to indicate a general business practice must be described.
(d) a description of the rights established under 33-19-301 and 33-19-302 and the manner in which those rights may be exercised; and
(e) that information obtained from a report prepared by an insurance-support organization may be retained by the insurance-support organization and disclosed to other persons.
(3) In lieu of the notice prescribed in subsection (2), the insurance institution or insurance producer may provide an abbreviated notice informing the applicant or policyholder that:
(a) personal information may be collected from persons other than the individual or individuals proposed for coverage;
(b) such the information as well as other personal or privileged information subsequently collected by the insurance
institution or insurance producer may in certain circumstances be disclosed to third parties without authorization;
(c) a right of access and correction exists with respect to all personal information collected; and
(d) the notice prescribed in subsection (2) must be furnished to the applicant or policyholder upon request.
(4) The obligations imposed by this section upon an insurance institution or insurance producer may be satisfied by another insurance institution or insurance producer authorized to act on its behalf."
Section 3. Section 33-19-204, MCA, is amended to read:
"33-19-204. Content, use, and disclosure of authorization forms. Notwithstanding any other provision of law of this
state, an insurance institution, insurance producer, except as provided in subsection (10), or insurance-support organization
may not utilize as its disclosure authorization form collect personal or privileged information about an individual in
connection with insurance transactions except in conformance with a form or statement that authorizes the disclosure of
personal or privileged information about an the individual to the insurance institution, insurance producer, or
insurance-support organization unless and the form or statement:
(1) is written in plain language;
(2) is dated and signed by the individual or a person authorized to act on behalf of the individual;
(3) specifies the types of persons authorized to disclose information about the individual;
(4) specifies the nature of the information authorized to be disclosed;
(5) names the insurance institution or insurance producer and identifies by generic reference representatives of the insurance institution to whom the individual is authorizing information to be disclosed;
(6) specifies the purposes for which the information is collected;
(7) specifies the length of time such that the authorization remains valid, which may be no longer than:
(a) in the case of authorizations signed for the purpose of collecting information in connection with an application for an insurance policy, a policy reinstatement, or a request for change in policy benefits:
(i) 30 months from the date the authorization is signed if the application or request involves life, health, or disability insurance;
(ii) 1 year from the date the authorization is signed if the application or request involves property or casualty insurance;
(b) in the case of authorizations signed for the purpose of collecting information in connection with a claim for benefits under an insurance policy:
(i) the term of coverage of the policy if the claim is for a health insurance benefit;
(ii) the duration of the claim if the claim is not for a health insurance benefit; and
(8) advises the individual or a person authorized to act on behalf of the individual that, subject to the exception provided in subsection (9), the individual or the individual's authorized representative is entitled to receive a copy of the authorization form and, upon request, a record of any subsequent disclosures of personal or privileged information pursuant to 33-19-306(2) through (17) that must include:
(a) the name, address, and institutional affiliation, if any, of each person receiving or examining the recorded health care information during the preceding 3 years;
(b) the date of the receipt or examination; and
(c) to the extent practicable, a description of the information disclosed.
(9) The provisions of subsection (8) do not require disclosure to the individual or person authorized to act on behalf of the individual when the disclosure has been made to a person whose identity could not be discovered under the applicable rules of civil procedure.
(10) An individual insurance producer may collect personal information from an applicant before obtaining a signed authorization form or statement from the applicant. However, the individual insurance producer may not disclose the personal information to any person before obtaining a signed authorization form or statement from the applicant."
Section 4. Section 33-19-306, MCA, is amended to read:
"33-19-306. Disclosure limitations and conditions. (1) Except as provided in this section, an insurance institution, insurance producer, or insurance-support organization may not disclose any personal or privileged information about an individual collected or received in connection with an insurance transaction.
(2) Disclosure may be made with the written authorization of the individual but:
(a) if the authorization is submitted by another insurance institution, insurance producer, or insurance-support organization, the authorization must meet the requirements of 33-19-204; or
(b) if the authorization is submitted by a person other than an insurance institution, insurance producer, or insurance-support organization, the authorization must be:
(i) dated;
(ii) signed by the individual; and
(iii) sufficient to identify the nature of the information to be disclosed and the person to whom the information is to be disclosed; and
(iii)(iv) obtained 1 year or less prior to the date a disclosure is sought pursuant to this subsection.
(3) Disclosure may be made to a person other than an insurance institution, insurance producer, or insurance-support
organization, provided such that the disclosure is limited to that which is reasonably necessary:
(a) to enable such the person to perform a business, professional, or an insurance function for the disclosing insurance
institution, insurance producer, or insurance-support organization and such the person agrees not to further disclose the
information further without the individual's separate, written authorization unless the further disclosure:; or
(i) would otherwise be permitted by this section if made by an insurance institution, insurance producer, or
insurance-support organization; or
(ii) is reasonably necessary for such person to perform its function for the disclosing insurance institution, insurance
producer, or insurance-support organization; or
(b) to enable such the person that has agreed not to further disclose the information without the individual's separate,
written authorization to provide information to the disclosing insurance institution, insurance producer, or insurance-support
organization for the purpose of:
(i) determining an individual's eligibility for an insurance benefit or payment; or
(ii) detecting or preventing criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with an insurance transaction.
(4) Disclosure may be made to an insurance institution, insurance producer, insurance-support organization, or self-insurer that has agreed not to further disclose the information without the individual's separate, written authorization if the information disclosed is limited to that which is reasonably necessary:
(a) to detect or prevent criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with insurance transactions; or
(b) for either the disclosing or receiving insurance institution, insurance producer, or insurance-support organization to perform its insurance function in connection with an insurance transaction involving the individual.
(5) Disclosure may be made to a medical care institution or medical professional of that information reasonably necessary for the following purposes:
(a) verifying insurance coverage or benefits;
(b) informing an individual of a medical problem of which the individual may not be aware; or
(c) conducting an operations or services audit.
(6) Disclosure may be made to an insurance regulatory authority that agrees not to further disclose the information without the individual's separate, written authorization.
(7) Disclosure may be made to a law enforcement or other government authority:
(a) to protect the interests of the insurance institution, insurance producer, or insurance-support organization in preventing or prosecuting the perpetration of fraud upon it; or
(b) if the insurance institution, insurance producer, or insurance-support organization reasonably believes that illegal activities have been conducted by the individual.
(8) Disclosure that is limited to that which is reasonably necessary may be made as otherwise permitted or required by law.
(9) Disclosure that is limited to that which is reasonably necessary may be made in response to a facially valid administrative or judicial order, including a search warrant or subpoena.
(10) Disclosure (a) Except as provided in subsection (10)(b), disclosure that is limited to that which is reasonably
necessary may be made for the purpose of conducting actuarial or research studies, provided that:
(a)(i) no individual may be is identified in any actuarial or research report;
(b)(ii) materials allowing the individual to be identified are returned or destroyed as soon as they are no longer needed;
and
(c)(iii) the actuarial or research organization agrees not to further disclose the information unless the disclosure would
otherwise be permitted by this section if made by an insurance institution, insurance producer, or insurance-support
organization without the individual's separate, written authorization.
(b) Disclosure of information may be made for:
(i) health research that is subject to the approval of an institutional review board and the requirements of federal law and regulations governing biomedical research; or
(ii) epidemiological or drug therapy outcomes research that requires information that has been made anonymous to protect the identity of the patient through coding or encryption.
(11) Disclosure may be made to a party or a representative of a party to a proposed or consummated sale, transfer, merger, or consolidation of all or part of the business of the insurance institution, insurance producer, or insurance-support organization, if:
(a) prior to the consummation of the sale, transfer, merger, or consolidation only such information is disclosed as that is
reasonably necessary to enable the recipient to make business decisions about the purchase, transfer, merger, or
consolidation; and
(b) the recipient agrees not to further disclose the information unless the disclosure would otherwise be permitted by this
section if made by an insurance institution, insurance producer, or insurance-support organization without the individual's
separate, written authorization.
(12) Disclosure may be made to a person whose only use of such information will be in connection with the marketing of
a product or service, if:
(a) no medical record information, privileged information, or personal information relating to an individual's character,
personal habits, mode of living, or general reputation is disclosed, and no classification derived from such information is
disclosed;
(b) the individual has been given an opportunity to indicate that he does not want personal information disclosed for
marketing purposes and has given no indication that he does not want the information disclosed; and
(c) the person receiving the information agrees not to use it except in connection with the marketing of a product or
service.
(13)(12) (a) Disclosure that is limited to that which is reasonably necessary may be made to an any affiliate whose only
use of the information will be in connection with an audit of the insurance institution or insurance producer or the
marketing of an insurance product or service if the affiliate agrees not to disclose the information for any other purpose or to
unaffiliated persons.
(b) Disclosure of personal information that is limited to an individual's name, age, sex, family composition, address, telephone number, occupation, and avocations may be made to any affiliate whose only use of the information is in connection with the marketing of insurance or financial products if the affiliate agrees not to disclose the information for any other purpose or to unaffiliated persons.
(14)(13) Disclosure Except for medical record information, disclosure may be made by a consumer reporting agency to a
person other than an insurance institution or insurance producer.
(15)(14) Disclosure may be made to a group policyholder for the purpose of reporting claims experience or conducting
an audit of the insurance institution's or insurance producer's operations or services if the information disclosed is
reasonably necessary for the group policyholder to conduct the review or audit and the group policyholder agrees not to
further disclose the information without the individual's separate, written authorization.
(16)(15) Disclosure that is limited to that which is reasonably necessary may be made to a professional peer review
organization for the purpose of reviewing the service or conduct of a medical care institution or medical professional if the
professional peer review organization agrees not to further disclose the information without the individual's separate,
written authorization.
(17)(16) Disclosure that is limited to that which is reasonably necessary may be made to a governmental authority as
required by federal or state law or for the purpose of determining the individual's eligibility for health benefits for which the
governmental authority may be liable.
(18)(17) Disclosure that is limited to that which is reasonably necessary may be made to a certificate holder or
policyholder for the purpose of providing information regarding the status of an insurance transaction.
(18) The commissioner may, after notice and hearing, adopt rules to carry out the provisions of this section. The rules may not define the recordkeeping requirements regarding authorized disclosures of personal or privileged information pursuant to subsections (2) through (17) but may define the requirements of any agreement obtained by an insurance institution, insurance producer, or insurance-support organization regarding disclosures of personal or privileged information."
Section 5. Effective date. [This act] is effective January 1, 2000.
- END -
Latest Version of SB 103 (SB0103.ENR)
Processed for the Web on April 1, 1999 (10:02AM)
New language in a bill appears underlined, deleted material appears stricken.
Sponsor names are handwritten on introduced bills, hence do not appear on the bill until it is reprinted. See the status of the bill for the bill's primary sponsor.
Status of this Bill | 1999 Session | Leg. Branch Home
This bill in WP 5.1 | All versions of all bills in WP 5.1
Prepared by Montana Legislative Services
(406)444-3064