Ark. Code Ann. § 23-86-119 “Disclosure to Policyholders”

Arkansas Insurance Department Mike Beebe Lenita Blasingame Governor Commissioner 1200 West Third Street, Little Rock, AR 72201-1904 · (501) 371-2600 · (501) 371-2618 fax · www.insurance.arkansas.gov Information (800) 282-9134 · Consumer Services (800) 852-5494 · Seniors (800) 224-6330 · Criminal Inv. (866) 660-0888 BULLETIN NO. 1-2009 TO: ALL LICENSED INSURANCE COMPANIES, HEALTH MAINTENANCE ORGANIZATIONS, HOSPITAL MEDICAL SERVICE CORPORATIONS, NATIONAL ASSOCIATION OF INSURANCE COMMISSIONERS, AND OTHER INTERESTED PARTIES FROM: ARKANSAS INSURANCE DEPARTMENT SUBJECT: ARK. CODE ANN. §23-86-119 “DISCLOSURE TO POLICYHOLDERS” EFFECTIVE DATE: JANUARY 14, 2009 DATE: JANUARY 14, 2009 The Department is issuing this Bulletin in response to several inquiries it has received regarding the provisions contained in Ark. Code Ann. §23-86-119 and the possible conflicts that insurers may encounter with the HIPAA Privacy Rule. Under Ark. Code Ann. §23-86-119, insurers are required to release general health claims information to any policyholder with more than twenty-five (25) employees. This information is needed by employers to obtain insurance quotes on their group health plans. In most cases the release of this information would not be considered to be in conflict with the provisions of the HIPAA Privacy Rule. However, in some cases the release of this information to small employers may cause a problem for the insurers. Under the HIPAA Privacy Rule, there are several actions insurers may take in order to remain in compliance with the Privacy Rule when releasing the information required in the Arkansas law. For instance, insurers can add specific language to their policies that would allow them to release this information to every policyholder. In lieu of specific policy language, insurers may also require employers to sign a certification form that would allow for the release of the information by the insurer. Other options may also be available to insurers. An employer’s failure to comply with the insurance company’s policies and procedures regarding the release of health information subject to the HIPAA Privacy Rule could relieve the insurance company from its obligations under Ark. Code Ann. §23-86- 119. It is the Department’s position that insurers can comply with Ark. Code Ann. §23-86-119 and the HIPAA Privacy Rule without any further action by the Department. The Department does not feel that it should determine the methods insurers should use to insure compliance with the HIPAA Privacy Rule; however, the processes and procedures implemented by insurers should assure compliance with both the HIPAA Privacy Rule and Ark. Code Ann. § 23-86-119. Any insurer found to be in non-compliance with Ark. Code Ann. §23-86-119 cannot rely on the HIPAA Privacy Rule as a defense to that violation of the Arkansas Insurance Code. Insurers are directed to furnish a copy of this Bulletin to its appointed producers in Arkansas. Questions concerning this Bulletin should be directed to the Arkansas Insurance Department Legal Division at 501- 371-2820 or by e-mail to legal.division@arkansas.gov. (signed by Lenita Blasingame) (January 14, 2009) ________________________________ ___________________ Lenita Blasingame, Commissioner Date