R590-206-18. Required Authorization for Disclosure of Nonpublic Personal Health Information

(1) A licensee may not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer before the disclosure. (2) This Section R590-206-18 does not prohibit, restrict, or require an authorization for the disclosure of nonpublic personal health information by a licensee for the performance of the following: (a) claims administration, adjustment, or management; (b) detecting, investigating, or reporting fraud, misrepresentation, or criminal activity; (c) underwriting; (d) policy placement or issuance; (e) loss control; (f) ratemaking or guaranty fund functions; (g) reinsurance or excess loss insurance; (h) risk management; (i) case management; (j) disease management; (k) quality assurance or quality improvement; (l) performance evaluation; (m) provider credentialing verification; (n) utilization review; (o) peer review activities; (p) actuarial, scientific, medical, or public policy research; (q) grievance procedures; (r) internal administration of compliance, managerial, or information systems; (s) policyholder service functions; (t) auditing; (u) reporting; (v) database security; (w) administration of consumer disputes and inquiries; (x) external accreditation standards; (y) replacement of a group benefit plan or workers compensation policy or program; (z) activities in connection with a sale, merger, transfer, or exchange of all or part of a business or operating unit; (aa) an activity that permits disclosure without authorization pursuant to the Health Insurance Portability and Accountability Act; (bb) disclosure that is required to enforce a licensee's rights or the rights of other persons engaged in carrying out a transaction or providing a product or service that a consumer requests or authorizes; and (cc) an activity permitted by law, required by a governmental reporting authority, or to comply with legal process.