Authorization Forms

ALFRED W. GROSS COMMISSIONER OF INSURANCE STATE CORPORATION COMMISSION BUREAU OF INSURANCE P.O. BOX 1157 RICHMOND, VIRGINIA 23218 TELEPHONE: (804) 371-9741 TDD/VOICE: (804) 371-9206 http://www.scc.virginia.gov April 18, 2006 Administrative Letter 2006–06 TO: All Companies licensed to Write Life and Health Insurance in Virginia and Interested Parties RE: Authorization Forms The Bureau of Insurance (the Bureau) recently reviewed a number of authorization forms used by insurers in Virginia to determine the extent, if any, to which insurers have been requesting, retaining and/or disclosing personal or sensitive information beyond that which is necessary or appropriate to properly underwrite or administer products pursuant to their guidelines. This review was prompted by assertions made by consumers that they were required to sign forms authorizing the disclosure or release of overly sensitive personal information or information relating to conditions that consumers considered to be irrelevant to the requested insurance transaction. There were also concerns expressed that the information would be made available to a wide spectrum of parties and would remain available for excessive or unreasonable periods of time. Finally, concerns were expressed concerning disclosure appearing on these forms suggesting that the forms were specifically developed to comply with HIPAA, thereby implicitly suggesting that insurers were required to ask certain questions to comply with federal requirements when, in fact, that may not have been the case. The purpose of this letter is to provide insurers with general guidelines concerning the Bureau’s expectations concerning authorization forms, focusing particularly on the findings resulting from this review process. While the forms reviewed were found generally to be compliant with Virginia law, there were some deficiencies noted: • Some forms lacked specificity in purpose or function for requesting or disclosing certain information. Rather than specifically identifying sources of information and the purposes for information requests, these forms included general and vague statements indicating that information could be collected or used “for any purpose” or “from any person who has records or knowledge of me and my health”. • Some forms required health or personal information that was not pertinent in any way to the type of coverage or the specific claim investigation involved. Administrative Letter 2006-6 April 18, 2006 Page 2 of 2 • Some forms were designated as “HIPAA compliant” when, in fact, the type of information requested was not subject to the provisions of HIPAA. While the Bureau has no objection to the inclusion of statements indicating that forms are compliant with certain federal or state regulations, we do expect insurers to verify the accuracy of such statements, and we do object to the inclusion of any statement implying that federal or state rules or laws extend beyond their jurisdiction in form content or presentation. The Bureau strongly encourages all insurers to review their authorization forms carefully to ensure that they are clear in purpose and intent and that they are fully compliant with all the requirements identified in Chapter 6 of Title 38.2 of the Code of Virginia, with a particular focus on the required content elements identified in § 38.2- 606. In preparing all forms, insurers should verify that distinctions identified in various state and federal requirements, (i.e. authorization and consent; medical and personal or privileged information), have been identified and that the related requirements have been appropriately addressed. Finally, insurers should review processes and procedures, including those of their agents and of third parties providing services on behalf of the insurers, to verify that no information beyond that which is necessary and appropriate for product administration is requested, and that appropriate measures have been employed to fully protect the privacy of individuals and the confidentiality of information collected about them. To that end, insurers are encouraged to regularly review and update, as appropriate, security programs and procedures to ensure that they are compliant with § 38.2-613.2 of the Code of Virginia. The Bureau will take appropriate action against any insurers found to be using forms or employing practices (including practices employed by third parties providing certain administrative services on the insurer’s behalf), in violation of Virginia law. Questions regarding this letter may be directed to: Life and Health Division PO Box 1157 Richmond, Virginia 23218 Phone: (804) 371-9074 FAX: (804) 371-9944 We appreciate your consideration of this matter. Cordially, Alfred W. Gross Commissioner of Insurance AWG/jkc