Code of Maryland Regulations
Title 31 - MARYLAND INSURANCE ADMINISTRATION
Subtitle 16 - MISCELLANEOUS
Chapter 31.16.08 - Privacy of Consumer Financial and Health Information
Section 31.16.08.17 - When Authorization Required for Disclosure of Nonpublic Personal Health Information

Universal Citation: MD Code Reg 31.16.08.17

Current through Register Vol. 51, No. 19, September 20, 2024

A. A licensee may not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer whose nonpublic personal health information is sought to be disclosed.

B. This regulation does not prohibit, restrict, or require an authorization for the disclosure of nonpublic personal health information by a licensee for the performance of the following insurance functions by or on behalf of the licensee:

(1) Claims administration;

(2) Claims adjustment and management;

(3) Detection, investigation, or reporting of actual or potential fraud, misrepresentation, or criminal activity;

(4) Underwriting;

(5) Policy placement or issuance;

(6) Loss control;

(7) Rate-making and guaranty fund functions;

(8) Reinsurance and excess loss insurance;

(9) Risk management;

(10) Case management;

(11) Disease management;

(12) Quality assurance;

(13) Quality improvement;

(14) Performance evaluation;

(15) Provider credentialing verification;

(16) Utilization review;

(17) Peer review activities;

(18) Actuarial, scientific, medical, or public policy research;

(19) Grievance procedures;

(20) Internal administration of compliance, managerial, and information systems;

(21) Policyholder service functions;

(22) Auditing;

(23) Reporting;

(24) Database security;

(25) Administration of consumer disputes and inquiries;

(26) External accreditation standards;

(27) The replacement of a group benefit plan or workers' compensation policy or program;

(28) Activities in connection with a sale, merger, transfer, or exchange of all or part of a business or operating unit;

(29) Any activity that permits disclosure without authorization pursuant to the federal Health Insurance Portability and Accountability Act privacy rules promulgated by the U.S. Department of Health and Human Services;

(30) Disclosure that is required, or is one of the lawful or appropriate methods, to enforce the licensee's rights or the rights of other persons engaged in carrying out a transaction or providing a product or service that a consumer requests or authorizes;

(31) Any activity otherwise permitted by law, required pursuant to governmental reporting authority, or to comply with legal process; and

(32) Any additional insurance functions determined by the Commissioner to the extent that they are:
(a) Necessary for appropriate performance of insurance functions; and

(b) Fair and reasonable to the interest of consumers.

Disclaimer: These regulations may not be the most recent version. Maryland may have more current or accurate information. We make no warranties or guarantees about the accuracy, completeness, or adequacy of the information contained on this site or the information linked to on the state site. Please check official sources.
This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.