The Office of General Counsel issued the following opinion on May 28, 2003, representing the position of the New York State Insurance Department.

Re: Parent’s Access to Child’s Health Information, Health Insurance Portability & Accountability Act (HIPAA).

Question Presented:

Must an insurer or its designee provide a parent with sufficient information concerning treatment of a dependent child to enable the parent to ascertain the correctness of the insurer’s reimbursement?

Conclusion:

Subject to applicable New York law, the parent would be entitled to such information.

Facts:

Mr A is employed by ABC University and has health coverage through a group contract issued to the University by DEF. His 16 year old daughter, who is being treated by a psychiatrist, is covered as a dependent under the policy.

Recently Mr. A had a question concerning the reimbursement by DEF for his daughter’s treatment and contacted the insurer’s designee, JKL, to discuss the matter. A representative of JKL indicated that the Privacy Regulation promulgated by the United States Department of Health & Human Services pursuant to HIPAA precluded their discussing the matter with him. Mr. A believes that the JKL representative is in error, but the representative refused to connect him with a supervisor to whom he could present his assertion.

Analysis:

DEF is a Health Service Corporation licensed by this Department in accordance with New York Insurance Law § 4301 (McKinney 2000 and 2003 Supplement). This Department does not license JKL in any capacity, although it is registered as a Utilization Review Agent pursuant to New York Public Health Law § 4900(9) (McKinney 2002).

HIPAA, Pub. L. No. 104-191 (1996), is a comprehensive enactment dealing with health insurance. Section 264 of HIPAA, codified as a Note to 42 U.S.C.A. § 1320d-2 (West 2002 Supplement), required the Secretary of Health & Human Services (HHS) to promulgate a regulation dealing with privacy of protected health information. The Regulation as promulgated by the Department of HHS, 45 C.F.R. § 160.101 et seq. (2003), contains comprehensive requirements for the protection of protected health information.

Protected health information is defined in the HIPAA Privacy Regulation, 45 C.F.R. § 160.103 (2003):

Protected health information means individually identifiable health information: . . . that is: (i) Transmitted by electronic media; (ii) Maintained in any medium described in the definition of electronic media . . . or (iii) Transmitted or maintained in any other form or medium.

Health information is defined, 45 C.F.R. § 160.103:

Health information means any information, whether oral or recorded in any form or medium, that: (1) Is created or received by a health care provider, health plan, public health authority, . . . or health care clearinghouse; and (2) Relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual

The general rule, 45 C.F.R. §§ 164.502(a) (2003) and 164.508(a) (2003), is that authorizations are required before protected health information may be disclosed by covered entities, which term, 45 C.F.R. § 160.103, includes health insurers. An exception is provided, 45 C.F.R. § 502(g)(3)(ii)(A):

If, and to the extent, permitted or required by an applicable provision of State or other law, including applicable case law, a covered entity may disclose, or provide access . . . to, protected health information about an unemancipated minor to a parent, guardian, or other person acting in loco parentis.

According to HHS, 67 Fed. Reg. 53201 (August 14, 2002) the State definition of unemancipated minor is to be utilized.

Access to health information is generally governed by New York Public Health Law § 18 (McKinney 2002). That statute, in New York Public Health Law § 18(1)(g), includes parents among those individuals who are considered to be "qualified persons" for the purpose of securing access to health information. New York Public Health Law § 18(2)(c) specifically provides:

Subject to the provisions of subdivision three of this section and except as otherwise provided by law, upon the written request of a parent . . . , a health care provider shall provide an opportunity, within ten days, for such parent or guardian to inspect any patient information maintained or possessed by such provider concerning care and treatment of the infant for which the consent of such parent or guardian was obtained or where care was provided without consent in an emergency which was the result of accidental injury or the unexpected onset of serious illness; provided, however, that such parent or guardian shall not be entitled to inspect or make copies of any patient information concerning the care and treatment of an infant where the health care provider determines that access to the information requested by such parent or guardian would have a detrimental effect on the provider's professional relationship with the infant, or on the care and treatment of the infant, or on the infant's relationship with his or her parents or guardian.

New York Public Health Law § 18(3)(c), however, provides:

A subject over the age of twelve years may be notified of any request by a qualified person to review his/her patient information, and, if the subject objects to disclosure, the provider may deny the request. . . .

Mental health records are, however, subject to special requirements. New York Mental Hygiene Law § 33.16(b)(3) (McKinney 2002 and 2003 Supplement) provides:

Subject to the provisions of subdivision (c) of this section and except as otherwise provided by law, upon the written request of a parent of an infant . . . a facility shall provide an opportunity, within ten days, for such parent or guardian to inspect any clinical record maintained or possessed by such facility concerning care and treatment of the infant for which the consent of a parent or guardian was obtained or has been requested; provided, however, that such parent or guardian shall not be entitled to inspect or make copies of any clinical record concerning the care and treatment of an infant where the treating practitioner determines that access to the information requested by such parent or guardian would have a detrimental effect on the practitioner's professional relationship with the infant, or on the care and treatment of the infant or on the infant's relationship with his or her parents or guardians.

New York Mental Hygiene Law § 1.03(26) (McKinney 2002 and 2003 Supplement) defines: Infant’ or ‘minor’ as a person who has not attained the age of eighteen years.

New York Mental Hygiene Law § 33.16(c)(2) provides:

A patient or client over the age of twelve may be notified of any request by a qualified person to review his/her record and if the patient or client objects to disclosure, the facility, in consultation with the treating practitioner may deny the request.

Mr. A was directed to contact the Health Department for interpretations of the New York Public Health Law and the Office of Mental Health of the Department of Mental Hygiene for interpretations of the New York Mental Hygiene Law.

It is the position of this Department, subject to confirmation by the Office for Civil Rights of HHS, that HIPAA permits Mr. A to have access to his daughter’s protected health information, subject to the limitations imposed by both HIPAA and the above cited New York statutes. If, after being presented with this Department’s position, either DEF or JKL refuses to grant Mr. A appropriate access, Mr. A may file a complaint with the Department.

For further information you may contact Principal Attorney Alan Rachlin at the New York City Office.