The Office of General Counsel issued the following opinion on June 8, 2004, representing the position of the New York State Insurance Department.
Re: Protected Health Information, No-Fault Inter-Company Loss Transfer
Pursuant to the New York Insurance Department Privacy Rule (Regulation 169) or the Privacy Rule enacted in accordance with the Health Insurance Portability and Accountability Act (HIPAA), is an authorization required before health information may be released by an insurer seeking reimbursement in accordance with New York Insurance Law § 5105 (McKinney 2000) against another insurer whose insured caused an accident that required the first insurer to pay No-Fault benefits?
HIPAA would not apply to such insurer if it is not a covered entity under the HIPAA Privacy Rule. Pursuant to N.Y. Comp. Codes R. & Regs. tit. 11, § 420.17(b) (2001), such health information may be released without an authorization.
A domestic property/casualty insurer ("Insurer A") issues policies primarily to owners of for-hire vehicles, e.g. taxicabs and limousines, in the City of New York. Occasionally, where it has paid out basic economic loss and believes that the operator of another motor vehicle was responsible for the accident, Insurer A will seek to secure reimbursement from the insurer of the other vehicle. Conversely, there are instances where the insurer of the other vehicle will believe that the operator of the vehicle that Insurer A insures caused the accident and seeks to secure reimbursement from Insurer A.
At present, when Insurer A demands, prior to institution of an arbitration proceeding in accordance with New York Insurance Law § 5105, reimbursement from the other insurer, that insurer will request information concerning the payments made by Insurer A for medical expenses. It is the present practice of Insurer A to provide such information without requiring an authorization from the insured. When another insurer makes a demand to Insurer A for reimbursement, it requests information on the medical expenses incurred.
With one exception, insurers receiving a request from Insurer A for medical information preparatory to evaluation of a demand for reimbursement have furnished such information. However, recently another insurer, which is a major issuer of automobile liability insurance policies, has required a signed authorization prior to release of the information.
New York Insurance Law § 5105(a) (McKinney 2000) requires that an insurer of a vehicle for hire which desires to recover from another insurer basic PIP benefits that it has paid may only proceed in inter-company loss transfer arbitration. Some insurers attempt to resolve such demands prior to institution of a formal arbitration proceeding.
As part of the requirements imposed by the Financial Services Modernization Act of 1999 (Gramm-Leach-Bliley), Pub. Law No. 106-102, the Department has promulgated a privacy regulation, N.Y. Comp. Codes R. & Regs. tit. 11, Part 420 (2001) (Regulation 169). The general requirement for an authorization before health information may be released, N.Y. Comp. Codes R. & Regs. tit. 11, § 420.17(a) is modified by N.Y. Comp. Codes R. & Regs. tit. 11, § 420.17(b):
Nothing in this section shall prohibit, restrict or require an authorization for the disclosure of nonpublic personal health information by a licensee for the performance of the following insurance functions by or on behalf of the licensee: claims administration; claims adjustment and management. . . .
In addition, the Regulation, N.Y. Comp. Codes R. & Regs. tit. 11, § 420.21 (2001) provides:
Irrespective of whether a licensee is subject to the federal Health Insurance Portability and Accountability Act . . . privacy rules and regulations as promulgated by the U.S. Department of Health and Human Services (the "federal rule") . . . if a licensee complies with all requirements of the federal rule . . . except for its effective date provision, the licensee shall not be subject to any provisions of sections 420.17 through 420.20 of this Subpart.
HIPAA, Pub. L. No. 104-191 (1996), is a comprehensive enactment dealing with health insurance. Section 264 of HIPAA, codified as a Note to 42 U.S.C.A. § 1320d-2 (West 2002 Supplement), required the Secretary of Health and Human Services (HHS) to promulgate a regulation dealing with privacy of protected health information. The Rule as promulgated by the Department of HHS, 45 C.F.R. § 160.101 et seq. (2003), contains comprehensive requirements for the protection of protected health information.
The HIPAA Privacy Rule regulates PHI in the custody of "covered entities".
A covered entity under the Rule is defined, 45 C.F.R. 160.103 (2003), as:
Covered entity means: (1) A health plan. . . . (3) A health care provider who transmits any health information in electronic form in connection with a transaction covered by this subchapter.
Although an insurer that issues No-Fault policies may issue other types of insurance that would bring it within the definition of health plan, 45 C.F.R. § 160.103, No-Fault insurance is not among those types of insurance that, in and of themselves, would make such an insurer a health plan under HIPAA. Based upon a review of the Departments records, it does not appear that Insurer A issues health insurance.
Accordingly, it appears that Insurer A is not a covered entity under the HIPAA Privacy Rule.
In those cases where the insurer is not a covered entity within the meaning of the HIPAA Privacy Rule, the Departments Regulation 169 would apply. Since claims administration is involved in inter-company
loss transfer, in accordance with N.Y. Comp. Codes R. & Regs. tit. 11, §§ 420.17(b) and 420.21, no authorization is required.
Any questions concerning whether Insurer A, or another insurer providing no-fault benefits, is a covered entity within the HIPAA Privacy Rule should be addressed to:
Office for Civil Rights
United States Department of Health and Human Services
26 Federal Plaza
New York, NY 10278
Questions concerning any New York requirements concerning health information contained in statutes other than the New York Insurance Law (McKinney 2000 and 2004 Supplement) and the regulations promulgated thereunder, especially New York Public Health Law § 18 (McKinney 2002) should be addressed to:
Bureau of House Counsel
Office of Legal Affairs
Empire State Plaza
Albany, NY 12237.
For further information you may contact Principal Attorney Alan Rachlin at the New York City Office.