OGC Opinion No. 09-06-09
The Office of General Counsel issued the following opinion on June 23, 2009 representing the position of the New York State Insurance Department.
RE: Non-public personal health information sharing among affiliates
Question Presented:
May an employee of an insurer that is adjusting a claimant’s first-party no-fault claim share non-public personal health information about that claimant with an employee of an affiliate insurer that is adjusting the claimant’s third-party bodily injury (“BI”) claim?
Conclusion:
No. An employee of an insurer that is adjusting a claimant’s first-party no-fault claim may not share non-public personal health information about that claimant with an employee of an affiliate insurer that is adjusting the claimant’s third-party BI claim.
Facts:
The inquiry is of a general nature, without reference to specific facts.
Analysis:
As way of background, Article 51 of the New York Insurance Law, also known as the Comprehensive Motor Vehicle Insurance Reparations Act or “no-fault law,” governs payments to reimburse a person, irrespective of fault, for economic loss when that person suffers injury arising out of the use or operation of a motor vehicle. Under the no-fault regime, an insured who has been in a motor vehicle accident can claim first-party benefits of up to $50,000 from her motor vehicle insurer to cover “basic economic loss,” as that term is defined in N.Y. Ins. Law § 5102(a)(4) (McKinney 2000 and Supp. 2009).
In addition to no-fault coverage, all motor vehicle policies must provide at least the minimum limits of third-party BI coverage set forth in the New York Vehicle and Traffic Law. Third-party BI covers a motor vehicle operator or owner if a claim is made against the operator or owner. The coverage makes payment on behalf of a motor vehicle operator involved in an accident if the accident results in serious injury or death to others or their property.
In an opinion of the Department’s Office of General Counsel (“OGC”) dated January 28, 2002, OGC concluded that an employee of an insurer that is adjusting a claimant’s no fault claim may share the claimant’s non-public health information with another employee in the same company who is adjusting the claimant’s third-party BI claim, without first obtaining consent from the claimant. That opinion relied on § 420.17(b) of New York Comp. Codes R. & Regs.(“NYCRR”), tit. 11, Part 420 (“Regulation 169”), which reads as follows:
Nothing in this section shall prohibit, restrict or require an authorization for the disclosure of nonpublic personal health information by a licensee for the performance of the following insurance functions by or on behalf of the licensee: claims administration; claims adjustment and management; detection, investigation or reporting of actual or potential fraud, misrepresentation or criminal activity; underwriting; policy placement or issuance; loss control; ratemaking and guaranty fund functions; reinsurance and excess loss insurance; risk management; case management; disease management; quality assurance; quality improvement; performance evaluation; provider credentialing verification; utilization review; peer review activities; actuarial, scientific, medical or public policy research; grievance procedures; internal administration of compliance, managerial, and information systems; policyholder service functions; auditing; reporting; database security; administration of consumer disputes and inquiries; external accreditation standards; the replacement of a group benefit plan or workers" compensation policy or program; activities in connection with a sale, merger, transfer or exchange of all or part of a business or operating unit; any activity that permits disclosure without authorization pursuant to the Federal Health Insurance Portability and Accountability Act privacy rules promulgated by the U.S. Department of Health and Human Services; disclosure that is required, or is one of the lawful or appropriate methods to enforce the licensee's rights or the rights of other persons engaged in carrying out a transaction or providing a product or service that a consumer requests or authorizes; and any activity otherwise permitted by law, required pursuant to governmental reporting authority, or to comply with legal process. Additional insurance functions may be added with the approval of the superintendent to the extent they are necessary for appropriate performance of insurance functions and are fair and reasonable to the interest of consumers.
The inquirer now asks whether the analysis set forth in the January 28, 2002 opinion applies with equal force to insurers that are affiliates. In other words, she asks whether the employee of an insurer that is adjusting a claimant’s first-party claim may share non-public personal health information about that claimant with an employee of an affiliate that is adjusting the claimant’s third-party BI claim.
The plain language of 11 NYCRR § 420.17(b) permits a licensee to share non-public personal health information for the performance of certain insurance functions “by or on behalf of the licensee” (emphasis supplied). Thus, the scope of that exception is limited to the same insurer—not to affiliate insurers. Therefore, an employee of an insurer that is adjusting a claimant’s first-party claim may not share non-public personal health information about that claimant with an employee of an affiliate that is adjusting the claimant’s third-party BI claim.
For further information you may contact Senior Attorney Sapna Maloor at the New York City Office.