Insurance Circular Letter No. 8 (2017)

June 27, 2017

STATUTORY AND REGULATORY REFERENCES: 11 NYCRR 420 (Insurance Regulation 169); 42 U.S.C. § 290dd-2; and 42 C.F.R. § 2.31.

The purpose of this circular letter is to provide guidance regarding the forms insurers may use to request medical records from insurance applicants that include substance abuse records. Insurers may request an insurance applicant’s medical records when underwriting an insurance policy or contract, such as a life or disability insurance policy. These medical records may include substance abuse records. The confidentiality of substance abuse records is covered by 42 U.S.C. § 290dd-2 and 42 C.F.R. § 2.31.

Under 42 U.S.C. § 290dd-2(a), “records of the identity, diagnosis, prognosis, or treatment of any patient which are maintained in connection with the performance of any program or activity relating to substance abuse education, prevention, training, treatment, rehabilitation, or research, which is conducted, regulated, or directly or indirectly assisted by any department or agency of the United States” are confidential, except as provided in 42 U.S.C. § 290dd-2(e), and only may be disclosed for the purposes and under the circumstances expressly authorized under 42 U.S.C. § 290dd-2(b). Pursuant to 42 U.S.C. § 290dd-2(b), the content of any such record may be disclosed in accordance with the patient’s prior written consent, but only to such extent, under such circumstances, and for such purposes as allowed under regulations prescribed pursuant to 42 U.S.C. § 290dd-2(b).

42 C.F.R. § 2.31(a) states that written consent to a disclosure must include: (1) the specific name or general designation of the program or person permitted to make the disclosure; (2) the name or title of the individual or the name of the organization to which disclosure is to be made; (3) the name of the patient; (4) the purpose of the disclosure; (5) how much and what kind of information is to be disclosed; (6) the signature of the patient and, when required for a patient who is a minor, the signature of a person authorized to give consent under 42 C.F.R. § 2.14 or, when required for a patient who is incompetent or deceased, the signature of a person authorized to sign under 42 C.F.R. § 2.15 in lieu of the patient; (7) the date on which the consent is signed; (8) a statement that the consent is subject to revocation at any time except to the extent that the program or person that is to make the disclosure has already acted in reliance on it, where acting in reliance includes the provision of treatment services in reliance on a valid consent to disclose information to a third party payer; and (9) the date, event or condition upon which the consent will expire if not revoked before that date, event or condition. This date, event, or condition must insure that the consent will last no longer than reasonably necessary to serve the purpose for which it is given. 42 C.F.R. § 2.31(b) sets forth a sample consent form.

It has in the past been the position of the Department of Financial Services (“Department”) that a form created by an insurer to authorize release of medical records to the insurer (“authorization form”) may not include authorization to release records pertaining to substance abuse diagnosis or treatment, and that an insurer must use a separate form for such records. The Department’s position was based in part on language in OGC Opinion No. 99-23 (NILS) (Feb. 22, 1999), which said that “substance abuse treatment information should be the subject of a specific release.” Recently, insurers asked the Department to reconsider its position. After consulting with the U.S. Department of Health and Human Services, the Department has determined that an insurer may integrate authorization for the release of substance abuse diagnosis and treatment records into a single authorization for release of medical records as long as the language pertaining to the release of the substance abuse diagnosis and treatment records complies with 42 U.S.C. § 290dd-2 and 42 C.F.R. § 2.31 and as long as the authorization form is not a form prescribed by law or regulation that an insurer may not alter. To the extent that OGC Opinion No. 99-23 appears to state otherwise, its guidance need no longer be followed.

Insurers are reminded that any authorization form also must comply with 11 NYCRR 420 (Insurance Regulation 169). Section 420.18(a)(5) and (b) of Regulation 169 require an authorization form to specify a length of time for which the authorization will remain valid, which may not exceed 24 months; state that the consumer or customer may revoke the authorization at any time; and describe the procedure for making a revocation.

Please direct all questions regarding this circular letter to Joana Lucashuk, Associate Attorney, by phone at (212) 480-2125 or by email at [email protected].