The Office of General Counsel has issued the following informal opinion on April 16, 2001, representing the position of the New York State Insurance Department.

Re: New York Insurance Department Privacy Regulation, Prepaid Health Service Plans


Is a Prepaid Health Service Plan (PHSP) encompassed within the definition of Health Maintenance Organization as that term is used in this Department’s Privacy Regulation, N.Y. Comp. R. & Regs. Tit. 11, §420 et seq (2000) (Regulation 169)?


No, it was not the intention of this Department to regulate the privacy practices of PHSPs, so long as they restrict their business to government programs, and the Regulation should not be construed to be applicable to them in such circumstances.


Attorney A represents the XYZ Coalition of PHSPs, which is composed of 14 health plans sponsored by public and not-for-profit hospitals and community health centers.

This Department’s Privacy Regulation, N.Y. Comp. R. & Regs tit. 11, §420.3(p)(1), defines a "Licensee", to which the Regulation is applicable, as:

‘Licensee’ means a person licensed or required to be licensed, or authorized or required to be authorized, or registered, or required to be registered pursuant to the Insurance Law of this State; a health maintenance organization holding or required to hold, a certificate of authority pursuant to Article 44 of the Public Health Law; or an unauthorized insurer in regard to the excess line business conducted pursuant to section 2118 of the Insurance Law and Part 27 of this Title (Regulation 41).

In accordance with New York Insurance Law §1109(a) (McKinney 2000), an HMO is not required to be licensed by this Department, provided it has a Certificate of Authority from the Commissioner of Health (Commissioner) pursuant to New York Public Health Law Article 44 (McKinney 2000). The subscriber contracts of an HMO are, however, in accordance with New York Public Health Law §4406(1) (McKinney 2000), subject to regulation by this Department as if they were subscriber contracts of Health Service Corporations authorized in accordance with New York Insurance Law Article 43 (McKinney). In accordance with the above authorization and the requirements of New York Insurance Law Article 43, this Department regulates forms and rates of HMO subscriber contracts, including consumer protection requirements, such as privacy protection.

The Commissioner of Health is authorized by New York Public Health Law §4403 (McKinney 2000) to issue a Certificate of Authority to HMOs that issue subscriber contracts to the general public. The Commissioner is further authorized, by New York Public Health Law §4403-a(1) (McKinney 2000), to issue a Certificate of Authority to PHSPs:

The commissioner may issue a special purpose certificate of authority to a provider, applying on forms prescribed by the commissioner, seeking to offer a comprehensive health services plan on a prepaid contractual basis either directly, or through an arrangement, agreement or plan or combination thereof to an enrolled population, which is substantially composed of persons eligible to receive benefits under title XIX of the federal social security act or other public programs.

Since the subscriber contracts and rates of PHSPs are extensively regulated under the New York Public Health Law and New York Social Services Law (McKinney 2000), this Department has not, heretofore, regulated them pursuant to the New York Insurance Law.

Attorney A represents that his client PHSPs restrict their subscribers to individuals eligible for Medicaid, regulated under Title XIX of the Federal Social Security Act (42 U.S.C.A §1396 et seq (West 2000)) and the New York Social Services Law, and participants in the Child Health Plus program, which is regulated by New York Insurance Law §1120 (McKinney 2001), as well as relevant provisions of the New York Public Health and Social Services Law. This Department understands, however, that the Department of Health, utilizing the "substantially composed" language of New York Public Health Law §4403-a, has indicated that PHSPs may have up to 10% of their subscribers in the "commercial" market.

Attorney A asserts that the protections of this Department’s Privacy Regulation are not necessary since subscriber privacy is already adequately protected. Attorney A first cites the confidentiality requirements established by New York Social Services Law §369(4) (McKinney 2000), which, Attorney A represents, are imposed on PHSPs by contract. The relevant provision of the Social Services Law provides:

Any inconsistent provision of this chapter or other law notwithstanding, all information received by social services and public health officials and service officers concerning applicants for and recipients of medical assistance may be disclosed or used only for purposes directly connected with the administration of medical assistance for needy persons.

Attorney A further represents that the contracts entered into between the State and those entities providing service under the Medicaid and Child Health Programs have a similar restriction.

Based upon the above, this Department believes that subscribers’ privacy is, when the PHSP limits its operations to Medicaid, adequately protected by the contracts between PHSPs and the State, and no useful purpose would be served by including PHSPs within those organizations subject to this Department’s Privacy Regulation. This Department, therefore, agrees with Attorney A’s understanding that Regulation 169 does not encompass PHSPs issuing contracts only within that market in its purview.

If, however, the PHSP should issue a contract in the commercial market the consumer protections that are present in the contracts between the PHSP and the State, would not be present. In that instance, both consumer protection and maintenance of a "level playing field" among insurers, commercial HMOs and PHSPs require that the Privacy Regulation be applicable.

As to Child Health Plus, since contracts under that program may be issued by Health Maintenance Organizations, this Department considers that business to be commercial business. In order to maintain a "level playing field", PHSPs must comply with Regulation 169 with respect to that business.

The Department’s position with respect to PHSPs and privacy will be clarified in the next iteration of Regulation 169.

For further information you may contact Principal Attorney Alan Rachlin at the New York City Office.