610.70(4)(b)
(b) An insurer that complies with a request under
par. (a) shall notify the individual of that compliance in writing and furnish the correction, amendment or fact of deletion to all of the following:
610.70(4)(b)1.
1. Any person who may have received, within the preceding 2 years, the recorded personal medical information concerning the individual and who is specifically designated by the individual.
610.70(4)(b)2.
2. Any insurance support organization for which insurers are the primary source of personal medical information and to which the insurer, within the preceding 7 years, has systematically provided recorded personal medical information. This subdivision does not apply to an insurance support organization that does not maintain recorded personal medical information concerning the individual.
610.70(4)(b)3.
3. Any insurance support organization that furnished to the insurer the personal medical information that has been corrected, amended or deleted.
610.70(4)(c)
(c) If an insurer refuses to comply with a request under
par. (a) 1., the individual making the request may file with the insurer, an insurance agent or an insurance support organization any of the following:
610.70(4)(c)1.
1. A concise statement setting forth the information that the individual believes to be correct, relevant or fair.
610.70(4)(c)2.
2. A concise statement setting forth the reasons why the individual disagrees with the insurer's refusal to correct, amend or delete the recorded personal medical information.
610.70(4)(d)
(d) If the individual files a statement under
par. (c), the insurer shall do all of the following:
610.70(4)(d)1.
1. File any statement filed by the individual under
par. (c) with the recorded personal medical information that is the subject of the request under
par. (a) in such a manner that any person reviewing the recorded personal medical information will be aware of and have access to the statement.
610.70(4)(d)2.
2. In any subsequent disclosure by the insurer of the recorded personal medical information, clearly identify any matter in dispute and provide any statement filed by the individual under
par. (c) that relates to the recorded personal medical information along with the information.
610.70(4)(d)3.
3. Furnish any statement filed by the individual under
par. (c) to any person to whom the insurer would have been required to furnish a correction, amendment or fact of deletion under
par. (b).
610.70(4)(e)
(e) The requirements under this subsection do not apply to information concerning an individual that relates to, and that is collected in connection with or in reasonable anticipation of, a claim or civil or criminal proceeding involving the individual.
610.70(5)
(5) Disclosure of personal medical information by insurers. Any disclosure by an insurer of personal medical information concerning an individual shall be consistent with the individual's signed disclosure authorization form, unless the disclosure satisfies any of the following:
610.70(5)(a)
(a) Is otherwise authorized by the individual, or by a person who is authorized to consent on behalf of an individual who lacks the capacity to consent.
610.70(5)(b)
(b) Is reasonably related to the protection of the insurer's interests in the assessment of causation, fault or liability or in the detection or prevention of criminal activity, fraud, material misrepresentation or material nondisclosure.
610.70(5)(c)
(c) Is made to an insurance regulatory authority or in response to an administrative or judicial order, including a search warrant or subpoena, that is valid on its face.
610.70(5)(e)
(e) Is made for purposes of pursuing a contribution or subrogation claim.
610.70(5)(f)
(f) Is made to a professional peer review organization, bill review organization, health care provider or medical consultant or reviewer for the purpose of reviewing the services, fees, treatment or conduct of a medical care institution or health care provider.
610.70(5)(g)
(g) Is made to a medical care institution or health care provider for any of the following purposes:
610.70(5)(g)2.
2. Conducting an operations or services audit to verify the individuals treated by the health care provider or at the medical care institution.
610.70(5)(h)
(h) Is made to a network plan that is offered by an insurer in order to make arrangements for coordinated health care in which personal medical information concerning an individual is available for providing treatment, making payment for health care under the plan and undertaking such plan operations as are necessary to fulfill the contract for provision of coordinated health care.
610.70(5)(i)
(i) Is made to a group policyholder for the purpose of reporting claims experience or conducting an audit of the insurer's operations or services. Disclosure may be made under this paragraph only if the disclosure is reasonably necessary for the group policyholder to conduct the review or audit.
610.70(5)(j)
(j) Is made for purposes of enabling business decisions to be made regarding the purchase, transfer, merger, reinsurance or sale of all or part of an insurance business.
610.70(5)(k)
(k) Is made for purposes of actuarial or research studies or for accreditation or auditing. With respect to a disclosure made under this paragraph, any materials that allow for the identification of an individual must be returned to the insurer or destroyed as soon as reasonably practicable, and no individual may be identified in any actuarial, research, accreditation or auditing report.
610.70(5)(L)
(L) Is made to the insurer's legal representative for purposes of claims review or legal advice or defense.
610.70(6)(a)(a) A person is not liable to any person for any of the following:
610.70(6)(a)1.
1. Disclosing personal medical information in accordance with this section.
610.70(6)(a)2.
2. Furnishing personal medical information to an insurer or insurance support organization in accordance with this section.
610.70(6)(b)
(b) Paragraph (a) does not apply to the disclosure or furnishing of false information with malice or intent to injure any person.
610.70(7)
(7) Obtaining information under false pretenses. Any person who knowingly and wilfully obtains information about an individual from an insurer or insurance support organization under false pretenses may be fined not more than $10,000 or imprisoned for not more than one year in the county jail or both.
610.70 History
History: 1997 a. 231.
