Section R590-206-18 - Required Authorization for Disclosure of Nonpublic Personal Health Information(1) A licensee may not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer before the disclosure.(2) This Section R590-206-18 does not prohibit, restrict, or require an authorization for the disclosure of nonpublic personal health information by a licensee for the performance of the following: (a) claims administration, adjustment, or management;(b) detecting, investigating, or reporting fraud, misrepresentation, or criminal activity;(d) policy placement or issuance;(f) ratemaking or guaranty fund functions;(g) reinsurance or excess loss insurance; (h) risk management;(k) quality assurance or quality improvement;(l) performance evaluation;(m) provider credentialing verification;(o) peer review activities;(p) actuarial, scientific, medical, or public policy research;(q) grievance procedures;(r) internal administration of compliance, managerial, or information systems;(s) policyholder service functions;(w) administration of consumer disputes and inquiries;(x) external accreditation standards;(y) replacement of a group benefit plan or workers compensation policy or program;(z) activities in connection with a sale, merger, transfer, or exchange of all or part of a business or operating unit;(aa) an activity that permits disclosure without authorization pursuant to the Health Insurance Portability and Accountability Act;(bb) disclosure that is required to enforce a licensee's rights or the rights of other persons engaged in carrying out a transaction or providing a product or service that a consumer requests or authorizes; and(cc) an activity permitted by law, required by a governmental reporting authority, or to comply with legal process.Utah Admin. Code R590-206-18
Amended by Utah State Bulletin Number 2017-15, effective 7/11/2017Adopted by Utah State Bulletin Number 2023-23, effective 11/21/2023