The Office of General Counsel issued the following informal opinion on August 3, 2001, representing the position of the New York State Insurance Department.

Re:  N.Y. Comp. Codes R. & Regs. tit. 11 §§ 420.0 – 420.24 (2001) (Reg. 169) and Claims Processing

Questions Presented:

1. Pursuant to N.Y. Comp. Codes R. & Regs. tit. 11 §§ 420.0 – 420.24 (2001), is an insurer required to issue privacy notices to claimants under workers’ compensation, professional malpractice or other commercial liability policies if such insurer shares nonpublic personal information with non-affiliated third parties in connection with claims?

2. Does the handling of a claim submitted by a claimant come within the exceptions in N.Y. Comp. Codes R. & Regs. tit. 11 § 420.14 (2001) if the insurer uses a non-affiliated third party administrator to handle the claim?

Conclusions:

1. Yes. Both nonpublic personal financial and health information for claimants under workers’ compensation policies, professional malpractice and other commercial liability policies are covered by the regulation. N.Y. Comp. Codes R. & Regs. tit. 11 § 420.1(b) (2001).

2. The administration, adjustment and management of a claim submitted by a claimant comes within the N.Y. Comp. Codes R. & Regs. tit. 11 §§ 420.14 and 420.17 (2001) exceptions. The insurer may share claimants’ non-public personal information with non-affiliated parties in accordance with the requirements of those sections.

Facts:

The insurer issues workers’ compensation policies, professional malpractice and other commercial liability polices to businesses and professionals. The insurer retains non-affiliated third party administrators whose duties include receipt of the claim, establishment and maintenance of claim files, investigation of the claim, including the securing of all information pertinent to the evaluation of the claim, adjustment, negotiation and settlement of the claim. The third party administrators are contractually obligated not to disclose or use any information received in connection with claims other than for purposes set forth above, or as permitted by sections 420.14 and 420.15 of the regulation.

Analysis:

N.Y. Comp. Codes R. & Regs. tit. 11 § 420.1(b) (2001) makes the regulation applicable to:

(1) Nonpublic personal financial information about individuals who obtain, seek to obtain or are claimants or beneficiaries of products or services primarily for personal, family or household purposes from licensees. This part does not apply to information about companies or about individuals who obtain products or services for business, commercial, or agricultural purposes.

(2) All nonpublic personal health information.

Accordingly, claimants’ nonpublic personal financial and health information under workers’ compensation, professional malpractice and other commercial liability policies are covered by the regulation. The exceptions to certain notice and opt out requirements for nonpublic personal financial information are contained in N.Y. Comp. Codes R. & Regs. tit. 11 §§ 420.13, 420.14, and 420.15 (2001). The exceptions to obtaining authorization to disclose nonpublic personal health information is contained in N.Y. Comp. Codes, R. & Regs. tit, 11, § 420.17(b) (2001).

Nonpublic Personal Financial Information

A claimant under a workers’ compensation policy would be a "consumer" under the regulation if the licensee discloses nonpublic personal financial information about the individual to a nonaffiliated third party, other than as permitted under sections 420.13, 420.14 or 420.15, and would have to be provided with an initial privacy notice and an opt out notice prior to such disclosure. N.Y. Comp. Codes R. & Regs. tit. 11 §§ 420.3(e)(2), 420.4(a)(2), 420.7, 420.10 (2001). However, if the disclosure to the nonaffiliated third party is permitted under sections 420.13, 420.14 or 420.15, certain exceptions to the notice and opt out requirements apply.

In his letter, Attorney A, General Counsel of Financial Group B, asks whether an unaffiliated third party’s handling of a claim, which he describes as receipt of the claim, establishment and maintenance of claim files, investigation, evaluation, adjustment, negotiation and settlement of the claim, comes within sections 420.14 or 420.15. N.Y. Comp. Codes R. & Regs. tit. 11 § 420.14(a) (2001) provides in pertinent part:

The requirements for initial notice to the consumer in section 420.4(a)(2) of this Part, and the opt out provisions in sections 420.7 and 420.10 of this Part and their application to service providers and joint marketing as described in section 420.13 of this Part, do not apply if the licensee discloses nonpublic personal financial information as necessary to effect, administer, or enforce a transaction that a consumer requests or authorizes, or in connection with:

(1) Servicing or processing an insurance product or service that a consumer requests or authorizes;

(2) Maintaining or servicing the consumer’s account with the licensee.

The Department has opined that the sharing of nonpublic personal financial information with an unaffiliated third party for the purpose of adjusting the claim is permissible under the above cited exception. The other functions that Attorney A describes as components of "handling the claim" would also come within this exception. The unaffiliated third party would be constrained by N.Y. Comp. Codes R. & Regs. tit. 11 § 420.11 (2001), with respect to subsequent disclosure of the nonpublic personal financial information.

Nonpublic Personal Health Information

With respect to sharing nonpublic personal health information, N.Y. Comp. Codes R. & Regs. tit. 11 § 420.17(a) (2001) provides:

A licensee shall not disclose nonpublic personal health information about a consumer or a customer unless an authorization is obtained from the consumer or customer whose nonpublic personal health information is sought to be disclosed.

N.Y. Comp. Codes R. & Regs. tit. 11 § 420.17(b) (2001) provides certain exceptions to that requirement, including:

[T]he disclosure of nonpublic personal health information by a licensee for the performance of the following insurance functions by or on behalf of the licensee: claims administration; claims adjustment and management….

In accordance with N.Y. Comp. Codes R. & Regs. tit. 11 § 420.17(b) (2001), the insurer can share nonpublic personal health information with a non-affiliated third party for the functions Attorney A describes.

For further information you may contact Supervising Attorney Joan Siegel at the New York City Office.