The Office of General Counsel issued the following informal opinion on April 10, 2002, representing the position of the New York State Insurance Department.

Re: Regulation 169 Privacy Notice

Questions Presented:

Is N.Y. Comp. Codes R. & Regs. tit. 11, §§ 420.0-420.24 (2001) (hereinafter "Regulation 169") applicable to ABC’s Children’s Health, ABC’s NY Health, and ABC’s Family Health products?

(2) Is ABC required to send an annual notice to its customers?

Conclusions:

(1) Regulation 169 is applicable to ABC’s Children’s Health and ABC’s NY Health products. Regulation 169 is not applicable to ABC's Family Health product.

(2) Pursuant to N.Y. Comp. Codes R. & Regs. tit. 11, § 420.5 (2001) ABC must provide its customers with an annual notice no later than December 31, 2002.

Facts:

ABC is a N.Y. Pub. Health Law Article 44 (McKinney 2002) Health Maintenance Organization (hereinafter "Article 44 HMO").

ABC's Children’s Health product provides coverage under New York State's Child Health Insurance Plan for New York State residents who are not eligible for Medicaid, have no other health care coverage or insurance, and are under 19 years of age.

ABC's NY Health product is a standardized health product required to be sold by all HMOs. Eligible individuals are sole proprietors, small employers with not more than fifty employees, and working uninsureds whose employers do not provide health insurance who meet income requirements.

ABC's Family Health product provides coverage pursuant to a New York State public health insurance program for adults between the ages of 19 and 64 who do not have health insurance but have incomes too high to qualify for Medicaid. The Family Health program is an extension of Medicaid, with the New York State Health Department as the state agency designated by the United States Department of Health and Human Services to administer the program.

Analysis:

Section 420.1(a) of Regulation 169 states in pertinent part: "Purpose. This Part governs the treatment of nonpublic personal information about individuals (defined in this Part as consumers or customers) in this State by all licensees of the Insurance Department." (Emphasis added.)

Section 420.3(p)(1) of Regulation 169 defines a "Licensee", to which the Regulation is applicable, to include "a health maintenance organization holding or required to hold, a certificate of authority pursuant to Article 44 of the Public Health Law . . . ." Thus, Regulation 169 applies to all Article 44 HMOs.

The Superintendent must approve ABC's Children’s Health insurance policies sold to eligible children pursuant to N.Y. Ins. Law § 1120 (McKinney 2001-2002 Interim Pocket Part). The Superintendent and Commissioner of Health share jurisdiction over comprehensive regulation of the Child Health Insurance Plan pursuant to N.Y. Pub. Health Law §§ 2510 and 2511 (McKinney 2002). ABC's Children’s Health product is regulated solely by New York State law. Accordingly, Regulation 169 is applicable to ABC’s Children’s Health product.

The Superintendent has specific authority to regulate ABC's NY Health product pursuant to N.Y. Ins. Law § 4326 (McKinney 2001-2002 Interim Pocket Part). Section 4326 establishes Healthy New York, requires all HMOs to participate, establishes eligibility requirements, sets standard benefits, and provides for the Superintendent's regulation of rates and contracts. ABC's NY Health product is regulated solely by New York State law. Accordingly, Regulation 169 is applicable to ABC's NY Health product.

ABC’s Family Health program is an extension of Medicaid, 42 U.S.C.A. § 1396 et seq. (West 2001), with the New York State Health Department as the state agency designated by the United States Department of Health and Human Services (hereinafter "HHS") to administer the program. Pursuant to New York State law, ABC's Family Health product is regulated solely by the Commissioner of Health except for the Superintendent's consultative or advisory capacity concerning the definition of benefits to be offered. N.Y. Soc. Serv. Law § 369-ee(1)(e) (McKinney 2001-2002 Interim Supplementary Pamphlet). However, the Federal government must approve the handbook between ABC and eligible individuals under a Family Health Insurance Plan. This handbook is the functional equivalent of a certificate for in-group health insurance and it provides for the eligible individual's rights, privileges, complaint procedures, and benefits.

The confidentiality requirements established by N.Y. Soc. Serv. Law § 369(4) (McKinney 2001-2002 Interim Supplementary Pamphlet) apply to ABC’s Family Health program because it is an extension of Medicaid. The relevant provisions of the Social Services Law provide:

Any inconsistent provision of this chapter or other law notwithstanding, all information received by social services and public health officials and service officers concerning applicants for and recipients of medical assistance may be disclosed or used only for purposes directly connected with the administration of medical assistance for needy persons.

Based upon the above, this Department believes that the privacy of ABC’s Family Health subscribers is adequately protected and thus, Regulation 169 is not applicable to ABC’s Family Health program.

N.Y. Comp. Codes R. & Regs. tit. 11, § 420.5 (2001), provides:

(a) (1) General rule. A licensee shall provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices not less than annually during the continuation of the customer relationship. Annually means at least once in any period of 12 consecutive months during which that relationship exists. A licensee may define the 12-consecutive-month period, but the licensee must apply it to the customer on a consistent basis.

(2) Example. A licensee provides a notice annually if it defines the 12-consecutive-month period as a calendar year and provides the annual notice to the customer once in each calendar year following the calendar year in which the licensee provided the initial notice. For example, if a customer buys an insurance policy on any day of year one, the licensee shall provide an annual notice to that customer by December 31st of year two, but thereafter, shall provide each subsequent annual notice within 12 calendar months of the prior annual notice.

In accordance with the above section, with respect to nonpublic personal financial information, a licensee must provide its customers with a notice that accurately reflects its privacy policies and practices not less than annually during the continuation of the customer relationship. This is referred to as the "Annual Notice". Using the example given in Section 420.5(a)(2), if ABC sent its initial notices on July 1, 2001, it has until December 31, 2002 to send its first annual notice. Thereafter, it must send each annual notice within 12 calendar months of the prior annual notice.

For further information you may contact Senior Attorney Robert Freedman at the New York City Office.