The Office of General Counsel issued the following opinion on July 22, 2002, representing the position of the New York State Insurance Department.
Re: Parental Access to Insurance Records Concerning Childs Medical Treatment.
Questions Presented:
1. May a Health Maintenance Organization (HMO) or an insurer that has issued a managed care health insurance contract require an authorization by the treated minor child before it will release information to the parent/insured concerning treatment of that minor child?
2. May a parent insist that an HMO secure his or her permission before rendering treatment to the minor child?
Conclusions:
1.Subject to limited exceptions, an insurer should provide such information to a parent without requiring the treated minor childs consent.
2. Subject to limited exceptions, a parent may insist that he or she be given the opportunity to give or withhold consent before a minor child is treated.
Facts:
Mrs. A and her 17 year old daughter are covered under a contract issued by ABC, which is an HMO with a Certificate of Authority from the Commissioner of Health in accordance with New York Public Health Law Article 44 (McKinney 2001) and is part of XYZ Health Plan, which is licensed by this Department as a Health Service Corporation in accordance with New York Insurance Law Article 43 (McKinney 2000).
Mrs. A has requested that ABC provide her with information concerning medical treatment furnished to her daughter, with the exception of treatment relating to reproductive matters and other sexuality issues. Mrs. A has further requested that, with the exception of reproductive matters, other sexuality issues and emergency treatment, ABC not have its participating physicians treat her daughter or furnish prescription drugs to her without her prior permission. ABC has informed Mrs. A that it is prevented by statute from following her request.
Mrs A. seeks confirmation that ABC is misreading the applicable statutory and regulatory requirements.
Analysis:
New York Public Health Law § 4401 (McKinney 2001) defines an HMO as:
1. Health maintenance organization . . . means any person, natural or corporate, or any groups of such persons who enter into an arrangement, agreement or plan or any combination of arrangements or plans which propose to provide or offer, or which do provide or offer, a comprehensive health services plan.
2. Comprehensive health services plan . . . means a plan through which each member of an enrolled population is entitled to receive comprehensive health services in consideration for a basic advance or periodic charge. A plan may include the provision of health care services which are covered by the organization at the election of enrollees by health care providers not participating in the plan [point of service] . . . .
Most HMOs delegate their obligation to provide health services to enrollees by contracting with individual health care providers, who actually provide the services.
New York Insurance Law § 4801(c) (McKinney 2000) defines a managed care health insurance contract as:
a managed care health insurance contract . . . shall mean a contract which requires that all medical or other health care services covered under the contract, other than emergency care services, be provided by, or pursuant to a referral from, a designated health care provider chosen by the insured (i.e. a primary care gatekeeper), and that services provided pursuant to such a referral be rendered by a health care provider participating in the insurer's managed care provider network. . . .
This Department believes that the obligations of both HMOs and insurers issuing a managed care health insurance contract are identical insofar as health information privacy and permission for the rendering of medical care are concerned.
This Department has promulgated a regulation governing privacy of financial and health information. The regulation (Regulation 169), which may be found at N.Y. Comp. Codes R. & Regs. tit. 11, Part 420 (2001), protects information obtained from "consumers" and "customers". A consumer is defined in N.Y. Comp. Codes R. & Regs. tit. 11, § 420.3(e)(1) as:
Consumer means an individual who, in this State, seeks to obtain, obtains or has obtained an insurance product or service, directly or through a legal representative, from a licensee that is to be used primarily for personal, family, or household purposes, and about whom the licensee has nonpublic personal information.
A customer is defined in N.Y. Comp. Codes R. & Regs. tit. 11, § 420.3(h) as:
Customer means a consumer who has a customer relationship with a licensee.
Customer relationship is defined in N.Y. Comp. R. & Regs. tit. 11, § 420.3(i)(1) as:
Customer relationship means a continuing relationship between a consumer and a licensee under which the licensee provides one or more insurance products or services in this State to the consumer that are to be used primarily for personal, family, or household purposes.
The general requirements for release of health information, which are set forth in N.Y. Comp. Codes R. & Regs. tit 11, § 420.17, are:
(a) A licensee shall not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer whose nonpublic personal health information is sought to be disclosed.
(b) Nothing in this section shall prohibit, restrict or require an authorization for the disclosure of nonpublic personal health information by a licensee for the performance of the following insurance functions by or on behalf of the licensee: claims administration; . . . administration of consumer disputes and inquiries; . . . any activity that permits disclosure without authorization pursuant to the federal Health Insurance Portability and Accountability Act privacy rules promulgated by the U.S. Department of Health and Human Services; . . . . Additional insurance functions may be added with the approval of the superintendent to the extent they are necessary for appropriate performance of insurance functions and are fair and reasonable to the interest of consumers.
A certificate holder under a group health insurance contract is a customer within the meaning of Regulation 169, so that the actual policyholder, in many cases the employer, will not have access to an individuals personal information without his or her consent. In the case of family policies, such as the one in question, each covered family member is a customer within the meaning of Regulation 169, so that neither the policyholder nor certificate holder would have access to a dependants personal information without his or her consent.
However, access to health information is generally governed by New York Public Health Law § 18 (McKinney 2001). That statute, in New York Public Health Law § 18(1)(g), includes parents among those individuals who are considered to be "qualified persons" for the purpose of securing access to health information. New York Public Health Law § 18(2)(c) specifically provides:
Subject to the provisions of subdivision three of this section and except as otherwise provided by law, upon the written request of a parent . . . , a health care provider shall provide an opportunity, within ten days, for such parent or guardian to inspect any patient information maintained or possessed by such provider concerning care and treatment of the infant for which the consent of such parent or guardian was obtained or where care was provided without consent in an emergency which was the result of accidental injury or the unexpected onset of serious illness; provided, however, that such parent or guardian shall not be entitled to inspect or make copies of any patient information concerning the care and treatment of an infant where the health care provider determines that access to the information requested by such parent or guardian would have a detrimental effect on the provider's professional relationship with the infant, or on the care and treatment of the infant, or on the infant's relationship with his or her parents or guardian.
New York Public Health Law § 18(3)(c), however, provides:
A subject over the age of twelve years may be notified of any request by a qualified person to review his/her patient information, and, if the subject objects to disclosure, the provider may deny the request. . . .
Mrs. A was directed to contact the Health Department for interpretations of the New York Public Health Law.
The Federal Health Insurance Portability and Accountability Act regulation mentioned in N.Y. Comp. Codes R. & Regs. tit. 11, § 420.17(b) is to be modified by Secretary Thompson of the United States Department of Health & Human Services (HHS) to clarify that the Federal regulations are not to be construed to override applicable state laws and regulations concerning a parents rights to information concerning a minor childs health treatment. The position of HHS is set forth in the March 27, 2002 Federal Register at 67 Fed. Reg. 14791-93. The pertinent provision, if adopted by HHS, would be found at 45 C.F.R. § 164.502(g)(3)(ii) and (iii) (2002):
(ii) Notwithstanding the provisions of paragraph (g)(3)(i) of this section: (A) A covered entity [which includes HMOs] may disclose protected health information about an unemancipated minor to a parent . . . if an applicable provision of State or other law, including applicable case law, permits or requires such disclosure; and (B) A covered entity may not disclose protected health information about an unemancipated minor to a parent . . . if an applicable provision of State or other law, including case law, prohibits such disclosure.
(iii) Notwithstanding the provisions of paragraph (g)(3)(i) of this section, a covered entity must, consistent with State or other applicable law, provide a right of access . . . to either: (A) a parent . . ., as the personal representative of the unemancipated minor; (B) The unemancipated minor; or C) Both.
As to Mrs. As right to insist on most medical treatment only being given with her consent, New York Public Health Law § 2504 provides that, except for emergency treatment, the consent of a parent is required for medical treatment of an unmarried individual under the age of 18. New York Public Health Law § 2504(4), however, provides:
Medical, dental, health and hospital services may be rendered to persons of any age without the consent of a parent or legal guardian when, in the physician's judgment an emergency exists and the person is in immediate need of medical attention and an attempt to secure consent would result in delay of treatment which would increase the risk to the person's life or health.
There are exceptions to the general rule governing parental consent concerning reproductive matters, other sexuality issues, and HIV testing. In addition, according to New York Mental Hygiene Law § 22.11(c)(1) (McKinney 1996 and 2001 Supplement), a minor child may receive treatment for substance abuse without parental consent if the treating physician determines that securing such request would be detrimental to the minor child.
Since the Health Department has responsibility for regulating the quality of care provided by an HMO, directives as to Mrs. A being entitled to review and approve of prospective care would have to come from that Department.
For further information, you may contact Principal Attorney Alan Rachlin at the New York City office.