The Office of General Counsel issued the following opinion on May 19, 2003 representing the position of the New York State Insurance Department.

Re: N.Y. Comp. Codes R. & Regs. tit.11, § 420.17 (2001) and N.Y. Workers’ Comp. Law § 110-a(1)(d)(McKinney 2003)

Questions Presented

Pursuant to N.Y. Comp. Codes R. & Regs. tit.11, § 420.17(b) (Regulation 169) (2001), may a workers’ compensation insurer provide a report for both open and closed claims that includes nonpublic personal financial and health information to its policyholder, an independent agent, a broker or a service provider?

Conclusions

Regulation 169 was not intended to nor could it expand or limit the scope of permissible disclosure now provided for in the New York Workers’ Compensation Law (McKinney 2003). Accordingly, if the information contained in the report contains "individually identifiable information" pursuant to N.Y. Workers’ Comp. Law § 110-a(1)(b)(ii), the insurer may provide the report to the policyholder, an independent agent, a broker or a service provider only to the extent permissible under N.Y. Workers’ Comp. Law § 110-a(1)(d)(McKinney 2003).

Facts

No facts were provided. The inquiry is general in nature.

Analysis

N.Y. Comp. Codes R. & Regs. tit.11, § 420.17 (Regulation 169) (2001) provides:

(a) A licensee shall not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer whose nonpublic personal health information is sought to be disclosed.

(b) Nothing in this section shall prohibit, restrict or require an authorization for the disclosure of nonpublic personal health information by a licensee for the performance of the following insurance functions by or on behalf of the licensee: claims administration; claims adjustment and management; detection, investigation or reporting of actual or potential fraud, misrepresentation or criminal activity; underwriting; policy placement or issuance; loss control; ratemaking and guaranty fund functions; reinsurance and excess loss insurance; risk management; case management; disease management; quality assurance; quality improvement; performance evaluation; provider credentialing verification; utilization review; peer review activities; actuarial, scientific, medical or public policy research; grievance procedures; internal administration of compliance, managerial, and information systems; policyholder service functions; auditing; reporting; database security; administration of consumer disputes and inquiries; external accreditation standards; the replacement of a group benefit plan or workers" compensation policy or program; activities in connection with a sale, merger, transfer or exchange of all or part of a business or operating unit; any activity that permits disclosure without authorization pursuant to the federal Health Insurance Portability and Accountability Act privacy rules promulgated by the U.S. Department of Health and Human Services; disclosure that is required, or is one of the lawful or appropriate methods to enforce the licensee's rights

or the rights of other persons engaged in carrying out a transaction or providing a product or service that a consumer requests or authorizes; and any activity otherwise permitted by law, required pursuant to governmental reporting authority, or to comply with legal process. Additional insurance functions may be added with the approval of the superintendent to the extent they are necessary for appropriate performance of insurance functions and are fair and reasonable to the interest of consumers.

Pursuant to Section 420.17 of Regulation, unless the disclosure of nonpublic personal health information falls within one of the enumerated insurance functions in subdivision (b), a licensee may not disclose such information without the consumer or customer’s authorization. In the context of a workers’ compensation claim, disclosure of a claimant’s nonpublic personal health information in a report provided by the insurer to the employer may fall within the scope of subdivision (b) of Section 420.17, as "any activity otherwise permitted by law." N.Y. Workers Comp. Law § 110-a specifically permits disclosure by the Workers’ Compensation Board of workers’ compensation records that contain nonpublic personal health information under certain circumstances. Regulation 169 was not intended to nor could it enlarge or limit the scope of this disclosure now provided for in the New York Workers’ Compensation Law (McKinney 2003). 1

Accordingly, to determine whether a disclosure by a Workers’ Compensation insurer of a claimant’s nonpublic personal health information is permissible, the insurer must consider the provisions of N.Y. Workers’ Comp. Law § 110-a to determine whether such disclosure would come within its scope. That section provides:

1. Restrictions on disclosure. (a) Except upon the order or subpoena of a court of competent jurisdiction, or subpoena of a law enforcement agency, or subpoena properly issued under the authority of an administrative agency, or in accordance with subdivision two or three of this section, no workers’ compensation record shall be disclosed, redisclosed, released, disseminated or otherwise published by an officer, member, employee or agent of the board to any other person.

(b) For purposes of this section, (i) "record" means a claim file, a file regarding an injury or complaint for which no claim has been made, and/or any records maintained by the board in electronic databases in which the individual claimants or workers are identifiable, or any other information relating to any person who has heretofore or hereafter reported an injury or filed a claim for workers’ compensation benefits, including a copy or oral description of a record which is or was in the possession or custody of the board, its officers, members, employees, or agents.

* * *

(ii) "individually identifiable information" means any data concerning any injury, claim, or potential claim that is linked to an identifiable employee or other natural person.

* * *

2. Authorized disclosure. Workers’ compensation records which contain individually identifiable information may, unless otherwise prohibited by law, be disclosed to:

* * *

(d) a workers’ compensation insurance carrier, employer or the state insurance fund, including officers, employees, legal representatives, agents, reinsurers and contractors thereof, where such individuals are acting within the scope of their duties in evaluating, processing or settling a claim involving the subject of the particular record for which such disclosure is sought, and where such carrier, employer or fund is a party to such claim;

* * *

4. It shall be unlawful for any person who has obtained copies of board records or individually identifiable information from board records to disclose such information to any person who is not otherwise lawfully entitled to obtain these records.

Thus, if the information contained in the insurer’s report is "individually identifiable information" that would appear in a "record" that the Board could have disclosed to the insurer, the insurer may disclose the information to the employer, independent agent, broker or service provider only to the extent that such disclosure is permissible under N.Y. Workers’ Comp. Law § 110-a(2)(d) (McKinney Supp. 2003).

This opinion is limited to a discussion of the scope of disclosure permitted pursuant to Regulation 169. It does not address the requirements of the Health Insurance Portability & Accountability Act ("HIPAA"), nor does it address any other provisions of state or federal law that may further restrict the release of certain nonpublic personal health information, such as HIV or drug or alcohol related information.

For further information one may contact Supervising Attorney Joan Siegel at the New York City Office.

1 T he confidentiality provisions in the Workers’ Compensation Law would serve no purpose if a record, which was disclosed to an insurer by the Board, could then be redisclosed by the insurer, pursuant to Regulation 169, in a manner that would have been impermissible under the Workers’ Compensation Law.