The Office of General Counsel issued the following informal opinion on April 5, 2002, representing the position of the New York State Insurance Department.

Re: Nonpublic Personal Health Information (Regulation 169)

Questions Presented:

1. Does the term "service provider" include health care providers and/or suppliers of health care related services and items?

2. How does the term "service provider", which is used in Regulation 169, differ from the terms "business associate" or "trading partner", which are used in the federal Health Insurance Portability and Accountability Act ("HIPAA"), 45 C.F.R. 160.103 (2001)?

Conclusions:

1. With respect to the application of N.Y. Comp. Codes R. & Regs. tit. 11, § 420.17(b) (2001) to health care providers and/or suppliers of health care related services and items, whether or not these individuals are service providers is not determinative of whether any of the enumerated exceptions contained in this section are applicable. Rather, the function being performed should be analyzed to determine whether it falls within the enumerated exceptions. With respect to nonpublic personal financial information, N.Y. Comp. Codes R. & Regs. tit. 11, § 420.13, 420.14 and 420.15 (2001) enumerate the exceptions allowing for disclosure. Similarly, the function being performed by the health care providers and/or suppliers of health care related services and items should be analyzed to determine the applicability of those sections.

2. "Business associate" and "trading partner" are defined terms under HIPAA, 45 C.F.R. 160.103 (2001), a regulation promulgated by the United States Department of Health and Human Services.

Facts:

No facts were provided. The inquiry was general in nature.

Analysis:

Question 1:

N.Y. Comp. Codes R. & Regs. tit. 11, § 420.17(b) (2001) permits disclosure of nonpublic personal health information without the consumer or customer’s authorization for the performance of certain insurance functions by or on behalf of the licensee. The term "service provider" is not used in this section. Thus, in determining whether N.Y. Comp. Codes R. & Regs. tit. 11, § 420.17(b) (2001) permits disclosure to health care providers and/or suppliers of health care related services and items, whether or not the individuals performing the function are "service providers" is not determinative. Rather, the function being performed by these individuals should be analyzed to determine whether it falls within the enumerated exceptions.

With respect to nonpublic personal financial information, N.Y. Comp. Codes R. & Regs. tit. 11, § 420.13, 420.14 and 420.15 (2001) enumerate the exceptions allowing for disclosure.1 Similarly, their applicability also requires an analysis of the functions being performed by the health care provider or supplier of health care related services and items.

Although the term "service provider" is not defined in Regulation 169, this Office has interpreted the term as including a health care provider or supplier of health care related services and items only in those limited cases where it can be said that the provider or supplier is providing or supplying services for the licensee, rather than for the individual. For example, if an insured under a health insurance policy or as a member of a health maintenance organization visits a doctor, the doctor would be providing services for the individual and would not be treated as a "service provider" for purposes of Regulation 169. On the other hand, if the visit were at the behest of the licensee and to a doctor designated by the licensee, such as when the individual is an applicant for a life insurance policy for which a medical examination is required or when the insured is making a claim under a no-fault policy, the doctor could be considered a "service provider" because the doctor would be providing services for the licensee, rather than for the individual.

Question 2:

The terms "business associate" and "trading partner" are terms that are defined and used in HIPAA, 45 C.F.R. 160.103 (2001), which was promulgated by the United States Department of Health and Human Services. Accordingly, an interpretation of those terms should be obtained from that Agency. N.Y. Comp. Codes R. & Regs. tit. 11, § 420.21 (2001) provides that a licensee that complies with all requirements of HIPAA, except for its effective date provision, is not subject to the rules for health information contained in N.Y. Comp. Codes R. & Regs. tit. 11, §§ 420.17-420.20 (2001).

For further information, you may contact Supervising Attorney Joan Siegel at the New York City Office.


1 Although the term "service provider" is used in N.Y. Comp. Codes R. & Regs. tit. 11, § 420.13 (2001), it is not a defined term in the Regulation.