The Office of General Counsel issued the following informal opinion on April 24, 2002, representing the position of the New York State Insurance Department.

Re: Prepaid Health Service Plan, Regulation of Privacy

Questions Presented:

1. Do either N.Y. Comp. R. & Regs. tit. 11, Part 420 (2001) (Regulation 169) or N.Y. Comp. R. & Regs. tit. 11, Part 421 (2002) (Regulation 173) apply to a Prepaid Health Service Plan (PHSP) providing coverage to Medicaid beneficiaries?

2. Does either Regulation 169 or Regulation 173 apply to a PHSP issuing coverage under the Child Health Plus program?

3. Does either Regulation 169 or Regulation 173 apply to a PHSP providing coverage under the Family Health Plus program?


1. Neither Regulation 169 nor Regulation 173 would apply to coverage under the Medicaid program.

2. Both Regulation 169 and Regulation 173 would apply to coverage under the Child Health Plus program.

3. Neither Regulation 169 nor Regulation 173 would apply to coverage under the Family Health Plus program.


A health insurer has an application pending with the Commissioner of Health for a Certificate of Authority as a PHSP and desires to clarify its obligation under the various privacy regulations issued by this Department.


General Background

This Department’s Privacy Regulation, N.Y. Comp. R. & Regs tit. 11, § 420.3(p)(1) (2001) (Regulation 169), defines a "Licensee", to which the Regulation is applicable, as:

‘Licensee’ means a person licensed or required to be licensed, or authorized or required to be authorized, or registered, or required to be registered pursuant to the Insurance Law of this State; a health maintenance organization holding or required to hold, a certificate of authority pursuant to Article 44 of the Public Health Law; or an unauthorized insurer in regard to the excess line business conducted pursuant to section 2118 of the Insurance Law and Part 27 of this Title (Regulation 41).

In addition to issuing Certificates of Authority to general purpose HMOs, the Commissioner is also authorized, by New York Public Health Law § 4403-a(1) (McKinney 2002), to issue a Certificate of Authority to PHSPs:

The commissioner may issue a special purpose certificate of authority to a provider, applying on forms prescribed by the commissioner, seeking to offer a comprehensive health services plan on a prepaid contractual basis either directly, or through an arrangement, agreement or plan or combination thereof to an enrolled population, which is substantially composed of persons eligible to receive benefits under title XIX of the federal social security act or other public programs.

Except for limited circumstances, as delineated below, this Department has no regulatory responsibility for and no supervisory authority over a PHSP.


Medicaid is a joint Federal-State program established under Title XIX of the Federal Social Security Act, 42 U.S.C.A § 1396 et seq. (West 2000) and regulated in New York pursuant to New York Social Services Law Article 5, Title 11 (McKinney 1992). Since the Federal government establishes most of the requirements for the Medicaid program, state regulation of benefits and contracts is pre-empted.

In addition, this Department understands that the confidentiality requirements established by New York Social Services Law § 369(4) are imposed on PHSPs by contract. The relevant provision of the Social Services Law provides:

Any inconsistent provision of this chapter or other law notwithstanding, all information received by social services and public health officials and service officers concerning applicants for and recipients of medical assistance may be disclosed or used only for purposes directly connected with the administration of medical assistance for needy persons.

This Department believes that subscribers’ privacy is adequately protected by the contracts between PHSPs and the State. Therefore, when a PHSP limits its operations to Medicaid, it is not subject to Regulation 169.

Regulation 173 complements Regulation 169 by establishing standards for developing and implementing administrative technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information. A licensee for Regulation 173 is generally defined, N.Y. Comp. R. & Regs. tit. 11, § 421.1(d) (2002), as a licensee for Regulation 169, with exceptions that do not affect PHSPs.

Accordingly, a PHSP that limits its business to Medicaid is not subject to Regulation 173.

Child Health Plus

The Child Health Plus (CHP) program was established by 1990 N.Y. Laws 922 to establish a program to provide primary health insurance coverage for children through age 13. It is primarily regulated by relevant provisions of the New York Public Health Law (McKinney 2002) and Social Services Law (1992). Pursuant to New York Insurance Law § 1120 (McKinney 2000), Commercial insurers, Not-For-Profit Health Service Corporations, and HMOs may also issue policies and contracts under the program.

There are a number of differences between Medicaid and CHP in New York’s statutes. First, with respect to Medicaid, the insurer, including a PHSP, enters into a contract with the State and there is no contractual relationship between the subscriber and the insurer. With CHP, however, pursuant to New York Public Health Law § 2511(7)(a) (McKinney 2002), there is a contract between the insurer and the State, as well as a contractual relationship with the individual (or his or her legal representative) covered under the CHP program, which relationship is evidenced by a document approved by this Department pursuant to New York Public Health Law §2511(7)(b).

Second, the rates charged by an insurer under the CHP program are approved by this Department utilizing the same criteria utilized by this Department for HMOs, including community rating as required by New York Insurance Law § 4317(a) (McKinney 20001).

Third, the only compensation received by an insurer for Medicaid coverage is that received from the State and the individual beneficiary is not expected to make a contribution. By contrast, the CHP program is contributory for some children, New York Public Health Law § 2510(9), and, pursuant to New York Public Health Law § 2511(5), even a child not otherwise eligible may "buy in" to the program.

The Department of Health, utilizing the "substantially composed" language of New York Public Health Law § 4403-a, has indicated that PHSPs may have up to 10% of their subscribers in the "commercial" market. Because of the similarity of CHP policies and contracts to other policies and contracts issued by insurers under this Department’s jurisdiction, and in order that PHSPs should not have a competitive advantage, this Department had determined that PHSPs, in so far as they issues contracts to CHP insureds, are issuing "commercial business" and thus are subject to Regulation 169.

Accordingly, to the extent it issues a contract in the CHP program, a PHSP is considered a licensee subject to Regulations 169 and 173.

Family Health Plus

Family Health Plus (FHP) was established by 1999 N.Y. Laws 1 as an extension of Medicaid and operates pursuant to waivers from the United States Department of Health and Human Services. Although insurers under the jurisdiction of this Department may be providers under FHP, the program is supervised on the state level by the Department of Health pursuant to the relevant provisions of the New York Public Health Law and New York Social Services Law (McKinney 2001 Supplement). This Department has no involvement in the operation or supervision of FHP.

Since, as with Medicaid, this Department has no authority over contracts or benefits and there is adequate protection under the Social Services Law, neither Regulation 169 nor Regulation 173 is applicable to the FHP business of any licensee.

For further information, you may contact Principal Attorney Alan Rachlin at the New York City Office.