AN ACT CONCERNING THE INSURANCE APPLICATION PROCESS.

Be it enacted by the Senate and House of Representatives in General Assembly convened:

Section 1. Section 38a-981 of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2008):

(a) Notwithstanding any provision of the general statutes to the contrary, no insurance institution, agent or insurance-support organization [may] shall utilize as its disclosure authorization form in connection with insurance transactions, a form or statement [which] that authorizes the disclosure of personal or privileged information concerning an individual to an insurance institution, agent, or insurance-support organization unless the form or statement: (1) Is written in plain language substantially complying with the tests enumerated in subsection (b) of section 42-152; (2) is dated; (3) specifies the types of persons authorized to disclose information concerning the individual; (4) specifies the nature of the information authorized to be disclosed; (5) identifies the insurance institution or agent and the types of representatives of the insurance institution to whom the individual has authorized the information to be disclosed; (6) specifies the purposes for which the information is collected; (7) specifies the length of time such authorization shall remain valid, which shall be [no longer] not later than: (A) In the case of authorizations signed for the purpose of collecting information in connection with an application for an insurance policy, a policy reinstatement or a request for a change in policy benefits: (i) Thirty months from the date the authorization is signed if the application or request involves life, health or disability insurance, (ii) one year from the date the authorization is signed if the application or request involves property or casualty insurance, (B) in the case of authorizations signed for the purpose of collecting information in connection with a claim for benefits under an insurance policy: (i) The term of coverage of the policy if the claim involves a health insurance benefit, (ii) the duration of the claim if it involves an insurance benefit which is not a health insurance benefit; and (8) advises the individual or a person authorized to act on his behalf that [he] said individual or authorized person is entitled to receive a copy of the authorization form.

(b) Notwithstanding the provisions of section 38a-983, as amended by this act, and subdivision (2) of subsection (c) of section 38a-979, at the time an insurance institution, agent or insurance-support organization releases information, authorized to be disclosed pursuant to subsection (a) of this section, to any third party, such insurance institution, agent or insurance-support organization shall provide written notice to the individual about whom the information released pertains. Such notice shall include, but not be limited to, the date the information was disclosed, the name and address of the third party to whom the information was disclosed, the name, address and business phone number of the insurance institution, agent or insurance-support organization that released the information, and the specific purpose for which the information was disclosed.

[(b)] (c) (1) An insurance institution or a third-party administrator providing insurance or administrative services with respect to an employer's employee benefit plan [which] that provides its employees with health benefits shall, upon written request of an exclusive bargaining agent for such employees, provide such bargaining agent with information regarding description of health benefits available to such employees, claim experience regarding such benefits and the cost to the employer for such coverage or administrative services, as the case may be, for employees in the bargaining unit represented by such bargaining agent. If such employees constitute a subgroup of a multi-bargaining-unit group, the information provided by the insurance institution or administrator shall, upon written request of the exclusive bargaining agent for the subgroup, include a description of available health benefits, claim experience regarding such benefits and the cost to the employer for such coverage or administrative services, as the case may be, for the entire multi-bargaining-unit group or for subgroups within the multi-bargaining-unit group. A copy of such information shall be provided at the same time to the employer by the insurance institution or administrator. Such information shall be made available to the bargaining agent and the employer only if the bargaining agent agrees in writing to pay all reasonable costs, as determined by the insurance institution or administrator, that are incurred by the insurance institution or administrator in developing and distributing the information. The information provided to such agent shall relate to the group of employees as a whole and shall not include any information relating to specific individuals. No requests made pursuant to this subdivision may seek information which relates to a period of time more than twenty-four months prior to the date such request was made.

(2) Prior to providing any information pursuant to subdivision (1) of this subsection, an insurance institution or third-party administrator may require the bargaining agent requesting such information to provide evidence in writing that such bargaining agent is currently designated or certified by the proper state or federal authority as the exclusive bargaining representative or agent of the employees who are the subject of the request.

(3) The provisions of this subsection shall not apply to employees participating in an employee welfare benefit plan subject to the provisions of Title I of the Employee Retirement Income Security Act of 1974 (ERISA), Public Law 93-406, as amended from time to time, or to the exclusive bargaining agents of such employees.

Sec. 2. Section 38a-983 of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2008):

(a) If an individual, after proper identification, submits a written request to an insurance institution, agent or insurance-support organization for access to recorded personal information concerning [himself which] said individual, that is reasonably described and accessible, the institution, agent or insurance-support organization shall, [within] not later than thirty business days from the date such request is received: (1) Inform the individual of the nature and substance of such recorded personal information in writing, by telephone or by other means of oral communication; (2) permit the individual to see and copy, in person, such recorded personal information pertaining to [him] the individual or to obtain a copy of such information by mail, unless such information is in coded form, in which case an accurate translation in readable language shall be provided in writing; (3) disclose to the individual the identity, if recorded, of those persons to whom the insurance institution, agent or insurance-support organization has disclosed such personal information within two years prior to such request, and if the identity is not recorded, the names of those insurance institutions, agents, insurance-support organizations or other persons to whom such information is normally disclosed; and (4) provide the individual with a summary of the procedures by which he may request correction, amendment or deletion of recorded personal information. Nothing in this subsection shall be construed to release an insurance institution, agent or insurance-support organization from the notice obligations imposed by subsection (b) of section 38a-981, as amended by this act.

(b) Any personal information provided pursuant to subsection (a) of this section shall identify the source of the information if it is an institutional source.

(c) Medical-record information supplied by a medical-care institution or medical professional and requested under subsection (a) of this section, together with the identity of the medical professional or medical-care institution [which] that provided such information, shall be supplied either directly to the individual or to a medical professional designated by the individual and licensed to provide medical care with respect to the condition to which the information relates by the insurance institution, agent or insurance-support organization. If it elects to disclose the information to a medical professional designated by the individual, the insurance institution, agent or insurance-support organization shall notify the individual, at the time of the disclosure, that it has provided the information to the medical professional.

(d) Except for personal information provided under section 38a-985, an insurance institution, agent or insurance-support organization may charge a reasonable fee to cover the costs incurred in providing a copy of recorded personal information to individuals.

(e) The obligations imposed by this section upon an insurance institution or agent may be satisfied by another insurance institution or agent authorized to act on its behalf. With respect to the copying and disclosure of recorded personal information pursuant to a request under subsection (a) of this section, an insurance institution, agent or insurance-support organization may make arrangements with an insurance-support organization or a consumer reporting agency to copy and disclose such information on its behalf.

(f) The rights granted to individuals in this section shall extend to all individuals to the extent information concerning [them] such individuals is collected and maintained by an insurance institution, agent or insurance-support organization in connection with an insurance transaction. The rights granted to all individuals by this subsection shall not extend to information concerning them that relates to and is collected in connection with or in reasonable anticipation of, a claim or a civil or criminal proceeding involving them.

(g) For purposes of this section, the term "insurance-support organization" does not include "consumer reporting agency".

Sec. 3. Section 38a-988 of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2008):

(a) An insurance institution, agent or insurance-support organization shall not disclose any personal or privileged information concerning an individual collected or received in connection with an insurance transaction unless the disclosure is:

(1) Made with the written authorization of the individual, provided: (A) If such authorization is submitted by another insurance institution, agent or insurance-support organization, it meets the requirements of section 38a-981, as amended by this act, or (B) if such authorization is submitted by a person other than an insurance institution, agent or insurance-support organization, it shall be: (i) Dated, (ii) signed by the individual, and (iii) obtained within one year prior to the date a disclosure is sought pursuant to this subdivision;

(2) Made to a person other than an insurance institution, agent or insurance-support organization, provided such disclosure is reasonably necessary: (A) To enable such person to perform a business, professional or insurance function for the disclosing insurance institution, agent or insurance-support organization, and such person agrees not to disclose the information without the individual's written authorization unless the disclosure: (i) Would otherwise be permitted by this section if made by an insurance institution, agent, or insurance-support organization, or (ii) is reasonably necessary for such person to perform such person's function for the disclosing insurance institution, agent or insurance-support organization; or (B) to enable such person to provide information to the disclosing insurance institution, agent or insurance-support organization for the purpose of: (i) Determining an individual's eligibility for an insurance benefit or payment, or (ii) detecting or preventing criminal activity, fraud, material misrepresentation or material nondisclosure in connection with an insurance transaction;

(3) Made to an insurance institution, agent, insurance-support organization or self-insurer, provided the information disclosed is limited to that which is reasonably necessary: (A) To detect or prevent criminal activity, fraud, material misrepresentation or material nondisclosure in connection with insurance transactions, or (B) for either the disclosing or receiving insurance institution, agent or insurance-support organization to perform its function in connection with an insurance transaction involving the individual;

(4) Made to a medical-care institution or medical professional for the purpose of: (A) Verifying insurance coverage or benefits; (B) informing an individual of a medical problem of which such individual may not be aware; or (C) conducting an operations or services audit, provided only such information is disclosed as is reasonably necessary to accomplish the foregoing purposes;

(5) Made to an insurance regulatory authority;

(6) Made to a law enforcement or other government authority: (A) To protect the interests of the insurance institution, agent or insurance-support organization in preventing or prosecuting the perpetration of fraud upon it; or (B) if the institution, agent or organization reasonably believes that illegal activities have been conducted by the individual;

(7) Otherwise permitted or required by law;

(8) In response to a facially valid administrative or judicial order, including a search warrant or subpoena;

(9) Made for the purpose of conducting actuarial or research studies, provided: (A) No individual may be identified in any actuarial or research report; (B) materials in which the individual may be identified are returned or destroyed as soon as they are no longer necessary; and (C) the actuarial or research organization agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by an insurance institution, agent or insurance-support organization;

(10) Made to a party or a representative of a party to a proposed or consummated sale, transfer, merger or consolidation of all or part of the business of the insurance institution, agent or insurance-support organization, provided: (A) Prior to the consummation of the sale, transfer, merger or consolidation only such information is disclosed as is reasonably necessary to enable the recipient to make business decisions about the purchase, transfer, merger or consolidation; and (B) the recipient agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by an insurance institution, agent or insurance-support organization;

(11) Made to a person whose only use of such information will be in connection with the marketing of a product or service, provided: (A) No medical-record information, privileged information, or personal information relating to an individual's character, personal habits, mode of living or general reputation is disclosed, and no classification derived from such information is disclosed; (B) the individual has been afforded an opportunity to indicate that the individual does not wish personal information disclosed for marketing purposes and has given no indication that the individual does not wish the information disclosed; and (C) the person receiving such information agrees not to use it except in connection with the marketing of a product or service;

(12) Made to an affiliate whose only use of the information will be in connection with an audit of the insurance institution or agent or the marketing of an insurance product or service, provided (A) with regard to individually identifiable medical records information, written consent of the individual to whom the individually identifiable medical record pertains is obtained prior to disclosure for marketing purposes, and (B) the affiliate agrees not to disclose the information for any other purpose or to unaffiliated persons;

(13) Made by a consumer reporting agency, provided the disclosure is made to a person other than an insurance institution or agent;

(14) Made to a group policyholder for the purpose of reporting claims experience or conducting an audit of the insurance institution's or agent's operations or services, provided the information disclosed is reasonably necessary for the recipient to conduct the audit;

(15) Made to a professional peer review organization for the purpose of reviewing the service or conduct of a medical-care institution or medical professional;

(16) Made to a governmental authority for the purpose of determining the individual's eligibility for health benefits for which the governmental authority may be liable;

(17) Made to a certificate holder or policyholder for the purpose of providing information regarding the status of an insurance transaction;

(18) Made to a lienholder, mortgagee, assignee, lessor or other person shown on the records of an insurance institution or agent as having a legal or beneficial interest in a policy of insurance, provided: (A) No medical-record information is disclosed unless the disclosure would otherwise be permitted by this section; and (B) the information disclosed is limited to that which is reasonably necessary to permit such person to protect its interests in such policy;

(19) Made pursuant to section 53-445;

(20) Made to the Department of Public Health in conjunction with the investigation of a health care provider pursuant to section 19a-14.

(b) Written notice of any disclosures made pursuant to this section shall be provided to the individual about whom the disclosure was made, in accordance with subsection (b) of section 38a-981, as amended by this act.

Statement of Purpose:

To provide notice to individuals when information about them has been released by an insurance institution, agent or insurance-support organization to third parties.

[Proposed deletions are enclosed in brackets. Proposed additions are indicated by underline, except that when the entire text of a bill or resolution or a section of a bill or resolution is new, it is not underlined.]