HOUSE BILL No. 4757 June 3, 1999, Introduced by Rep. Shulman and referred to the Committee on Family and Civil Law. A bill to amend 1980 PA 350, entitled "The nonprofit health care corporation reform act," by amending section 406 (MCL 550.1406) and by adding section 406a. THE PEOPLE OF THE STATE OF MICHIGAN ENACT: 1 Sec. 406. (1)AIN ORDER TO ENSURE THE CONFIDENTIALITY OF 2 RECORDS CONTAINING PERSONAL DATA THAT MAY BE ASSOCIATED WITH 3 IDENTIFIABLE MEMBERS, A health care corporation shall, in order4to ensure the confidentiality of records containing personal data5that may be associated with identifiable members,use reasonable 6 care to secure these records from unauthorized access and to col- 7 lect only personal data that are necessary for the proper review 8 and payment of claims AND AS REQUIRED TO COMPLY WITH SECTION 9 406A. Except as is necessary to comply with section 603 or for 10 the purpose of claims adjudication, claims verification, or when 03704'99 * DKH 2 1 required by law, a health care corporation shall not disclose 2 records containing personal data that may be associated with an 3 identifiable member, or personal information concerning a member, 4 to a person other than the member, without the prior and specific 5 informed consent of the member to whom the data or information 6 pertains. The member's consent shall be in writing. Except when 7 a disclosure is made to the commissioner or another governmental 8 agency, a court, or any other governmental entity, a health care 9 corporation shall make a disclosure for which prior and specific 10 informed consent is not required upon the condition that the 11 person to whom the disclosure is made protect and use the dis- 12 closed data or information only in the manner authorized by the 13 corporation, pursuant to subsection (2). If a member has autho- 14 rized the release of personal data to a specific person, a health 15 care corporation shall make a disclosure to that person upon the 16 condition that the person shall not release the data to a third 17 person unless the member executes in writing another prior and 18 specific informed consent authorizing the additional release. 19 This subsectionshallDOES not preclude the release of informa- 20 tion to a member, pertaining to that member, by telephone, if the 21 identity of the member is verified. This subsectionshallDOES 22 not preclude a representative of a subscriber group, upon request 23 of a member of that subscriber group, or an elected official, 24 upon request of a constituent, from assisting the individual in 25 resolving a claim. 26 (2) The board of directors of a health care corporation 27 shall establish and make public the policy of the corporation 03704'99 * 3 1 regarding the protection of the privacy of members and the 2 confidentiality of personal data. The policy, at a minimum, 3 shall do all of the following: 4 (a) Provide for the corporation's implementation of provi- 5 sions in this act and other applicable laws respecting collec- 6 tion, security, use, release of, and access to personal data. 7 (b) Identify the routine uses of personal data by the corpo- 8 ration; prescribe the means by which members will be notified 9 regardingsuchTHOSE uses; and provide for notification regard- 10 ing the actual release of personal data and information that may 11 be identified with, or that concern, a member, upon specific 12 request by that member. As used in this subdivision, "routine 13 use" means the ordinary use or release of personal data compati- 14 ble with the purpose for which the data were collected. 15 (c) Assure that no person shall have access to personal data 16 except on the basis of a need to know. 17 (d) Establish the contractual or other conditions under 18 which the corporation will release personal data. 19 (e) Provide that enrollment applications and claim forms 20 developed by the corporation shall contain a member's consent to 21 the release of data and information that is limited to the data 22 and information necessary for the proper review and payment of 23 claims, and shall reasonably notify members of their rights pur- 24 suant to the board's policy and applicable law. 25 (f) Provide that applicants for new or renewed certificates 26 shall be advised that the corporation does not require the use of 27 the applicant's federal social security account number and that, 03704'99 * 4 1 when applicable, another authority does require use of the 2 number. 3 (3) A health care corporationwhichTHAT violates this 4 section is guilty of a misdemeanor, punishable by a fine of not 5 more than $1,000.00 for each violation. 6 (4) A member may bring a civil action for damages against a 7 health care corporation for a violation of this section and may 8 recover actual damages or $200.00, whichever is greater, together 9 with reasonable attorneys' fees and costs. 10 (5) This sectionshallDOES notbe construed tolimit 11 access to records ortoenlarge or diminish the investigative 12 and examination powers of governmental agencies, as provided for 13 by law. 14 SEC. 406A. A HEALTH CARE CORPORATION SHALL FURNISH TO ANY 15 PERSON PAYING FOR A GROUP CERTIFICATE OR BENEFIT PLAN EITHER 16 DIRECTLY OR INDIRECTLY, WITHIN 30 DAYS AFTER RECEIVING A WRITTEN 17 REQUEST THEREFORE AND UPON PAYMENT OF A REASONABLE CHARGE, ALL OF 18 THE FOLLOWING INFORMATION FOR THE GROUP CERTIFICATE OR BENEFIT 19 PLAN FOR THE IMMEDIATELY PRECEDING 12-MONTH PERIOD: 20 (A) TOTAL NUMBER OF INDIVIDUALS COVERED. 21 (B) TOTAL NUMBER OF CLAIMS PAID. 22 (C) TOTAL NUMBER OF CLAIMS PENDING. 23 (D) TOTAL NUMBER OF CLAIMS EXCEEDING $50,000.00 AND THE 24 AMOUNT OF EACH OF THOSE CLAIMS. INFORMATION UNDER THIS SUBDIVI- 25 SION SHALL NOT DISCLOSE PERSONAL DATA THAT MAY REVEAL THE IDEN- 26 TITY OF A COVERED INDIVIDUAL. 03704'99 * 5 1 (E) CLAIMS EXPERIENCE DATA BY COVERAGE COMPONENT. 2 (F) ALL PERTINENT INFORMATION THAT IS NECESSARY FOR THE 3 PERSON TO OBTAIN COMPETITIVE BIDS FOR OTHER THIRD PARTY ADMINIS- 4 TRATOR SERVICES OR OTHER HEALTH CARE COVERAGE. 03704'99 * Final page. DKH