Is an insurer, in Montana

Mont. Code Ann. § 33-19-306(10), (14) · Read the law's page

• If you are a licensee disclosing personal or privileged information for an actuarial or research study, limit the disclosure to what is reasonably necessary, make sure no individual is identified in any actuarial or research report, return or destroy the materials that allow an individual to be identified as soon as they are no longer needed, and get the actuarial or research organization to agree not to further disclose the information without the individual's separate, written authorization (section 33-19-306(10)(a)).
• If you are a licensee disclosing for health research, make sure the research is subject to institutional review board approval and the federal requirements for biomedical research, and if you disclose for epidemiological or drug therapy outcomes research, disclose only information that has been made anonymous to protect the identity of the patient through coding or encryption (section 33-19-306(10)(b)).
• If you are a licensee disclosing to a group policyholder for reporting claims experience or auditing your operations or services, disclose only what the group policyholder reasonably needs, get its agreement not to further disclose the information without the individual's separate, written authorization, and edit any medical record information disclosed to prevent the identification of the applicant, policyholder or certificate holder (section 33-19-306(14)).

Mont. Code Ann. §§ 33-19-101 to 33-19-409 · Read the law's page

• If you are an insurance institution, insurance producer or insurance-support organization, do not use or authorize pretext interviews to obtain information in connection with an insurance transaction, except to investigate a claim where specific information available to the commissioner gives a reasonable basis for suspecting criminal activity, fraud, material misrepresentation or material nondisclosure.
• Give individuals about whom you collect and disclose personal information a clear and conspicuous written notice of your information practices, delivered to a policyholder or certificate holder no later than delivery of the policy or certificate and within 60 days after a material change in your privacy practices, and to an applicant when the application is submitted.
• Clearly specify any questions designed to obtain information solely for marketing or research purposes.
• Do not prepare or request an investigative consumer report for an application, renewal, reinstatement or change in benefits unless you tell the individual that they may request an interview and may receive a copy of the report on request.
• On a written request after proper identification, within 30 business days inform the individual of the nature and substance of the recorded personal information, let them see and copy it or obtain a copy by mail, disclose the identity of those to whom you disclosed it within the previous 2 years, and give a summary of the correction procedures.
• Within 30 business days of a written request to correct, amend or delete recorded personal information, either do so or tell the individual of your refusal, the reasons and the right to file a statement of disagreement.
• After an adverse underwriting decision, give the applicant, policyholder or individual proposed for coverage the specific reasons in writing, or advise that they may be requested in writing, with a summary of their rights, and on a written request made within 90 business days furnish the reasons, the supporting items of personal and privileged information and the institutional sources within 21 business days.
• Do not seek information about a previous adverse underwriting decision, or previous residual market coverage, unless the inquiry also asks for the reasons and the individual is advised of the source, and do not base an adverse underwriting decision on the fact of an earlier one.
• If you are a licensee, do not disclose personal or privileged information about an individual collected or received in connection with an insurance transaction except as section 33-19-306 allows, including with the individual's written authorization on a form that meets section 33-19-206, and do not use or disclose personal information for a marketing purpose except as section 33-19-307 permits.
• Use a disclosure authorization that is in writing or electronic form, identifies the individual, describes the information, recipient and purpose, is signed and dated, states how long it is valid (no more than 24 contiguous months) and how to revoke it, and do not condition enrollment, coverage, benefits or rates on signing one unless the disclosure is necessary to perform an insurance function.

Mont. Code Ann. §§ 33-18-901 to 33-18-904 · Read the law's page

• If you are an insurer, health service corporation, health maintenance organization, fraternal benefit society or other issuer of an individual or group policy or certificate of insurance, do not require an individual to obtain a genetic test unless the test is otherwise required by law, for example to establish parentage, for newborn screening, in a criminal investigation or for remains identification.
• Do not, on the basis of a person's genetic traits, refuse an application, refuse to issue, cancel or refuse to renew a policy or certificate, charge a higher rate or premium, or offer different terms, conditions or benefits or limit coverage.
• Do not underwrite or condition coverage on a requirement or agreement that the individual undergo genetic testing, or on genetic information about a member of the individual's family, and do not discriminate in agents' or brokers' fees or commissions on the basis of an individual's genetic traits.
• Do not seek genetic information about an individual for a purpose unrelated to assessing or managing the individual's current health, inappropriate in an asymptomatic individual, or unrelated to research in which a subject is not personally identifiable.

Mont. Code Ann. § 33-19-321 · Read the law's page

• If you are a licensee or insurance-support organization that conducts business in Montana and owns or licenses computerized data that includes personal information, notify any individual whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person, without unreasonable delay, consistent with law-enforcement needs and the measures necessary to determine the scope of the breach and restore the system.
• If you maintain computerized data that includes personal information disclosed to you to perform an insurance function, notify the licensee or insurance-support organization immediately following discovery of a breach of the system in which the data is maintained.
• When you must notify individuals, simultaneously submit to the commissioner an electronic copy of the notification and a statement of the date and method of distribution.

Mont. Code Ann. § 33-19-321(4) · Read the law's page

• Applies to a licensee (an insurance institution, insurance producer, or other person licensed or required to be licensed under Title 33, or a surplus lines insurer), an insurance-support organization, and a person to whom personal information is disclosed under part 3 of the insurance information and privacy protection chapter; declare is_insurer where you hold that status.
• Develop and maintain an information security policy for the safeguarding of personal information, and security breach notice procedures that provide expedient notice to individuals.