Law / United States / 
California
Health insurer confidential communications and sensitive services (Insurance Information and Privacy Protection Act section 791.29)
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Data subject rights, Consent, Disclosure
- Audit expectation
- none
As of .
What it requires
- Do not require a protected individual (an adult insured, or a minor who can consent to care without a parent's or guardian's consent) to obtain the policyholder's authorization to receive sensitive services or to submit a claim for them, if that person has the right to consent to care. Recognize their right to exercise these rights exclusively as to medical information about sensitive services they received.
- Direct every communication about a protected individual's receipt of sensitive services directly to that individual: bills and collection attempts, notices of adverse benefit determinations, explanations of benefits, requests for more claim information, notices of a contested claim, the name and address of a provider with the description of services and other visit information, and any communication containing protected health information. Send them to the alternative mailing address, email address or telephone number the individual designated, or otherwise in the individual's name at the address or telephone number on file.
- Do not disclose medical information about sensitive health care services provided to a protected individual to the policyholder or any insured other than that individual without the individual's express written authorization.
- Permit an insured to request, and accommodate, confidential communication in the form and format requested if readily producible, or at alternative locations. You may require the request in writing or by electronic transmission. It covers all communications that disclose medical information or provider name and address about the requester's care until revoked or replaced. Implement it within 7 calendar days of an electronic transmission, telephone request or website request, or 14 calendar days of a first-class mail request, and acknowledge receipt and report on status if the insured contacts you.
- Notify insureds with individual or group coverage that they may request confidential communication and how, on initial enrollment and annually at renewal, in a conspicuously visible location in the evidence of coverage and on your website through a hyperlink on the home page.
- Do not condition coverage on the waiver of these rights.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Section 791.29(f): a civil penalty not to exceed $5,000 for each violation, or $10,000 for each willful violation, assessed by the Commissioner after notice and an opportunity for hearing; the higher, willful-violation figure is recorded as per_violation_amount. The Commissioner has discretion to determine the acts or omissions that constitute a violation.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
California Insurance Commissioner (Department of Insurance), which may assess the civil penalty after notice and an opportunity for hearing under the Administrative Procedure Act. The article gives individuals no remedy beyond those section 791.20 lists, and that section lists none for this section.
Settledness
- As of
- Open questions
- Which of the section's requirements does federal law displace for a given health insurer, given that the section applies only to the extent permitted by federal law?
What this law does
Insurance Code section 791.29 requires a health insurer, notwithstanding any other law and to the extent permitted by federal law, to take steps to protect the confidentiality of an insured's medical information. A health insurer may not require a protected individual to obtain the policyholder's authorization to receive sensitive services or to submit a claim for sensitive services if the protected individual has the right to consent to care.
A health insurer must direct all communications about a protected individual's receipt of sensitive health care services directly to that individual, at an alternative mailing address, email address or telephone number the individual designated or otherwise in the individual's name at the address or telephone number on file.
A health insurer may not disclose medical information about sensitive health care services provided to a protected individual to the policyholder or any insured other than that individual without the individual's express written authorization. A health insurer must permit an insured to request, and accommodate requests for, confidential communication in the form and format requested if it is readily producible in that form and format, or at alternative locations.
A confidential communications request must be implemented within 7 calendar days of an electronic transmission, telephonic request or request through the health insurer's internet website, or within 14 calendar days of receipt by first-class mail. A health insurer must notify insureds of the right to request confidential communication and how to make the request, on initial enrollment and annually at renewal.
A health insurer may not condition coverage on the waiver of the rights the section provides. If the Commissioner determines that an insurer has violated the section, the Commissioner may, after notice and an opportunity for hearing, assess a civil penalty not to exceed $5,000 for each violation, or $10,000 for each willful violation.
Sensitive services are all health care services related to mental or behavioral health, sexual and reproductive health, sexually transmitted infections, substance use disorder, gender affirming care and intimate partner violence.
A protected individual is any adult insured covered under a health insurance policy, or a minor who can consent to a health care service without the consent of a parent or legal guardian under state or federal law, but not an individual who lacks the capacity to give informed consent for health care under section 813 of the Probate Code. The section became operative on .
When LexLint raises it
When your app profile says your app is an insurer or handles health records.