Law / United States / 
Connecticut
Written policies, standards and procedures for medical record information held by insurers
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Governance, Security, Disclosure
As of .
What it requires
- If you are an insurance institution, agent or insurance support organization that regularly collects, uses or discloses medical record information, develop and implement written policies, standards and procedures for its management, transfer and security, including protections against unauthorized collection, use or disclosure by you or your employees or agents (section 38a-999(a)).
- Include in those policies a limit on access to people who need it for their jobs, training for authorized employees, disciplinary measures, the job titles authorized to use or disclose the information, procedures for authorizing and restricting collection, use and disclosure, methods for handling, disclosing, storing and disposing of it, periodic monitoring of compliance, and additional protection for sensitive health information on sexually transmitted diseases, mental health, substance abuse, HIV and AIDS, and genetic testing, including the fact that an individual has undergone a genetic test (section 38a-999(a)(1) to (8)).
- Make the policies, standards and procedures available for review by the Insurance Commissioner, and make a summary available to enrollees on enrollment and on request (section 38a-999(b) and (c)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Settledness
- As of
What this law does
Under section 38a-999, an insurance institution, agent or insurance support organization that regularly collects, uses or discloses medical record information must develop and implement written policies, standards and procedures for its management, transfer and security.
Under section 38a-999, the policies must limit access to those who need it for their jobs, provide training and disciplinary measures, and give additional protection to sensitive health information on sexually transmitted diseases, mental health, substance abuse, HIV and AIDS, and genetic testing. Under section 38a-999, the policies, standards and procedures must be available for review by the Insurance Commissioner, and a summary must be available to enrollees on enrollment and on request. Section 38a-999 took effect on .
When LexLint raises it
When your app profile says your app is an insurer.