Law / United States / 
Iowa
Mental health information: third-party payors, peer review organizations and self-insured employers
In force.
A sensitive categories rule binding public and private bodies.
- Obligation class
- Consent, Disclosure, Prohibition
- Audit expectation
- none
As of .
What it requires
- If you are a third-party payor or peer review organization receiving mental health information on the patient's prior written consent, first file with the commissioner of insurance a written statement agreeing to instruct your employees and agents to maintain confidentiality, to comply with the limits on use and disclosure, and to destroy the information when it is no longer needed (Iowa Code 228.7(1)).
- Do not allow an employee or agent to use or disclose mental health information except to administer claims, to conduct a utilization and quality control review, to audit claims paid, or as otherwise authorized by law (228.7(2)(a)).
- If you are a self-insured employer that has not filed the statement, do not grant your employees or agents routine or ongoing access to mental health information unless they have signed a statement that they are aware the information may not be used or disclosed except as the subsection provides and that they are aware of the penalty for unauthorized disclosure (228.7(2)(b)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
Section 228.7(3) makes willful use or disclosure of mental health information in violation of subsection 2 a serious misdemeanor for an employee or agent of a third-party payor or peer review organization, with a fine not to exceed $500 for a first offense and $5,000 for each subsequent offense.
What this law does
In chapter 228 of the Iowa Code, a third-party payor is a person which provides accident and health benefits or medical, surgical or hospital benefits, including insurers, nonprofit health service corporations, health maintenance organizations, governmental agencies and self-insured employers.
Section 228.7 lets a mental health professional, data collector or mental health facility disclose mental health information, on the prior written consent of the patient or the patient's legal representative, to a third-party payor or peer review organization that has filed a written statement with the commissioner of insurance.
Section 228.7 bars an employee or agent of a third-party payor or of a peer review organization from using or disclosing mental health information to any person, except to the extent necessary to administer claims, to conduct a utilization and quality control review, to audit claims paid, or as otherwise authorized by law.
Section 228.7 bars routine or ongoing access to mental health information for employees and agents of a self-insured employer that has not filed the statement, unless they have signed a statement that they are aware of the limits on use and of the penalty for unauthorized disclosure.
Section 228.7 makes an employee or agent of a third-party payor or a peer review organization who willfully uses or discloses mental health information in violation of subsection 2 guilty of a serious misdemeanor, with a fine not to exceed $500 for a first offense and $5,000 for each subsequent offense. The history note of section 228.7 cites section 1 of chapter 1226 of the 88 Acts.
When LexLint raises it
When your app profile says your app is an insurer or handles health records.