Law / United States / 
Iowa
Insurance privacy rules: authorization to disclose nonpublic personal health information
Iowa Admin. Code r. 191-90.17 and 191-90.18
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Consent, Prohibition, Retention
- Audit expectation
- none
As of .
What it requires
- As an insurance licensee, do not disclose nonpublic personal health information about a consumer or customer unless you obtain an authorization from the consumer or customer whose information is sought to be disclosed (Iowa Admin. Code 191-90.17(1)).
- Use an authorization in written or electronic form that identifies the consumer or customer, generally describes the types of information, the parties to whom you disclose it, the purpose and how it will be used, carries the signature and date, and states how long it is valid, that it may be revoked at any time and how to revoke it (191-90.18(1)).
- Limit an authorization to no more than 24 months, honor a revocation made at any time, subject to the rights of one who acted in reliance on the authorization before notice, and keep the authorization or a copy in the individual's record (191-90.18(2) to (4)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 507B.7(1)(a) lets the Commissioner of Insurance, after hearing, order a civil penalty of not more than $1,000 for each act or violation, up to an aggregate of $10,000, or, if the person knew or reasonably should have known of the violation, not more than $5,000 for each act or violation, up to an aggregate of $50,000 in any one six-month period. The Commissioner may also suspend or revoke the license of a person who knew or reasonably should have known of the violation (section 507B.7(1)(b)).
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 50,000
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
Iowa Commissioner of Insurance, who orders penalties after hearing for a violation of Iowa Code section 507B.4, which rule 191-90.25 applies to a violation of chapter 90.
What this law does
Chapter 90 of the Insurance Division's rules governs the treatment of nonpublic personal financial information and nonpublic personal health information about individuals by all licensees of the insurance division. Rule 90.17 bars a licensee from disclosing nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer whose information is sought to be disclosed.
Rule 90.17 leaves a licensee or its insurance affiliate free to disclose nonpublic personal health information without an authorization for listed insurance functions, among them claims administration, fraud detection and underwriting.
Rule 90.18 requires a valid authorization to be in written or electronic form and to identify the consumer or customer, describe the types of information, the recipients, the purpose and use, carry the signature and date, and state how long it is valid and how it may be revoked. Rule 90.18 limits an authorization to no more than 24 months, lets the individual revoke it at any time, and requires the licensee to retain the authorization or a copy in the individual's record.
Rule 90.26 provides that the health information rules are effective , and that no administrative action against noncompliance will be taken until that date. Rule 90.25 provides that an insurer, producer or licensee that violates a requirement of the rules has committed a violation of Iowa Code section 507B.4, in addition to any other penalties provided by the laws of Iowa.
Section 507B.7 lets the Commissioner of Insurance order a civil penalty of up to $1,000 for each act or violation, up to $10,000 in the aggregate, or up to $5,000 for each act or violation, up to $50,000 in any one six-month period, if the person knew or reasonably should have known of the violation.
When LexLint raises it
When your app profile says your app is an insurer.