Law / United States / 
Montana
Insurance Information and Privacy Protection Act: disclosure for research, anonymized data and identification of individuals
Mont. Code Ann. § 33-19-306(10), (14)
In force since .
A de-identification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Obligation class
- Disclosure, Prohibition
- Audit expectation
- none
What it requires
- If you are a licensee disclosing personal or privileged information for an actuarial or research study, limit the disclosure to what is reasonably necessary, make sure no individual is identified in any actuarial or research report, return or destroy the materials that allow an individual to be identified as soon as they are no longer needed, and get the actuarial or research organization to agree not to further disclose the information without the individual's separate, written authorization (section 33-19-306(10)(a)).
- If you are a licensee disclosing for health research, make sure the research is subject to institutional review board approval and the federal requirements for biomedical research, and if you disclose for epidemiological or drug therapy outcomes research, disclose only information that has been made anonymous to protect the identity of the patient through coding or encryption (section 33-19-306(10)(b)).
- If you are a licensee disclosing to a group policyholder for reporting claims experience or auditing your operations or services, disclose only what the group policyholder reasonably needs, get its agreement not to further disclose the information without the individual's separate, written authorization, and edit any medical record information disclosed to prevent the identification of the applicant, policyholder or certificate holder (section 33-19-306(14)).
These lines are LexLint's reading of the law's text.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Section 33-19-405 makes a person who violates the chapter subject to the civil penalty in section 33-1-317, a fine not to exceed $25,000 imposed by the commissioner after a hearing, except that the fine on insurance producers or adjusters may not exceed $5,000 per violation.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 25,000
Who enforces it
Enforcement body
The commissioner of insurance, who has the power to examine and investigate the affairs of every insurance institution or insurance producer doing business in Montana.
What record it asks for
Logging duty
Section 33-19-306(10) and (14) state no log or record duty of their own. The record of disclosures of medical record information is described on the row for sections 33-19-101 to 33-19-409.
- Kind
- None
- As of
What this law does
A licensee is an insurance institution, insurance producer, or other person who is licensed or required to be licensed, authorized or required to be authorized, or registered or required to be registered under Title 33, or a surplus lines insurer. Under section 33-19-306(1), a licensee may not disclose personal or privileged information about an individual collected or received in connection with an insurance transaction except as the section provides.
A licensee may disclose personal or privileged information for an actuarial or research study only if the disclosure is limited to what is reasonably necessary and an individual is not identified in any actuarial or research report.
The materials that allow the individual to be identified must be returned or destroyed as soon as they are no longer needed, and the actuarial or research organization must agree not to further disclose the information without the individual's separate, written authorization.
A disclosure for health research must be subject to the approval of an institutional review board and the requirements of federal law and regulations governing biomedical research, and a disclosure for epidemiological or drug therapy outcomes research must be of information that has been made anonymous to protect the identity of the patient through coding or encryption.
A disclosure to a group policyholder for reporting claims experience or auditing the licensee's operations requires the group policyholder to agree not to further disclose the information without the individual's separate, written authorization, and the medical record information disclosed must be edited to prevent the identification of the applicant, policyholder, or certificate holder.
The commissioner shall adopt rules establishing the methods that licensees must use to prevent identification as described in subsection (14).
When LexLint raises it
When your app profile says your app is an insurer, handles health records, processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .