Law / United States / 
Pennsylvania
Privacy of consumer health information: authorization before disclosure by insurance licensees
31 Pa. Code §§ 146b.1 to 146b.24
In force.
A sensitive categories rule binding private bodies.
- Obligation class
- Consent, Disclosure
- Audit expectation
- none
As of .
What it requires
- If you are an insurer, producer or other licensee of the Insurance Department, do not disclose nonpublic personal health information about a consumer unless you obtain an authorization from that consumer, except where disclosure is necessary for an insurance function the section lists, such as claims administration, claims adjustment, fraud detection, underwriting or utilization review.
- Do not unfairly discriminate against a consumer because that consumer has not granted authorization for the disclosure.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 146b.23 makes a violation an unfair method of competition or unfair or deceptive act or practice subject to the Unfair Insurance Practices Act. Section 11 of that act lets a court, in an action the commissioner files, impose a civil penalty of not more than $5,000 for each violation the person knew or reasonably should have known was a violation, not to exceed $50,000 in any six month period, or not more than $1,000 for each other violation, not to exceed $10,000 in any six month period.
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 50,000
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
Pennsylvania Insurance Commissioner (Insurance Department), who may issue a cease and desist order or suspend or revoke a license after a hearing under section 9 of the Unfair Insurance Practices Act and may bring an action for the section 11 civil penalties.
What this law does
Chapter 146b governs the treatment of all nonpublic personal health information about individuals by various licensees of the Department. Section 146b.11(a) bars a licensee from disclosing nonpublic personal health information about a consumer unless an authorization is obtained from the consumer whose information is sought to be disclosed.
Section 146b.11(b) provides that nothing in the section prohibits, restricts or requires an authorization for disclosure of nonpublic personal health information to the extent necessary for listed insurance functions, among them claims administration, claims adjustment, fraud detection and underwriting. Section 146b.21(a) provides that, irrespective of whether a licensee is subject to the federal regulation, a licensee that complies with the federal regulation is not subject to the chapter.
Section 146b.22 bars a licensee from unfairly discriminating against a consumer because that consumer has not granted authorization for the disclosure. Section 146b.23 provides that violations of the chapter are deemed and defined by the Commissioner to be an unfair method of competition and an unfair or deceptive act or practice, subject to the applicable penalties or remedies of the Unfair Insurance Practices Act. Chapter 146b was adopted on .
Section 146b.24 requires a licensee to comply with the applicable requirements of the chapter by the corresponding compliance date applicable to the federal regulation.
When LexLint raises it
When your app profile says your app is an insurer.