Law / United States / 
Texas
Texas insurer privacy of health information: authorization before disclosing nonpublic personal health information
In force.
A sensitive categories rule binding private bodies.
- Obligation class
- Consent, Disclosure, Retention, Prohibition
- Audit expectation
- none
As of .
What it requires
- If you hold or are required to hold a license, registration or certificate of authority under the Insurance Code (an insurance company, health maintenance organization or insurance agent), obtain authorization before you disclose nonpublic personal health information, unless a function listed in section 602.053 applies (Tex. Ins. Code secs. 602.051(a), 602.053).
- Make a request for authorization clear and conspicuous, in written or electronic form, stating the identity of the consumer or customer, each type of information, each recipient, the purpose, the use and the revocation procedure, with the signature and date and notice of how long the authorization is valid and of the right to revoke it at any time (Tex. Ins. Code secs. 602.051(b), 602.052(a)).
- Do not rely on an authorization that is valid for more than 24 months, and keep the original or a copy in the records of the individual who is the subject of the information (Tex. Ins. Code sec. 602.051(c), (e)).
- Comply with Subchapter D of Health and Safety Code chapter 181 and the standards adopted under section 182.108 of the Health and Safety Code (Tex. Ins. Code sec. 602.054).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Tex. Ins. Code sec. 602.103: the attorney general may bring an action for a civil penalty against a covered entity or health care entity for a violation of chapter 602, the penalty may not be less than $3,000 for each violation, and a court that finds a pattern or practice may assess a civil penalty not to exceed $250,000.
- Rule
- Fixed only
- As of
- Minimum
- 3,000
- Currency
- USD
- Fixed cap
- 250,000
Who enforces it
Enforcement body
Texas attorney general, who may bring an action for a civil penalty against a covered entity or health care entity for a violation of chapter 602 (Tex. Ins. Code sec. 602.103(a)).
What this law does
A covered entity is a person who holds or is required to hold a license, registration, certificate of authority or other authorization under the Insurance Code or another insurance law of this state, including an insurance company, a health maintenance organization and an insurance agent.
Chapter 602 does not apply to a covered entity that is required to comply with the federal standards governing the privacy of individually identifiable health information adopted under the Health Insurance Portability and Accountability Act. Except as section 602.053 provides, a covered entity must obtain authorization to disclose nonpublic personal health information before disclosing the information.
A request for authorization to disclose nonpublic personal health information may be in written or electronic form and must state the identity of the consumer or customer, describe each type of information, each recipient, the purpose, the use and the revocation procedure, include a signature and date, and give notice of the validity period and the right to revoke at any time. The period for which an authorization is valid may not exceed 24 months.
The covered entity must retain the original or a copy of the authorization in the records of the individual who is the subject of the information. A covered entity may not knowingly or wilfully violate chapter 602. The attorney general may bring an action for a civil penalty against a covered entity or health care entity for a violation of chapter 602.
A civil penalty under section 602.103 may not be less than $3,000 for each violation, and a court that finds a pattern or practice may assess a civil penalty not to exceed $250,000. A covered entity that violates chapter 602 is subject to investigation, disciplinary proceedings, and probation or suspension of its license or other authorization to engage in business.
Subchapter C does not affect any right of a person under other law to bring a cause of action or otherwise seek relief for conduct that violates chapter 602. Chapter 602 was added by Acts 2003, 78th Legislature, chapter 1274, effective . Section 602.054 was added by Acts 2011, 82nd Legislature, chapter 1126 (House Bill 300), effective .
When LexLint raises it
When your app profile says your app is an insurer.