Indiana law requires that health insurance companies obtain a patient’s written consent before receiving the patient’s medical records or health information.1  Other important private insurance data requirements include the requirement that health maintenance organizations (HMOs) maintain quality assurance programs.2  The law is very specific as to the structure of the HMO quality program.  The law requires a written statement of purpose, confidentiality policies, an evaluation system, and a peer review system.3  The HMO is also required to establish a reporting protocol on its quality management activities,4 and allow access to records and quality management data to the Commissioner of Health.5