Private Insurance Data Requirements

Connecticut establishes the following rules for Insurers, Managed Care Organizations, and Health plans:

· Private insurers must implement policies, standards and procedures for managing, transferring, and securing medical record information.1

· Insurers must establish a grievance procedure and provide enrollees with notice of this procedure.2

· Insurers may disclose de-identified claims information to certain employers.3

· Health plans may not deny coverage based on a history of breast cancer if the applicant has been in remission for five years.4

· Insurers must provide applicants and policyholders with “notice of information practices” at the time a person applies for insurance, renews their policy, or requests a reinstatement of their policy.5

· Insurers must obtain authorization to disclose personal information on forms that meet Connecticut’s form criteria (e.g. uses plain language, specifies disclosed information).6

· Insurers must provide individuals with information regarding an adverse underwriting decision.7

· Insurers may disclose personal information in limited circumstances (e.g. with an individual’s authorization).8

· Insurers may not sell individually identifiable medical information, but may disclose such information for marketing purposes so long as they obtain the individual’s consent.9

· Managed Care Organizations must annually report quality information to the Insurance Commissioner.10

· Insurers that disclose individually identifiable information from medical records with the intent to harm an individual face fines and/or imprisonment.11

Connecticut requires the Insurance Commissioner to annually distribute Managed Care Organization consumer report cards.12

Connecticut consumers may request access to personal information maintained by an Insurer13 and may request that the Insurer correct, amend, or delete such information.14