28 TAC §§22.51, 22.58 and 22.59
The Texas Department of Insurance proposes an amendment to §22.51 and new §§22.58 and 22.59, concerning privacy of nonpublic personal health information provided by consumers to insurers and other covered entities regulated by the department. This proposal is necessary to complete implementation of Senate Bill (SB) 11, 77 th Texas Legislature. SB 11 added Chapter 28B to the Insurance Code (Article 28B.01 et seq.), which establishes standards for entities regulated by the department with regard to protected consumer health information. SB 11 also added Subtitle I to Title 2 of the Health & Safety Code (Section 181.001 et seq.), which requires certain persons, including covered entities subject to regulation by the department, to comply with provisions addressing reidentification of persons and marketing using protected health information. SB 11 authorizes the Commissioner to adopt rules necessary to implement protected health information privacy requirements as they relate to entities regulated by the department.
The subchapter as originally adopted set forth the requirements that covered entities must meet in structuring their consumer health information practices to comply with SB 11. Specifically, the current rules provide notice requirements, as well as other procedures that covered entities must follow with regard to nonpublic personal health information collected about a consumer. The proposed amendment to §22.51 expands the scope of the subchapter to include proposed new §§22.58 and 22.59. Proposed §22.58 outlines requirements for marketing using protected health information, including requirements for authorization of the individual who is the subject of the protected health information. Proposed §22.59 prohibits reidentification of or any attempt to reidentify a person who is the subject of any protected health information.
2. FISCAL NOTE. Kim Stokes, Senior Associate Commissioner for Life, Health, & Licensing, has determined that for each year of the first five years the proposed sections will be in effect, there will be no fiscal impact to state and local governments as a result of the enforcement or administration of the rule. There will be no measurable effect on local employment or the local economy as a result of the proposal.
3. PUBLIC BENEFIT/COST NOTE. Ms. Stokes has also determined that for each year of the first five years the new sections are in effect, the public benefit anticipated as a result of the proposed sections will be enhanced protection of privacy of consumer health information. Ms. Stokes has determined that any economic cost to persons required to comply with the new sections, as well as any costs to a covered entity qualifying as a small business under Government Code 2006.001, for each year of the first five years the proposed new sections will be in effect are the result of the legislative enactment of the Insurance Code Chapter 28B and Health & Safety Code §§181.151 and 181.152, and not as a result of the adoption, enforcement, or administration of the proposed new sections. The total cost to a covered entity is not dependent upon the size of the entity, but rather is dependent upon the entity´s number of consumers. Therefore, it is the department´s position that the adoption of these proposed new sections will have no adverse economic effect on small businesses or micro-businesses. Regardless of the fiscal effect, the department does not believe it legal or feasible to waive the requirements of these rules for small businesses or micro-businesses. To do so would allow differentiation of protection between consumers of small business covered entities compared to those protections provided to the consumers of large covered entities. In an effort to minimize costs, however, covered entities may deliver required notices along with other correspondence rather than in a separate mailing.
4. REQUEST FOR PUBLIC COMMENT. To be considered, comments on the proposal must be submitted in writing no later than 5:00 p.m., on February 10, 2003 to Gene C. Jarmon, General Counsel, Mail Code 113-2A, Texas Department of Insurance, P. O. Box 149104, Austin, Texas 78714-9104. An additional copy of the comment must be simultaneously submitted to Bill Bingham, Deputy for Regulatory Matters, Mail Code 107-2A, Texas Department of Insurance, P.O. Box 149104, Austin, Texas 78714-9104. A request for a public hearing should be submitted separately to the Office of the Chief Clerk.
5. STATUTORY AUTHORITY. The new sections are proposed under the Insurance Code Article 28B.08 and §36.001 and the Health & Safety Code, §181.004. Insurance Code Article 28B.08 provides that the Commissioner may adopt rules as necessary to implement the chapter. Insurance Code §36.001 provides that the Commissioner of Insurance may adopt rules to execute the duties and functions of the Texas Department of Insurance only as authorized by statute. Health & Safety Code §181.004 authorizes a state agency that licenses or regulates a covered entity subject to Chapter 181 to adopt rules as necessary to carry out the purposes of the chapter.
The following articles of the Insurance Code and sections of Chapter 181 of the Health & Safety Code are affected by this proposal: Insurance Code Art. 28B.01 et seq.,Health & Safety Code, §§181.151 and 181.152.
22.51. Purpose and Scope.
(a) Purpose. This subchapter governs the treatment by all covered entities of a consumer´s nonpublic personal health information. This subchapter:
(1) (No change.);
(2) (No change.);
(3) prohibits a covered entity from reidentifying or attempting to reidentify a consumer who is the subject of any protected health information without obtaining the consumer's consent or authorization; and
(4) sets forth requirements for written marketing communication using protected health information.
(b) (No change.)
22.58. Disclosure of Protected Health Information for Marketing Purposes; Requirements for Marketing By or On Behalf of a Covered Entity.
(a) A covered entity may not disclose, use, or sell protected health information, including prescription information or prescription patterns, for marketing purposes without an authorization from the person who is the subject of the protected health information which complies with this subchapter.
(b) A covered entity may not coerce or encourage the coercion of a person to consent to or authorize the disclosure, use, or sale of protected health information for marketing purposes.
(c) Any written marketing communications sent by or on behalf of a covered entity must:
(1) be sent in an envelope showing only the address of the sender and the name and address of the recipient;
(2) state the name and toll-free number of the sender and, if different, the covered entity on whose behalf the communication was sent; and
(3) explain the recipient's right to have the recipient's name removed from the sender's mailing list.
(d) A person who receives a request under subsection (c)(3) of this section to remove a recipient's name from a mailing list shall remove the recipient's name not later than the fifth day after the person receives the request.
22.59. Reidentified Information. A covered entity may not reidentify or attempt to reidentify a person who is the subject of any protected health information without obtaining from that person an authorization that complies with this subchapter, if required under Chapter 181, Health & Safety Code; Article 28B, Insurance Code; or other state or federal law.