Consumer Privacy – No
Blarney Allowed
March 17 is the one day
of the year that everyone (in America, at least) is welcomed as Irish and permitted to take
part in fun traditions like wearing green or drinking green beer. Another Irish tradition is kissing the
Blarney Stone, which sounds unsanitary, but is supposed to confer the gift of
gab (or blarney, if you will) on those that smooch the Stone.
What is not blarney, are
several recent legislative proposals that may increase licensed agent responsibility
and liabilities regarding how they handle consumer information. There are five consumer privacy bills that
have been introduced in the Legislature.
These include AB 1560 (Gorrell), AB 1710 (Dickinson), AB 1830 (Conway),AB 2147 (Melendez), SB 974 (Anderson).
All concern the proper handling of a consumer’s personal information. Three of the bills directly reference
information collected and used by the California Health Benefit Exchange,
others add liability and penalties for incorrect handling or willful misuse of
the information.
Three of the bills
require Covered California to first gain explicit permission from consumers
before it releases their information to third parties, including agents, among
other provisions. CAHU strongly supports handling consumer information (also
called private health information (PHI) using the best professional practices
that meet the many requirements of federal and state law. However, any new law in this area needs to
ensure that licensed, certified agents do not face new layers of privacy
mandates or incur unreasonable new legal liability when following through on
information lawfully provided to them by Covered California or any other
entity.
Agents are already mandated to comply with
extensive privacy laws, undergo substantial education on handling of consumer
information and ethics, plus annual continuing education in both areas. Agents are also subject to extensive
background checks. New layers of privacy
mandates, legal liability and fines are unnecessary when following up on
consumers needing help enrolling in health care coverage when the information
is lawfully provided. CAHU will be
working with all of the bill authors to educate them and to address any CAHU
concerns about a particular measure.
Even though agent
handling of PHI was not the cause of the media attention that led to these
bills, I did want to take a moment to caution all agents there is likely going
to be extra scrutiny on how agents handle Personal Health Information (names,
address or phone number, plus social security numbers, tax identification
information, etc.) as a result of these bills. All agents need to be extra careful and be
sure they handle consumer private
health information in compliance with HIPPA/ HITECH/PPACA, as well as with
additional contractual requirements imposed on any agent that does business
with Covered California as a certified agent.
As you
know, the Health Insurance Portability and Accountability Act of 11996 (HIPAA)
rules generally require that covered entities and business associates enter
into contracts with their business associates to ensure that the business
associates will appropriately safeguard protected health information.
There are significant fines and penalties associated with this act for breaches
or willful misuse of private health information.
The
Health Information Technology for Clinical and Economic Health (HITECH) Act,
part of the American Recovery and Reinvestment Act of 2009, gave State
Attorneys General the authority to bring civil actions on behalf of state
residents for violations of the HIPAA Privacy and Security Rules. The HITECH Act permits State Attorneys
General to obtain damages on behalf of state residents or to enjoin further
violations of the HIPAA Privacy and Security Rules.
If
you would like to refresh the details of all privacy rules that apply to agent
communications, check out the California Department of Insurance page on
privacy requirements at: http://www.insurance.ca.gov/privacy-policy/privacy.cfm.
I
also wanted to be sure that all agents are reminded to use secure (encrypted)
ways to transmit PHI of their clients. When sending PHI securely via encrypted
emails, please be aware that the HIPAA Privacy Rule still requires that PHI
only be shared with those who are permitted to have the information and share
only the minimum amount of PHI necessary to accomplish the business
purpose. I know you know, this, but a
reminder never hurts.
CAHU
is placing a link on our website that Covered California recommends for sending
client PHI info: (https://www.coveredca.com/hbex/agents/PDFs/Using%207-Zip%20for%20Encryption.pdf). This is a free, open source application that agents can download and use. There are also many other programs available
that encrypt information sent electronically.
Some free and some for sale. Just know that you have choices and the link
above is just one option. Just be sure to use secure emails to send your
client’s information to carriers or Covered California.
All Blarney aside, I
hope you have a wonderful St. Patrick’s Day.
Stay well, if you do drink green beer today, drink and drive responsibly
and get home safely.
Until Next Week,
Sam