Subdivision 1.Requirement.

An insurer, insurance agent, or insurance-support organization must not disclose any personal or privileged information about a person collected or received in connection with an insurance transaction without the authorization of that person except as authorized by this section. An insurer, insurance agent, or insurance-support organization must not collect personal information about a policyholder or an applicant not relating to a claim from sources other than public records without an authorization from the person. The authorization to collect personal information must be in writing or in the same medium as the application for insurance.

Subd. 2.Prevention of fraud.

Ask an insurance law question, get an answer ASAP!
Click here to chat with a lawyer about your rights.

Personal or privileged information may be disclosed without a written authorization to another person if the information is limited to that which is reasonably necessary to detect or prevent criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with an insurance transaction, and that person agrees not to disclose the information further without the individual written authorization unless the further disclosure is otherwise permitted by this section if made by an insurer, insurance agent, or insurance-support organization. Any insurer, insurance agent, or insurance-support organization making such a disclosure is immune from liability under section 60A.952, subdivision 3.

Subd. 3.Health care institutions and professionals.

Personal or privileged information may be disclosed without a written authorization to a health care institution or health professional for the purpose of verifying insurance coverage benefits, informing a person of a health problem of which the person must not be aware, or conducting an operations or services audit, if the information is only disclosed that is reasonably necessary to accomplish the purposes under this subdivision.

Subd. 4.Regulatory authority.

Personal or privileged information may be disclosed without a written authorization to an insurance regulatory authority.

Subd. 5.Other governmental authorities.

Personal or privileged information may be disclosed without a written authorization to a law enforcement or other governmental authority if:

(1) the disclosure is to protect the interests of the insurer, agent, or insurance-support organization in preventing or prosecuting the perpetration of fraud upon it; or

(2) the insurer, agent, or insurance-support organization reasonably believes that illegal activities have been conducted by the individual.

Subd. 6.Other laws or order.

Personal or privileged information may be disclosed without a written authorization if permitted or required by another law or in response to a facially valid administrative or judicial order, including a search warrant or subpoena.

Subd. 7.Actuarial and research studies.

Personal or privileged information may be disclosed without a written authorization to conduct actuarial or research studies if:

(1) no individual may be identified in the actuarial or research report;

(2) materials allowing an individual to be identified are returned or destroyed as soon as they are no longer needed; and

(3) the actuarial or research organization agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by an insurance company, agent, or insurance-support organization.

Subd. 8.Affiliate companies.

Personal or privileged information may be disclosed without a written authorization to an affiliate whose only use of the information will be in connection with an audit of the insurer or agent or the marketing of an insurance product or service, provided the affiliate agrees to not disclose the information for any other purpose or to unaffiliated persons.

Subd. 9.Group policyholder.

Personal or privileged information may be disclosed without written authorization to a group policyholder only to report claims experience or conduct an audit of the insurer’s or agent’s operations or services, if the information disclosed is reasonably necessary for the group policyholder to conduct the review or audit.

Subd. 10.Governmental licensing board.

Personal or privileged information may be disclosed without a written authorization to a governmental professional licensing or regulatory board to review the service or conduct of a health care institution or health professional that the insurer has reason to believe has violated its licensing act or engaged in the unlawful practice of a licensed professional.

Subd. 11.Professional peer review.

Subject to the terms of a contract between an insurer and a health professional or health care institution, personal or privileged information may be disclosed without a written authorization to a professional peer review organization to review the service or conduct of a health care institution or health professional.

Subd. 11a.Merger or sale.

Personal or privileged information may be disclosed to a party or representative of a party to a proposed or consummated sale, transfer, merger, or consolidation of all or part of the business of the insurer, agent, or insurance-support organization, without a written authorization provided:

(1) prior to the consummation of the sale, transfer, merger, or consolidation, only such information is disclosed as is reasonably necessary to enable the recipient to make business decisions about the merger, transfer, purchase, or consolidation; and

(2) the recipient agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by an insurer, agent, or insurance-support organization.

Subd. 12.Notice.

Whenever an insurer, insurance agent, or insurance-support organization discloses personal or privileged information about a person that requires the written authorization of that person under this section, the insurer, insurance agent, or insurance-support organization shall notify that person in writing within ten days of the date the information was disclosed. The notification must specify the identity of the person to whom information was disclosed and the nature and substance of the information that was disclosed. A notice is not required to be given under this subdivision if an insurer is disclosing personal information for underwriting purposes to another insurer, or to an insurance-support organization if the person had signed an authorization authorizing the disclosure.