§42.1.  Confidentiality of information; exceptions

A.  Notwithstanding the provisions of Subsections B and C of this Section, the commissioner shall comply with the provisions of R.S. 22:43; however, no identifier listed in Subsection E of this Section of any of the following persons shall be part of the separate file, record, or report required pursuant to R.S. 22:43 when recording information about any complaint or the compilation of statistical data:

(1)  The individual who is the subject of any health information, health information record, or the working papers, recorded information, documents, or copies thereof or related thereto.

(2)  Anyone identified as, or who it is reasonable to believe is, a relative, employer, or household member of the individual who is described in Paragraph (1) of this Subsection, where the relative, employer, or household member is listed in any record described in Paragraph (1) of this Subsection.

B.(1)  All health information in the custody of the Department of Insurance shall be confidential.  No part of any health information, health information record, or the working papers, recorded information, documents, or copies thereof or related thereto, produced by, obtained by, or disclosed to the commissioner, or any other person, and in the custody of the commissioner shall be disclosed under Title 44 of the Louisiana Revised Statutes of 1950.

(2)  "Health information" means any information in any form or medium, transmitted or maintained in any manner, and in the custody of the department that relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care, including medications and prescriptions, to an individual, or the past, present, or future payment for the provision of health care, including medications and prescriptions, to an individual.

C.  No records, or the working papers, recorded information, documents, or copies thereof or related thereto, produced by, obtained by, or disclosed to the commissioner, or any other person, in the course of or after the resolution of a complaint against any person or entity subject to the jurisdiction of the Department of Insurance and which are in the custody of the commissioner, shall be disclosed under Title 44 of the Louisiana Revised Statutes of 1950.

D.(1)  Nothing in this Section shall prohibit the communication of health information or health information records, or copies thereof, in the custody of the commissioner to:

(a)  The individual who is the subject of the health information or health information record.

(b)  The authorized representative of the individual who is the subject of the health information or health information record.

(c)  A third party when written authorization is provided by the individual who is the subject of the health information record or by the authorized representative of the individual who is the subject of the health information or health information record.

(2)  Nothing in this Section shall prohibit the disclosure of copies of the complaint filed by the complainant or insured, the response by the person or entity subject to the jurisdiction of the department, or the final disposition to:

(a)  The complainant or insured.

(b)  The authorized representative of the complainant or insured.

(c)  A third party when written authorization is provided by the complainant or insured or by the authorized representative of the complainant or insured.

(3)  Nothing in this Section shall prohibit the communication of facts, documents, or other information that is part of a record described in this Section, or the working papers, recorded information, documents, or copies thereof or related thereto, produced by, obtained by, or disclosed to the commissioner, or any other person and in the custody of the commissioner to a state or federal prosecuting attorney, a law enforcement agency, the office of the state inspector general, the state legislative auditor, or the attorney general of this state in connection with their statutory authority, or to any agency or communication district for the purpose of achieving coordinated and effective protection of the public health, safety, or welfare. The department shall also share information with any state or federal agency for the purpose of investigating or determining insurance or tax fraud or the offset of any governmental benefit or with any other government entity authorized by law to conduct any audit, investigation, or similar activity in connection with the administration of any state or federally funded program.

(4)  Nothing in this Section shall prohibit the commissioner from using any records or other information in the custody of the department in the furtherance of any regulatory or legal action brought as part of the commissioner's official duties.

E.  The identifiers described in this Section as confidential shall be the following:

(1)  Names.

(2)  All geographic subdivisions smaller than a state, including street address, city, county or parish, precinct, zip code, and any equivalent geocodes, except for the initial three digits of a zip code if, according to the current publicly available data from the Bureau of the Census:

(a)  The geographic unit formed by combining all zip codes with the same three initial digits contains more than 20,000 people; and

(b)  The initial three digits of a zip code for all such geographic units containing 20,000 or fewer people is changed to 000.

(3)  All elements of dates, except year, for dates directly related to an individual, including birth date, admission date, discharge date, date of death, and all ages over eighty-nine and all elements of dates, including year, indicative of such age, except that such ages and elements may be aggregated into a single category of age ninety or older.

(4)  Telephone numbers.

(5)  Facsimile numbers.

(6)  Electronic mail addresses.

(7)  Social security numbers.

(8)  Medical record numbers.

(9)  Health plan beneficiary numbers.

(10)  Account numbers.

(11)  Certificate and license numbers.

(12)  Vehicle identifiers and serial numbers, including license plate numbers.

(13)  Device identifiers and serial numbers.

(14)  Web Universal Resource Locators (URLs).

(15)  Internet Protocol (IP) address numbers.

(16)  Biometric identifiers, including finger- and voice-prints.

(17)  Full face photographic images and any comparable images.

(18)  Any other unique identifying number, characteristic, or code.

F.  The retention period for records described in this Section shall be no less than three calendar years, and the records may be disposed of thereafter according to R.S. 44:401 et seq.

Acts 2009, No. 367, §1, eff. July 6, 2009; Acts 2012, No. 642, §1, eff. June 7, 2012.