20-448.01. Required insurance procedures relating to HIV information; confidentiality; violations; penalties; definitions

A. In this section unless the context otherwise requires:

1. "Confidential HIV-related information" means information concerning whether a person has had an HIV-related test or has HIV infection, HIV-related illness or acquired immune deficiency syndrome and includes information which identifies or reasonably permits identification of that person or the person's contacts.

2. "HIV" means the human immunodeficiency virus.

3. "HIV-related test" means a laboratory test or series of tests for the virus, components of the virus or antibodies to the virus thought to indicate the presence of HIV infection.

4. "Protected person" means a person who takes an HIV-related test or who has been diagnosed as having HIV infection, acquired immune deficiency syndrome or HIV-related illness.

5. "Person" includes all entities subject to regulation under title 20, the employees, contractors and agents thereof, and anyone performing insurance related tasks for such entities, employees, contractors or agents.

B. Except as otherwise specifically authorized or required by this state or by federal law, no person may require the performance of, or perform an HIV-related test without first receiving the specific written informed consent of the subject of the test who has capacity to consent or, if the subject lacks capacity to consent, of a person authorized pursuant to law to consent for that person. Written consent shall be in a form as prescribed by the director.

C. No person who obtains confidential HIV-related information in the course of processing insurance information or insurance applications or pursuant to a release of confidential HIV-related information may disclose or be compelled to disclose that information except to the following:

1. The protected person or, if the protected person lacks capacity to consent, a person authorized pursuant to law to consent for the protected person.

2. A person to whom disclosure is authorized in writing pursuant to a release as set forth in subsection E of this section, including but not limited to a physician designated by the insured or a medical information exchange for insurers operated under procedures intended to ensure confidentiality, provided that in the case of a medical information exchange:

(a) The insurer will not report that blood tests of an applicant showed the presence of the AIDS virus antibodies, but only that unspecified blood test results were abnormal.

(b) Reports must use a general code that also covers results of tests for many diseases or conditions, such as abnormal blood counts that are not related to HIV, AIDS, AIDS related complex or similar diseases.

3. A government agency specifically authorized by law to receive the information. The agency is authorized to redisclose the information only pursuant to this section or as otherwise permitted by law.

4. A person regulated by this title to which disclosure is ordered by a court or administrative body pursuant to section 36-665.

5. The industrial commission or parties to an industrial commission claim pursuant to the provisions of section 23-908, subsection D and section 23-1043.02.

D. Test results and application responses may be shared with the underwriting departments of the insurer and reinsurers, or to those contractually retained medical personnel, laboratories, and insurance affiliates, excluding agents and brokers, which are involved in underwriting decisions regarding the individual's application if disclosure is reasonably necessary to make the underwriting decision regarding such application, and claims information may be shared with claims personnel and attorneys reviewing claims if disclosure is reasonably necessary to process and resolve claims.

E. A release of confidential HIV-related information pursuant to subsection C, paragraph 2 of this section shall be signed by the protected person or, if the protected person lacks capacity to consent, a person authorized pursuant to law to consent for the protected person. A release shall be dated and shall specify to whom disclosure is authorized, the purpose for disclosure and the time period during which the release is effective. A general authorization for the release of medical or other information is not a release of confidential HIV-related information unless the authorization specifically indicates its purpose as a general authorization and an authorization for the release of confidential HIV-related information and complies with the requirements of this section.

F. A person to whom confidential HIV-related information is disclosed pursuant to this section shall not disclose the information to another person except as authorized by this section. This subsection does not apply to the protected person or a person who is authorized pursuant to law to consent for the protected person.

G. If a disclosure of confidential HIV-related information is made pursuant to the provisions of a written release as permitted by subsection C, paragraph 2 of this section, the disclosure shall be accompanied by a statement in writing which warns that the information is from confidential records which are protected by state law that prohibits further disclosure of the information without the specific written consent of the person to whom it pertains or as otherwise permitted by law.

H. The person making a disclosure in accordance with subsection C, paragraphs 3, 4 and 5, and subsection G of this section shall keep a record of all disclosures for the time period prescribed by the director. On request, a protected person or his legal representative shall have access to the record.

I. Except as otherwise provided pursuant to this section or subject to an order or search warrant issued pursuant to section 36-665, no person who receives confidential HIV-related information pursuant to a release of confidential HIV-related information may disclose that information to another person or legal entity or be compelled by subpoena, order, search warrant or other judicial process to disclose that information to another person or legal entity.

J. The director shall adopt rules to implement the allowable tests and testing procedures, written consent to perform a human immunodeficiency virus related test, procedures for confidentiality and disclosure of medical information and procedures for gathering underwriting information and may adopt additional rules reasonable and necessary to implement this section.

K. Notwithstanding any other provision of law to the contrary, nothing in this section shall be interpreted to restrict the director's authority to full access to records of any entity subject to regulation under title 20, including but not limited to all records containing confidential HIV-related information. The director may only redisclose confidential HIV-related information in accordance with this section.

L. A protected person, whose rights provided in this section have been violated by a person or entity described in subsection A, paragraph 5 of this section, has those individual remedies specified in section 20-2118 against such a person or entity.