Session Laws

Be it enacted by the Senate and House of Representatives in General Court assembled, and by the authority of the same, as follows:

SECTION 1. The General Laws are hereby amended by inserting after chapter 175H the following chapter:- `tuc CHAPTER 175I. INSURANCE INFORMATION AND PRIVACY PROTECTION.

Section 1. (a) The obligations imposed by this chapter shall apply to an insurance institution, insurance representative or insurance-support organization which in the case of life, health and disability insurance:

(1) collects, receives or maintains information in connection with an insurance transaction which pertains to a natural person who is a resident of the commonwealth; or

(2) engages in an insurance transaction with an applicant, individual or policyholder who is a resident of the commonwealth.

(b) In the case of life, health or disability insurance, the rights granted by this chapter shall extend to the following residents of the commonwealth:

(1) natural persons who are the subject of information collected, received or maintained in connection with insurance transactions; and

(2) applicants, individuals or policyholders who engage in or seek to engage in insurance transactions.

(c) For purposes of this section, a person shall be considered a resident of the commonwealth if such person's last known mailing address, as shown in the records of the insurance institution, insurance representative or insurance-support organization, is located in the commonwealth.

Section 2. As used in this chapter the following words shall, unless the context otherwise requires have the following meanings:-

"Adverse underwriting decision", (1) any of the following actions with respect to insurance transactions involving insurance coverage which is individually underwritten:

(i) a declination of insurance coverage;

(ii) a termination of insurance coverage;

(iii) failure of an insurance representative to apply for insurance coverage with a specific insurance institution which the insurance representative represents and which is requested by an applicant; or

(iv) in the case of a life, health or disability insurance coverage, an offer to insure at higher than standard rates.

(2) Notwithstanding the provisions of clause (1), the following actions shall not be considered adverse underwriting decisions but the insurance institution or insurance representative responsible for their occurrence shall nevertheless provide the applicant or policyholder with the specific reason or reasons for their occurrence:

(i) the termination of an individual policy form on a class or statewide basis;

(ii) a declination of insurance coverage solely because such coverage is not available on a class or statewide basis; or

(iii) the rescission of a policy.

"Affiliate" or "affiliated", a person who directly, or indirectly through one or more intermediaries, controls, is controlled by or is under common control with another person.

"Applicant", any person who seeks to contract for insurance coverage other than a person seeking group insurance that is not individually underwritten.

"Commissioner", the commissioner of insurance or his designee.

"Consumer report", a written, oral or other communication of information bearing on a natural person's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living which is used or expected to be used in connection with an insurance transaction.

"Consumer reporting agency", any person who:

(1) regularly engages, in whole or in part, in the practice of assembling or preparing consumer reports for a monetary fee;

(2) obtains information primarily from sources other than insurance institutions; and

(3) furnishes consumer reports to other persons.

"Control", including the terms "controlled by" or "under common control with", the possession, direct or indirect, of the power to direct or cause the direction of the management and policies of a person, whether through the ownership of voting securities, by contract other than a commercial contract for goods or nonmanagement services, or otherwise, unless the power is the result of an official position with or corporate office held by the person.

"Declination of insurance coverage", a denial, in whole or in part, by an insurance institution or insurance representative of requested insurance coverage.

"Individual", any natural person who:

(1) in the case of life, health or disability insurance, is a past, present or proposed principal insured or certificate holder;

(2) is a past, present or proposed policy owner;

(3) is past or present applicant;

(4) is a past or present claimant; or

(5) derived, derives or is proposed to derive insurance coverage under an insurance policy or certificate subject to this chapter.

"Institutional source", any person or governmental entity that provides information about an individual to an insurance representative, insurance institution or insurance-support organization, other than:

(1) an insurance representative;

(2) the individual who is the subject of the information; or

(3) a natural person acting in a personal capacity rather than in a business or professional capacity.

"Insurance institution", any corporation, association, partnership, reciprocal exchange, inter-insurer, Lloyd's insurer, fraternal benefit society or other person engaged in the business of insurance, including health maintenance organizations, medical service plans and hospital service plans, preferred provider arrangements and Savings Bank Life Insurance as defined in chapters one hundred and seventy-five, one hundred and seventy-six, one hundred and seventy-six A, one hundred and seventy-six B, one hundred and seventy-six C, one hundred and seventy-six G, one hundred and seventy-six I, one hundred and seventy-eight and one hundred and seventy-eight A. "Insurance institution" shall not include insurance representatives or insurance-support organizations.

"Insurance-support organization":

(1) any person who regularly engages, in whole or in part, in the practice of assembling or collecting information about natural persons for the primary purpose of providing the information to an insurance institution or insurance representative for insurance transactions, including:

(i) the furnishing of consumer reports or investigative consumer reports to an insurance institution or insurance representative for use in connection with an insurance transaction; or

(ii) the collection of personal information from insurance institutions, insurance representatives or other insurance-support organizations for the purpose of detecting or preventing fraud or material misrepresentation in connection with insurance underwriting or insurance claim activity.

(2) Notwithstanding the provisions of subparagraph (1), the following persons shall not be considered "insurance-support organizations" for purposes of this chapter: insurance representatives, government institutions, insurance institutions, medical care institutions and medical professionals.

"Insurance representative", an agent, broker, advisor, adjuster or other person engaged in activities described in sections one hundred and sixty-two to one hundred and seventy-seven D, inclusive, of chapter one hundred and seventy-five.

"Insurance transaction", any transaction involving life, health or disability insurance which entails:

(1) the determination of an individual's eligibility for an insurance coverage, benefit or payment; or

(2) the servicing of an insurance application, policy, contract or certificate.

"Investigative consumer report", a consumer report or portion thereof in which information about a natural person's character, general reputation, personal characteristics or mode of living is obtained through personal interviews with the person's neighbors, friends, associates, acquaintances or others who may have knowledge concerning such items of information, provided; however, that it shall be unlawful for any such report to contain any information designed to determine the sexual orientation of an applicant, proposed insured, policyholder, beneficiary or any other person, or for such persons, information relating to counseling for Acquired Immune Deficiency Syndrome (AIDS) or AIDS-related Complex (ARC) as defined by the Centers for Disease Control of the United States Public Health Service. For purposes of this subsection, "counseling" shall not mean diagnosis of or treatment for AIDS or ARC.

"Medical-care institution", any facility or institution that is licensed to provide health care services to natural persons, including but not limited to health-maintenance organizations, home-health agencies, hospitals, medical clinics, public health agencies, rehabilitation agencies and skilled nursing facilities.

"Medical professional", any person licensed or certified to provide health care services to natural persons, including, but not limited to, a chiropractor, clinical dietician, clinical psychologist, dentist, nurse, occupational therapist, optometrist, pharmacist, physical therapist, physician, podiatrist, psychiatric social worker or speech therapist.

"Medical-record information", personal information which:

(1) relates to an individual's physical or mental condition, medical history or medical treatment; and

(2) is obtained from a medical professional or medical-care institution, from the individual, or from such individual's spouse, parent or legal guardian;

Medical-record information shall not include information relating to counseling for Acquired Immune Deficiency Syndrome (AIDS) or AIDS-related Complex (ARC) as defined by the Centers for Disease Control of the United States Public Health Service. For purposes of this definition, "counseling" shall not mean diagnosis of or treatment for AIDS or ARC.

"Person", any natural person, corporation, association, partnership or other legal entity.

"Personal information", any individually identifiable information gathered in connection with an insurance transaction from which judgments can be made about an individual's character, habits, avocations, finances, occupation, general reputation, credit, health or any other personal characteristics. "Personal information" shall include an individual's name and address and "medical-record information" but shall not include "privileged information".

"Policyholder", any person who:

(1) in the case of individual life, health or disability insurance, is a present policyholder; or

(2) in the case of group life, health or disability insurance which is individually underwritten, is a present group certificate holder.

"Pretext interview", an interview by a person who attempts to obtain information about a natural person and who commits one or more of the following acts:

(1) pretends to be someone he is not;

(2) pretends to represent a person he is not in fact representing;

(3) misrepresents the true purpose of the interview; or

(4) refuses to identify himself upon request.

"Privileged information", any individually identifiable information that:

(1) relates to a claim for insurance benefits or a civil or criminal proceeding involving an individual; and

(2) is collected in connection with or in reasonable anticipation of a claim for insurance benefits or civil or criminal proceeding involving an individual; provided, however, that information otherwise meeting the requirements of this definition shall nevertheless be considered "personal information" under this chapter if it is disclosed in violation of section thirteen.

"Termination of insurance coverage" or "termination of an insurance policy", either a cancellation or nonrenewal of an insurance policy, in whole or in part, for any reason other than the failure to pay a premium as required by the policy.

"Unauthorized insurer", an insurer not lawfully admitted to issue policies of insurance or an annuity or pure endowment contract, except as provided in section one hundred and sixty of chapter one hundred and seventy-five.

Section 3. No insurance institution, insurance representative, or insurance-support organization shall use or authorize the use of pretext interviews to obtain information in connection with an insurance transaction; provided, however, that a pretext interview may be undertaken to obtain information from a person or institution that does not have a generally or statutorily recognized privileged relationship with the person about whom the information relates for the purpose of investigating a claim where, based upon specific information available for review by the commissioner, there is a reasonable basis for suspecting criminal activity, fraud or material misrepresentation in connection with the claim.

Section 4. (a) An insurance institution or insurance representative shall provide a notice of information practices to all applicants or policyholders in connection with insurance transactions as follows:

(1) in the case of an application for insurance, a notice shall be provided no later than at the time the application for insurance is made;

(2) in the case of a policy renewal, a notice shall be provided no later than the policy renewal date, except that no notice shall be required in connection with a policy renewal if:

(i) personal information is collected only from the policyholder or from public records; or

(ii) a notice meeting the requirements of this section has been given within the previous twenty-four months;

(3) in the case of a policy reinstatement or change in insurance benefits, a notice shall be provided no later than the time a request for a policy reinstatement or change in insurance benefits is received by the insurance institution, except that no notice shall be required if personal information is collected only from the policyholder or from public records.

(b) A notice required by subsection (a) shall be in writing and shall state:

(1) whether personal information may be collected from persons other than the individual proposed for coverage;

(2) the type of personal information that may be collected and the type of source and investigative technique that may be used to collect such information;

(3) the type of disclosure permitted by this chapter and the circumstances under which such disclosure may be made without prior authorization; provided, however, that only such circumstances need be described which occur with such frequency as to indicate a general business practice;

(4) a description of the rights established under sections eight, nine and ten and the manner in which such rights may be exercised; and

(5) that information obtained from a report prepared by an insurance-support organization may be retained by the insurance-support organization and disclosed to other persons.

(c) In lieu of the notice prescribed in subsection (b), the insurance institution or insurance representative may provide an abbreviated notice informing the applicant or policyholder that:

(1) personal information may be collected from a person other than the individual proposed for coverage;

(2) such information as well as other personal or privileged information subsequently collected by the insurance institution or insurance representative may in certain circumstances be disclosed to a third party without authorization;

(3) a right of access and correction exists with respect to all personal information collected; and

(4) the notice prescribed in subsection (b) shall be furnished to the applicant or policyholder upon request.

(d) The obligations imposed by this section upon an insurance institution or insurance representative may be satisfied by another insurance institution or insurance representative authorized to act on its behalf.

(e) Information collection and disclosure authorized pursuant to this chapter is limited to the practices described in the notice issued or available pursuant to this section.

Section 5. An insurance institution or insurance representative shall clearly specify questions designed to obtain information solely for marketing or research purposes from an individual in connection with an insurance transaction.

Section 6. Notwithstanding any general or special law to the contrary, no insurance institution, insurance representative or insurance-support organization may utilize as its disclosure authorization form in connection with insurance transactions a form or statement which authorizes the disclosure of personal or privileged information about an individual to the insurance institution, insurance representative or insurance-support organization unless the form or statement:

(1) is written in plain language;

(2) is dated;

(3) specifies the types of persons authorized to disclose information about the individual;

(4) specifies the nature of the information authorized to be disclosed;

(5) names the insurance institution or insurance representative and identifies by generic reference the representative of the insurance institution to whom the individual is authorizing information to be disclosed;

(6) specifies the purposes for which the information is collected;

(7) specifies the length of time such authorization shall remain valid, which shall be no longer than:

(A) in the case of authorizations signed for the purpose of collecting information in connection with an application for an insurance policy, a policy reinstatement or a request for change in policy benefits, thirty months from the date the authorization is signed; or

(B) in the case of authorizations signed for the purpose of collecting information in connection with a claim for benefits under an insurance policy:

(i) the term of coverage of the policy if the claim is for a health insurance benefit; or

(ii) the duration of the claim if the claim is not for a health insurance benefit; and

(8) advises the individual or a person authorized to act on behalf of such individual that such individual or the individual's authorized representative is entitled to receive a copy of the authorization form.

Section 7. (a) No insurance institution, insurance representative or insurance-support organization may prepare or request an investigative consumer report about an individual in connection with an insurance transaction involving an application for insurance, a policy renewal, a policy reinstatement or a change in insurance benefits unless the insurance institution or insurance representative informs the individual:

(1) that each individual may request to be interviewed in connection with the preparation of the investigative consumer report; and

(2) that upon a request pursuant to section eight, such individual is entitled to receive a copy of the investigative consumer report.

(b) If an investigative consumer report is to be prepared by an insurance institution or insurance representative, such insurance institution or insurance representative shall institute reasonable procedures to conduct a personal interview requested by an individual.

(c) If an investigative consumer report is to be prepared by an insurance-support organization, the insurance institution or insurance representative desiring such report shall inform the insurance-support organization whether a personal interview has been requested by the individual. The insurance-support organization shall institute reasonable procedures to conduct such reviews, if requested.

(d) No investigative consumer report shall contain any information designed to determine the sexual orientation of an applicant, proposed insured, policyholder, beneficiary or any other person, or for such persons, information relating to counseling for Acquired Immune Deficiency Syndrome (AIDS) or AIDS-related Complex (ARC) as defined by the Centers for Disease Control of the United States Public Health Service. For purposes of this subsection, "counseling" shall not mean diagnosis of or treatment for AIDS or ARC.

Section 8. (a) An insurance institution, insurance representative or insurance-support organization shall make any personal information collected or maintained in connection with an insurance transaction in its possession or control available to the individual to whom it refers, or to the authorized representative of such individual, as provided in this section.

(b) If any individual, after identification, submits a written request to an insurance institution, insurance representative or insurance-support organization for access to recorded personal information about such individual which is reasonably described by such individual and reasonably locateable and retrievable by the insurance institution, insurance representative or insurance-support organization, the insurance institution, insurance representative or insurance-support organization shall within thirty business days from the date such request is received:

(1) either provide such individual with a copy of such recorded personal information or inform such individual of the nature and substance of such recorded personal information in writing;

(2) permit such individual to see and copy, in person, such recorded personal information or to obtain a copy of such recorded personal information by mail, whichever the individual prefers, unless such recorded personal information is in coded form, in which case an accurate translation in plain language shall be provided in writing;

(3) disclose to such individual the identity, if recorded, of any person to whom the insurance institution, insurance representative or insurance-support organization has disclosed such personal information within two years prior to such request, and if such identity is not recorded, the names of insurance institutions, insurance representatives, insurance-support organizations or other persons to whom such information is normally disclosed; and

(4) provide such individual with a summary of the procedures by which such individual may request correction, amendment or deletion of recorded personal information.

(c) Any personal information provided pursuant to subsection (b) shall contain the name or identify the source, except that a source that is a natural person acting in a personal capacity need not be revealed if such confidentiality was specifically promised.

(d) Medical record information supplied by a medical care institution or medical professional and requested under subsection (b), together with the identity of the medical professional or medical care institution which provided such information, shall be supplied either directly to the individual or to a medical professional designated by such individual and licensed to provide medical care with respect to the condition to which the information relates, whichever such individual prefers. Mental health record information shall be supplied directly to such individual, pursuant to this section, only with the approval of the qualified professional person with treatment responsibility for the condition to which the information relates or another equally qualified mental health professional. Upon release of any medical or mental health record information to a medical professional designated by such individual, the insurance institution, insurance representative or insurance-support organization shall notify such individual, at the time of the disclosure, that it has provided the information to the medical professional.

(e) Except for personal information provided under section ten, an insurance institution, insurance representative or insurance-support organization may charge a reasonable fee to cover the costs incurred in providing a copy of recorded personal information to an individual but no other fee may be charged.

(f) The obligations imposed by this section upon an insurance institution or insurance representative may be satisfied by another insurance institution or insurance representative authorized to act on its behalf. With respect to the copying and disclosure of recorded personal information pursuant to a request under subsection (b), an insurance institution, insurance representative or insurance-support organization may make arrangements with an insurance-support organization or a consumer reporting agency to copy and disclose recorded personal information on its behalf so long as the insurance-support organization or consumer reporting agency has established and maintains procedures for maintenance of records to assure confidentiality.

(g) The rights granted to an individual in this section shall extend to a natural person to the extent information about such person is collected and maintained by an insurance institution, insurance representative or insurance-support organization in connection with an insurance transaction. The rights granted to a natural person by this subsection shall not extend to information about such person that relates to and is collected in connection with or in reasonable anticipation of a claim or civil or criminal proceeding involving such person.

(h) For the purpose of this section, the term "insurance support organization" shall not include "consumer reporting agency".

Section 9. (a) An individual to whom personal information refers has a right to have any factual error corrected and any misrepresentation or misleading entry amended or deleted as provided in this section.

(b) Within thirty business days from the date of receipt of a written request from an individual to correct, amend or delete any recorded personal information about such individual within its possession, an insurance institution, insurance representative or insurance-support organization shall either:

(1) correct, amend or delete the portion of the recorded personal information in dispute; or

(2) reinvestigate the disputed information and upon completion of such reinvestigation the insurance institution, insurance representative or insurance-support organization shall correct, amend or delete the portion of the recorded personal information in dispute or notify the individual of:

(i) its refusal to make such correction, amendment or deletion;

(ii) the reason for such refusal;

(iii) the individual's right to file a statement as provided in subsection (d); and

(iv) the individual's right to request review by the commissioner of insurance as provided by section fourteen.

(c) If the insurance institution, insurance representative or insurance-support organization corrects, amends or deletes recorded personal information in accordance with paragraph (1) of subsection (b), the insurance institution, insurance representative or insurance-support organization shall so notify the individual in writing and furnish the correction, amendment or fact of deletion to:

(1) any person who, according to the records of the insurance institution, insurance representative or insurance-support organization, has, within the preceding two years received such recorded personal information from the insurance institution, insurance representative or insurance-support organization, and any person specifically designated by the individual who may have, within the preceding two years, received such recorded personal information; provided, however, that this subsection shall apply only to personal information which is medical record information or which relates to the individual's character, general reputation, personal characteristics or mode of living;

(2) any insurance-support organization whose primary source of personal information is insurance institutions if the insurance-support organization has systematically received such recorded personal information from the insurance institution within the preceding seven years; provided, however, that the correction, amendment or fact of deletion need not be furnished if the insurance-support organization no longer maintains recorded personal information about the individual; and

(3) any insurance-support organization that furnished the personal information that has been corrected, amended or deleted.

(d) Whenever an individual disagrees with an insurance institution's, insurance representative's or insurance-support organization's refusal to correct, amend or delete recorded personal information, such individual shall be permitted to file with the insurance institution, insurance representative or insurance-support organization:

(1) a concise statement setting forth what such individual thinks is the correct, relevant or fair information; and

(2) a concise statement of the reasons why such individual disagrees with the insurance institution's, insurance representative's or insurance-support organization's refusal to correct, amend or delete recorded personal information.

(e) In the event an individual files a statement as described in subsection (d), the insurance institution, insurance representative or insurance-support organization shall:

(1) file the statement with the disputed personal information and provide a means by which anyone reviewing the disputed personal information will be made aware of the individual's statement and have access to it;

(2) in any subsequent disclosure by the insurance institution, insurance representative or insurance-support organization of the recorded personal information that is the subject of disagreement, clearly identify the matter in dispute and provide the individual's statement along with the recorded personal information being disclosed; and

(3) furnish the statement to the persons and in the manner specified in subsection (c).

(f) The rights granted to an individual in this section shall extend to a natural person to the extent information about such person is collected and maintained by an insurance institution, insurance representative or insurance-support organization in connection with an insurance transaction. The rights granted to a natural person by this subsection shall not extend to information about such person that relates to and is collected in connection with or in reasonable anticipation of a claim or civil or criminal proceeding involving such person.

(g) For purposes of this section, the term "insurance-support organization" shall not include "consumer reporting agency".

Section 10. (a) In the event of an adverse underwriting decision, the insurance institution or insurance representative responsible for the decision shall:

(1) either provide the applicant, policyholder or individual proposed for coverage with the specific reason for the adverse underwriting decision in writing or advise such person that upon written request such person may receive the specific reason in writing; and

(2) provide the applicant, policyholder or individual proposed for coverage with a summary of the rights established under subsection (b) and sections eight and nine.

(b) Upon receipt of a written request within ninety business days from the date of the mailing of notice or other communication of an adverse underwriting decision to an applicant, policyholder or individual proposed for coverage, the insurance institution or insurance representative shall furnish to such person within twenty-one business days from the date of receipt of such written request:

(1) the specific reason for the adverse underwriting decision, in writing, if such information was not initially furnished in writing pursuant to paragraph (1) of subsection (a); and

(2) the specific items of personal and privileged information that support such reason; provided, however, that:

(i) the insurance institution or insurance representative shall not be required to furnish specific items of privileged information if it has a reasonable suspicion, based upon specific information available for review by the commissioner, that the applicant, policyholder or individual proposed for coverage has engaged in criminal activity, fraud, or material misrepresentation; and

(ii) specific items of medical record information supplied by a medical care institution or medical professional shall be disclosed either directly to the individual about whom the information relates or to a medical professional designated by such individual and licensed to provide medical care with respect to the condition to which the information relates, whichever such individual prefers. Mental health record information shall be supplied directly to such individual, pursuant to this subsection, only with the approval of the qualified professional person with treatment responsibility for the condition to which the information relates or of another equally qualified mental health professional. Upon release of any medical or mental health record information to a medical professional designated by such individual, the insurance institution, insurance representative or insurance-support organization shall notify such individual, at the time of the disclosure, that it has provided the information to the medical professional; and

(3) the name and address of the source that supplied the specific items of information pursuant to paragraph (2) of subsection (b); except that a source that is a natural person acting in a personal capacity need not be revealed if confidentiality was specifically promised; provided, however, that the identity of any medical professional or medical-care institution shall be disclosed either directly to the individual or to the designated medical professional other than the one who initially supplied the information, whichever such individual prefers.

(c) The obligations imposed by this section upon an insurance institution or insurance representative may be satisfied by another insurance institution or insurance representative authorized to act on its behalf.

(d) When an adverse underwriting decision results solely from an oral request or inquiry, the explanation of reasons and summary of rights required by subsection (a) may be given orally.

Section 11. No insurance institution, insurance representative or insurance-support organization may seek information in connection with an insurance transaction concerning any previous adverse underwriting decision experienced by an individual unless such inquiry also requests the reasons for any previous adverse underwriting decision.

Section 12. No insurance institution or insurance representative may base an adverse underwriting decision in whole or in part:

(1) on the fact of a previous adverse underwriting decision or on the fact that an individual previously obtained insurance coverage through a residual market mechanism; provided, however, that an insurance institution or insurance representative may base an adverse underwriting decision on further information obtained from an insurance institution or insurance representative responsible for a previous adverse underwriting decision;

(2) on personal information received from an insurance-support organization whose primary source of information is insurance institutions; provided, however, that an insurance institution or insurance representative may base an adverse underwriting decision on further personal information obtained as the result of information received from such insurance-support organization; or

(3) on the basis of sexual orientation; provided, however, that neither the national origin, marital status, lifestyle or living arrangements, occupation, gender, medical history, beneficiary designation, nor zip code or other territorial classification of the applicant may be used to establish, or aid in establishing, the applicant's sexual orientation.

Section 13. An insurance institution, insurance representative or insurance-support organization shall not disclose any personal or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure is:

(1) with the written authorization of the individual, provided that:

(i) if such authorization is submitted by another insurance institution, insurance representative or insurance-support organization, the authorization meets the requirement of section six; or

(ii) if such authorization is submitted by a person other than an insurance institution, insurance representative or insurance-support organization, the authorization is:

(A) dated;

(B) signed by the individual; and

(C) obtained one year or less prior to the date a disclosure is sought pursuant to this subsection; or

(2) to a person other than an insurance institution, insurance representative or insurance-support organization; provided, however, that such disclosure is reasonably necessary:

(i) to enable such person to perform a specific business, professional or insurance function for the disclosing insurance institution, insurance representative or insurance-support organization and such person agrees not to disclose the information further without such individual's written authorization unless the further disclosure:

(A) would otherwise be permitted by this section if made by an insurance institution, insurance representative or insurance-support organization; or

(B) is reasonably necessary for such person to perform its specific business, professional or insurance function for the disclosing insurance institution, insurance representative or insurance-support organization; or

(ii) to enable such person to provide information to the disclosing insurance institution, insurance representative or insurance-support organization for the purpose of:

(A) determining an individual's eligibility for an insurance benefit or payment; or

(B) detecting or preventing criminal activity, fraud or material misrepresentation in connection with an insurance transaction; or

(3) to an insurance institution, insurance representative, or insurance-support organization; provided, however, that the information disclosed is limited to that which is reasonably necessary:

(i) to detect or prevent criminal activity, fraud or material misrepresentation in connection with insurance transactions; or

(ii) for the receiving or disclosing insurance institution, insurance representative or insurance-support organization to perform its function in connection with an insurance transaction involving an individual; provided, however, that the recipient of the information is prohibited from redisclosing the information without explicit written authorization according to the requirements of paragraph (1) or that the individual is notified, either concurrently with the application or otherwise prior to disclosure of the information, that the disclosure of the information may be made and can find if the disclosure has been made; or

(4) to a medical-care institution or medical professional for the purpose of:

(i) verifying insurance coverage or benefits; or

(ii) informing an individual of a medical problem of which the individual may not be aware; or

(iii) conducting an operations or services audit to verify the individuals treated by the medical professional or at the medical-care institution, provided only such information is disclosed as is reasonably necessary to accomplish the foregoing purposes; or

(5) to an insurance regulatory authority; or

(6) to a law enforcement or other governmental authority:

(i) to protect the interests of the insurance institution, insurance representative or insurance-support organization in preventing or prosecuting the perpetration of fraud upon it; or

(ii) if the insurance institution, insurance representative or insurance-support organization reasonably believes that illegal activities have been conducted by the individual; or

(7) otherwise permitted or required by law; or

(8) in response to a facially valid administrative or judicial order, including a search warrant or subpoena; or

(9) made for the purpose of conducting actuarial or research studies, provided that:

(i) no individual may be identified in any actuarial or research report;

(ii) information allowing the individual to be identified is removed to the extent practicable and where such removal is not practicable, is returned or destroyed as soon as it is no longer needed; and

(iii) the actuarial or research organization agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by an insurance institution, insurance representative or insurance-support organization and the disclosure is made in connection with such actuarial or research studies; or

(10) to a party or representative of a party to a proposed or consummated sale, transfer, merger or consolidation of all or part of the business of the insurance of the insurance institution, insurance representative or insurance-support organization, provided that:

(i) prior to the consummation of the sale, transfer, merger or consolidation only such information is disclosed as is reasonably necessary to enable the recipient to make business decisions about the purchase, transfer, merger or consolidation; and

(ii) the recipient agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by an insurance institution, insurance representative or insurance-support organization and the disclosure is made in connection with such sale, transfer, merger or consolidation; or

(11) to a person whose only use of such information will be in connection with the marketing of a product or service, provided that:

(1) no medical-record information, privileged information, or personal information relating to an individual's health, character, personal habits, mode of living or general reputation is disclosed, and no classification derived from such information is disclosed;

(2) the individual has been given an opportunity to indicate that he does not want personal information disclosed for marketing purposes and has given no indication that he does not want the information disclosed; and

(3) the person receiving such information agrees not to use it except in connection with the marketing of a product or service; or

(12) to an affiliate whose only use of the information will be in connection with an audit of the insurance institution or insurance representative or the marketing of an insurance product or service; provided, however, that the affiliate agrees not to disclose the information for any other purpose or to unaffiliated persons; or

(13) by a consumer reporting agency; provided, however, that the disclosure is to a person other than an insurance institution or insurance representative; or

(14) to a group policyholder for the purpose of reporting claims experience or conducting an audit of the insurance institution's or insurance representative's operations or services; provided, however, that the information disclosed is reasonably necessary for the group policyholder to conduct the review or audit; or

(15) to a professional peer review organization for the purpose of reviewing the service or conduct of a medical-care institution or medical professional; or

(16) to a governmental authority for the purpose of determining the individual's eligibility for health benefits for which the governmental authority may be liable; or

(17) to a certificate holder or policyholder for the purpose of providing information regarding the status of an insurance transaction; or

(18) to a lienholder, mortgagee, assignee, lessor or other person shown on the records of an insurance institution or insurance representative as having a legal or beneficial interest in a policy of insurance; provided, however, that:

(i) no medical-record information is disclosed unless the disclosure would otherwise be permitted by this section; and

(ii) the information disclosed is limited to that which is reasonably necessary to permit such person to protect its interests in such policy.

Section 14. (a) The commissioner shall have power to examine and investigate into the affairs of every insurance institution or insurance representative doing business in the commonwealth to determine whether such insurance institution or insurance representative has been or is engaged in any conduct in violation of this chapter.

(b) The commissioner shall have the power to examine and investigate into the affairs of every insurance-support organization acting on behalf of an insurance institution or insurance representative which either transacts business in the commonwealth or transacts business outside the commonwealth that has an effect on a person residing in the commonwealth in order to determine whether such insurance-support organization has been or is engaged in any conduct in violation of this chapter.

Section 15. (a) Whenever the commissioner has reason to believe that an insurance institution, insurance representative or insurance-support organization has been or is engaged in conduct in the commonwealth which violates this chapter, or if the commissioner believes that an insurance-support organization has been or is engaged in conduct outside the commonwealth which has an effect on a person residing in the commonwealth and which violates this chapter, the commissioner shall issue and serve upon such insurance institution, insurance representative or insurance-support organization a statement of charges and notice of hearing to be held at a time and place fixed in the notice, the date of such hearing shall be not less than twenty-one business days after the date of service.

(b) At the time and place fixed for such hearing the insurance institution, insurance representative or insurance-support organization charged shall have an opportunity to answer the charges against it and present evidence on its behalf. Upon good cause shown, the commissioner shall permit any adversely affected person to intervene, appear and be heard at such hearing by counsel or in person.

(c) At any hearing conducted pursuant to this section the commissioner may administer oaths, examine and cross-examine witnesses and receive oral and documentary evidence. The commissioner shall have the power to subpoena witnesses, compel their attendance and require the production of books, papers, records, correspondence and other documents which are relevant to the hearing. A stenographic record of the hearing shall be made upon the request of any party or at the discretion of the commissioner. If no stenographic record is made and if judicial review is sought, the commissioner shall prepare a statement of the evidence for use on the review. Hearings conducted under this section shall be governed by the same rules of evidence and procedure applicable to administrative proceedings conducted under the laws of the commonwealth.

(d) Statements of charges, notices, orders and other processes of the commissioner under this chapter may be served by anyone duly authorized to act on behalf of the commissioner. Service of process may be completed in the manner provided by law for service of process in civil actions or by registered mail. A copy of the statement of charges, notice, order or other process shall be provided to the person or persons whose rights under this chapter have been allegedly violated. A verified return setting forth the manner of service, or return postcard receipt in the case of registered mail, shall be sufficient proof of service.

Section 16. For the purpose of this chapter, an insurance-support organization transacting business outside the commonwealth which has an effect on a person residing in the commonwealth shall be deemed to have appointed the commissioner to accept service of process on its behalf; provided, however, that the commissioner causes a copy of such service to be mailed forthwith by registered mail to the insurance-support organization at its last known principal place of business. The return postcard receipt for such mailing shall be sufficient proof that the same was properly mailed by the commissioner.

Section 17. (a) If, after a hearing pursuant to section fifteen, the commissioner finds that the insurance institution, insurance representative or insurance-support organization charged has engaged in conduct or practices in violation of this chapter, the commissioner shall put such findings in writing and shall issue and cause to be served upon such insurance institution, insurance representative or insurance-support organization a copy of such findings and an order requiring such insurance institution, insurance representative or insurance-support organization to cease and desist from the conduct or practices constituting a violation of this chapter.

(b) If, after a hearing pursuant to section fifteen, the commissioner determines that the insurance institution, insurance representative or insurance-support organization charged has not engaged in conduct or practices in violation of this chapter, the commissioner shall prepare a written report which sets forth findings of fact and conclusions of law. Such report shall be served upon the insurance institution, insurance representative or insurance-support organization charged and upon the person or persons, if any, whose rights under this chapter were allegedly violated.

(c) Until the expiration of the time allowed under section nineteen for filing a petition for review or until such petition is actually filed, whichever occurs first, the commissioner may modify or set aside any order or report issued under this section. After the expiration of the time allowed under section nineteen for filing a petition for review, if no such petition has been duly filed, the commissioner may, after notice and opportunity for hearing, alter modify or set aside, in whole or in part, any order or report issued under this section whenever conditions of fact or law warrant such action or if the public interest so requires.

Section 18. (a) In any case where a hearing pursuant to section fifteen results in the findings of a knowing violation of this chapter, the commissioner may, in addition to the issuance of a cease and desist order as prescribed in section seventeen, order payment of a monetary penalty of not more than one thousand dollars for each such violation; provided, however, that:

(1) in a hearing to which an insurance representative is a party, the monetary penalty imposed against such insurance representative shall not exceed ten thousand dollars in the aggregate for multiple violations; and

(2) in a hearing to which an insurance institution or insurance-support organization is a party, the monetary penalty imposed against such insurance institution or insurance-support organization shall not exceed fifty thousand dollars in the aggregate for multiple violations.

(b) Any person who violates a cease and desist order of the commissioner under section seventeen may, after notice and hearing and upon order of commissioner, be subject to one or more of the following penalties, at the discretion of the commissioner:

(1) a monetary fine of not more than ten thousand dollars for each such violation;

(2) a monetary fine of not more than fifty thousand dollars if the commissioner finds that such violation has occurred with such frequency as to constitute a general business practice; or

(3) suspension or revocation of an insurance institution's or insurance representative's license.

Section 19. (a) Any person subject to an order of the commissioner under section seventeen or section eighteen or any person whose rights under this chapter were allegedly violated may obtain a review of any order or report of the commissioner by filing in the supreme judicial court, within twenty days from the date of the service of such order or report, a written petition requesting that the order or report of the commissioner be set aside. A copy of such petition shall be simultaneously served upon the commissioner, who shall forthwith certify and file in such court a transcript of the entire record of the proceeding giving rise to the order or report which is the subject of the petition. Upon filing of the petition and transcript, the supreme judicial court shall have jurisdiction to make and enter a decree modifying, affirming or reversing any order or report of the commissioner, in whole or in part. The findings of the commissioner as to the facts supporting any order or report, if supported by clear and convincing evidence, shall be conclusive.

(b) To the extent an order or report of the commissioner is affirmed, the court shall issue its own order commanding obedience to the terms of the order or report of the commissioner. If any party affected by an order or report of the commissioner shall apply to the court for leave to produce additional evidence and shall show to the satisfaction of the court that such additional evidence is material and that there are reasonable grounds for the failure to produce such evidence in prior proceedings, the court may order such additional evidence to be taken before the commissioner in such manner and upon such terms and conditions as the court may deem proper. The commissioner may modify his findings of fact or make new findings by reason of the additional evidence so taken and shall file such modified or new findings along with any recommendation, if any, for the modification or revocation of a previous order or report. If supported by clear and convincing evidence, the modified or new findings shall be conclusive as to the matters contained therein.

(c) An order or report issued by the commissioner under sections seventeen or eighteen shall become final:

(1) upon the expiration of the time allowed for the filing of a petition for review, if no such petition has been duly filed; except that the commissioner may modify or set aside an order or report to the extent provided in subsection (c) of section seventeen; or

(2) upon a final decision of the supreme judicial court if the court directs that the order or report of the commissioner be affirmed or the petition for review dismissed.

(d) No order or report of the commissioner under this chapter or order of a court to enforce the same shall in any way relieve or absolve any person affected by such order or report from any liability under any law of the commonwealth.

Section 20. (a) If any insurance institution, insurance representative or insurance-support organization fails to comply with sections eight, nine or ten with respect to the rights granted under said sections, any person whose rights are violated may apply to the superior court, or any other court of competent jurisdiction, for appropriate equitable relief.

(b) An insurance institution, insurance representative or insurance-support organization which discloses information in violation of section thirteen shall be liable for special and compensatory damages sustained by the individual to whom the information relates.

(c) In any action brought pursuant to this section, the court may award the cost of the action and reasonable attorney's fees to the prevailing party.

(d) An action under this section must be brought within two years from the date the alleged violation is or should have been discovered.

(e) Except as specifically provided in this section, there shall be no remedy or recovery available to an individual, in law or in equity, for an occurrence constituting a violation of any provisions of this chapter.

Section 21. No cause of action in the nature of defamation, invasion of privacy or negligence shall arise against any person for disclosing personal or privileged information in accordance with this chapter; provided, however, this section shall provide no immunity:

(1) for any person who discloses false information with malice or willful intent to injure any person; or

(2) for any person who misidentifies an individual as the subject of information and who discloses such misidentified information to others.

Section 22. Any person who knowingly and willfully obtains information about an individual from an insurance institution, insurance representative or insurance-support organization under false pretenses shall be fined not more than ten thousand dollars or imprisoned for not more than one year, or both such fine and imprisonment.

SECTION 2. The provisions of sections eight, nine and thirteen of chapter one hundred and seventy-five H of the General Laws, inserted by section one of this act, shall apply to rights granted therein regardless of the date of collection or receipt of the information which is the subject of such sections.

SECTION 3. This act shall take effect on July first, nineteen hundred and ninety-two.

SECTION 4. The provisions and scope of this act shall not extend to property casualty insurers or property casualty insurance representatives.