211 CMR 36.00T — THE USE OF HIV-RELATED INFORMATION FOR LIFE AND HEALTH INSURANCE AND INFORMED CONSENT

211 CMR: DIVISION OF INSURANCE 211 CMR: 36.00: THE USE OF HIV-RELATED INFORMATION FOR LIFE AND HEALTH INSURANCE AND INFORMED CONSENT

Section

36.01: Purpose and Scope 36.02: Definitions 36.03: Prohibited Practices 36.04: Informed Consent 36.05: Disclosure of Positive HIV Test Results to Tested Individuals 36.06: Carrier Confidentiality Requirements 36.07: Applications 36.08: Penalties 36.09: Severability

211 CMR 36.00T THE USE OF HIV-RELATED INFORMATION FOR LIFE AND HEALTH INSURANCE AND INFORMED CONSENT

36.01 Purpose and Scope

36.01: Purpose and Scope

The purpose of 211 CMR 36.00 is to ensure that individuals who seek or obtain life and health insurance coverage (including disability insurance coverage) are not unfairly discriminated against, are fully informed of the extent to which HIV-related information is used by carriers, of the implications of HIV-related testing and to ensure that the confidentiality of such information is maintained by carriers, insurance producers and those persons or entities that act on their behalf in connection with insurance transactions. 211 CMR 36.00 applies to any testing for HIV or use of HIV-related information for insurance purposes.

36.02 Definitions

36.02: Definitions

The following words as used in 211 CMR 36.00 shall, unless the context clearly requires otherwise, have the following meanings:

AIDS, Acquired Immune Deficiency Syndrome as defined by the Centers for Disease Control and Prevention.

Carrier, any company as defined in M.G.L. c. 175, § 1 (or any life, health or disability insurance affiliate); any fraternal benefit society as defined in M.G.L. c. 176, § 1; any hospital service corporations defined in M.G.L. c. 176A, § 1; any medical service corporation as defined in M.G.L. c. 176B, § 1; any medical service plan as defined in M.G.L. c. 176C, § 1; any dental service corporation as defined in M.G.L. c. 176E, § 1; any optometric service corporation as defined in M.G.L. c. 176F, § 1; and any health maintenance organization licensed under M.G.L. c. 176G, § 1.

Commissioner, the Commissioner of Insurance, appointed pursuant to M.G.L. c.26, §6, or his or her designee.

HIV, Human Immunodeficiency Virus, which has been identified as the probable causative agent of AIDS. For purposes of 211 CMR 36.00, the definition of HIV will include but not be limited to AIDS.

HIV-related Information, any information concerning an individual’s diagnosis or treatment for HIV and other information relating to HIV as HIV is defined in 211 CMR 36.02. HIV-related information

211 CMR: DIVISION OF INSURANCE includes HIV test information reported to the MIB or any other insurance support organization under any code.

Individual, any natural person who is a resident of the commonwealth, including a parent or legal guardian of any minor or incompetent person and who:

(a) is a past, present or proposed named principal insured or certificate holder of life or health insurance; (b) is a past, present or proposed policyowner of life or health insurance; (c) is a past or present applicant of life or health insurance; (d) is a past or present claimant of life or health insurance; or (e) derived, derives or is proposed to derive insurance coverage under a life or health insurance policy or certificate.

Insurance Producer, a producer, adjuster or other person conducting activities referred to in M.G.L. c. 175, §§ 162 through 177 and insurance advisors as defined in M.G.L. c. 175, §§ 177A through 177D.

Insurance Support Organization, any person or entity, including but not limited to the MIB as defined in 211 CMR 36.02, that regularly engages, in whole or in part, in the practice of assembling or collecting information about natural persons and that provides the information to a carrier or insurance producer for insurance transactions, including:

(a) the furnishing of consumer reports or investigative consumer reports to a carrier or insurance producer for use in connection with an insurance transaction; or (b) the collection of personal or medical information from carriers, insurance producers or other insurance support organizations for the purpose of detecting or preventing fraud, material misrepresentation or material nondisclosure in connection with insurance underwriting or insurance claim activity.

MIB, the Medical Information Bureau, Inc., the nonprofit incorporated association which operates an information exchange on behalf of its member life and health carriers, and which constitutes an insurance support organization as defined in 211 CMR 36.02.

Positive Test Result, a positive test result on an HIV test.

36.03 Prohibited Practices

36.03: Prohibited Practices

(1) HIV-related information must be treated as highly confidential. No carrier, insurance producer or employee thereof shall communicate information regarding an HIV test, the results of any such test or any other HIV- related information to any person, unless such communication is lawful and such communication is made with the written authorization of the individual to whom the information relates.

(2) No carrier shall request or require that an individual undergo an HIV test unless the carrier has obtained prior written informed consent from the individual in compliance with the requirements of 211 CMR 36.04.

(3) A carrier may request or require an individual to submit to an HIV test only on a basis that is not unfairly discriminatory.

211 CMR: DIVISION OF INSURANCE (4) A carrier or insurance producer which learns or has reason to believe that its employee or any other person acting with authority on its behalf has violated the provisions of 211 CMR 36.00 shall immediately investigate the situation and take such prompt disciplinary, enforcement or other corrective action as may be required. Carriers and insurance producers shall maintain records of such violations and the corrective actions taken in a file which shall be made available to the Division of Insurance upon its request.

(5) A carrier or insurance producer shall comply with the procedures and practices set forth when informed consent is obtained pursuant to 211 CMR 36.00.

36.04 Informed Consent

36.04: Informed Consent

(1) Before a carrier may conduct an HIV test, the individual to be tested must give prior written informed consent to such testing to the carrier, laboratories and blood testing centers or agents in compliance with the requirements of 211 CMR 36.04. Such consent shall be based on an understanding by the individual to be tested that the test is being performed, of the nature of the test, of the persons or entities which will or may have access to the test results or to which the results of that test may be disclosed, of the purpose for which the test results may be used, and of any reasonably foreseeable risks and benefits resulting from the test.

(2) Such informed consent shall include, at a minimum, the following disclosures: (a) The carrier shall provide to the individual the following information in writing:

1. notification of the purpose(s) of the HIV test(s), including whether the test is required as a condition of obtaining an insurance benefit;
2. information concerning the effect(s) of the test result(s) on the approval of the application, or the risk classification of the individual;
3. information explaining HIV and AIDS, including without limitation, the following: a. the nature of the HIV test(s), including the name(s) of the test(s) to be performed, and the degree of reliability of each of the tests, including the risks of false negative results and false positive results; b. the meaning of the results of the test(s), including the implication of a positive HIV test result for developing AIDS, a description of HIV and AIDS, its major risk groups, symptoms, and the potential for adverse psychological effects to the individual upon being tested and upon learning of a positive test result;
4. a description of the carrier’s confidentiality standards and procedures, including full disclosure of any potential use that may be made of the test results or HIV-related information about the individual, and the extent to which the carrier restricts access to such results and information;
5. a complete description of the persons or entities which may reasonably be expected to have access to the test results or any other HIV-related information about the individual as permitted under 211 CMR 36.00 and the purposes for which such results or information would be provided to such persons or entities;
6. a statement concerning the availability of free, anonymous or confidential HIV testing, with the opportunity for both pre-test and post-test counseling;
7. a statement that the individual may wish to obtain counseling before undergoing the HIV test because of the serious nature of HIV and AIDS, and that if an individual waits to sign the consent form for up to 21 days from the date the test was requested

211 CMR: DIVISION OF INSURANCE by the carrier or insurance producer, absent changes in underwriting factors, that delay will not prejudice the application for insurance benefits; 8. a statement that HIV-related information concerning the individual maintained by the carrier will be available to the individual directly, or indirectly through a designated physician if preferred by the individual, upon his or her written request, and at no more than the reasonable cost of photocopying; and 9. a statement that if the individual believes that his or her rights concerning the confidentiality of HIV-related information have been violated he or she may contact the Division of Insurance. (b) The carrier shall furnish the individual with a copy of the notice of HIV testing and authorization for testing and disclosure, including the signed and dated authorization in conformity with the requirements of 211 CMR 36.04.

(3) Content of the Authorization. An authorization form must contain the following minimum information: (a) that the authorization to conduct an HIV test is valid for a period of not longer than 90 days after the date on which the informed consent form is signed, or for such lesser period as the carrier may select; (b) a description of the test protocol, including the name(s) of the test(s) to be performed, the laboratory or laboratories which will conduct the test or which customarily conduct such tests for the carrier, the carrier which will receive the test results, and the purpose(s) of the test(s); (c) a statement that the test results will not be released to any person or entity other than those described in the consent form (which persons and entities shall consist only of those persons or entities to which release of such confidential medical information is lawful), unless the carrier obtains the specific prior written consent of the individual, which consent may not be sought in this consent form; further, any statement that information will be shared with the MIB or any other insurance support organization must describe that organization, its policy of disclosure to other carriers, its policy concerning consumer access to information and the process by which consumers can correct inaccurate information, and include that organization's address and telephone number; (d) a statement that HIV-related information will be disclosed only to persons and entities for which prior written informed consent to the release has been given, and that in the event of such a release of HIV-related information concerning the individual to any person or entity other than the carrier, its employees, reinsurers, attorneys, and contractors solely on a need to know bases for use for underwriting, claims or another business purpose in connection with the insurance transaction, or any insurance support organization, the carrier will notify the individual in writing of the name and address of such person or entity, and subject to 211 CMR 36.04(3)(e), upon the request of the individual, will promptly provide to the individual a copy of the information released at no more than the reasonable cost of photocopying; and (e) a description of the methods by which the carrier shall notify the individual of a positive HIV test result, and the time period, which shall be as expeditiously as possible, but in no event later than 45 days after the individual's blood sample is taken, by which such test results will be conveyed in accordance with 211 CMR 36.05. The description shall offer the individual the option to receive the information from a physician he or she designates on the form, or directly from the carrier, and shall inform the individual that such information sent to the physician may become part of the physician's permanent medical record concerning that individual. The individual may change his or her election by so informing the carrier in writing.

211 CMR: DIVISION OF INSURANCE (4) A carrier shall use a notice of HIV testing and authorization for testing and disclosure form that contains at a minimum the information specified in 211 CMR 36.04(2) and (3). Copies of all such forms shall be retained on file by the carrier and shall be available to the Division upon its request.

36.05 Disclosure of Positive Test Results to Tested Individual

36.05: Disclosure of Positive Test Results to Tested Individual

(1) A carrier which requires or requests that any individual submit to an HIV test shall notify that individual of a positive test result as expeditiously as possible, but in no event later than 45 days after the individual's blood sample is taken. Such test result disclosure shall be made in either of the following ways, at the option of the individual: (a) Notification through the designated physician. A carrier may encourage an individual to obtain results through his or her physician rather than directly. If the individual selects this option and authorizes disclosure of the positive test result to a physician, and has not informed the carrier in writing of a revocation of the election, the carrier shall send the HIV test results to the designated physician, together with the following statement regarding the confidentiality of HIV test results: In addition to any current privacy safeguards applying to medical information generally, Massachusetts state law prohibits you from:

1. disclosing the results of HIV tests to any person other than the individual tested without first obtaining that individual's written informed consent; and
2. identifying the individual tested to any person without first obtaining that individual's written informed consent. (b) Direct notification to the individual. If the individual selects this option, the carrier shall mail a certified letter delivered in a plain envelope, marked "Personal and Confidential" to the individual's address. The letter shall include, at a minimum, information concerning HIV and AIDS information resources, available on the Massachusetts Department of Public Health, Office of HIV/AIDS website, www.mass.gov/eohhs/gov/department/dph/programs/id/hiv-aids/ , that the individual may wish to contact for further information about the positive test result.

(2) Any individual shall be entitled, upon request, to receive directly from the carrier at no more than the reasonable cost of duplicating any such documents, any HIV-related information collected or maintained by the carrier about that individual and shall not be required to obtain such information indirectly through a physician, other medical provider, the MIB or any insurance support organization or any other mechanism, unless he or she has previously so designated and has not revoked that request in writing.

(3) If any individual, upon receiving copies of such HIV-related information, believes it to be incorrect, he or she may contact the carrier and seek a correction in accordance with the procedures outlined in the Federal Fair Credit Reporting Act or other applicable provisions of law.

36.06 Carrier Confidentiality Requirements

36.06: Carrier Confidentiality Requirements

(1) A carrier shall implement reasonable internal safeguards to protect the privacy of HIV-related information including any request that an individual submit to an HIV test, the carrier’s basis for requesting such a test, any refusal or agreement to submit to a test, and any HIV test result. These internal confidentiality standards shall meet the following minimum requirements:

211 CMR: DIVISION OF INSURANCE (a) the standards shall be in writing, and shall be available to the Division upon request; (b) the carrier shall designate a specific person(s) to have responsibility for maintaining the confidentiality of HIV-related information; (c) each employee, insurance producer or other person or entity authorized to act on behalf of the carrier who may have access to HIV-related information shall be informed in writing of the carrier’s confidentiality standards to the extent reasonably necessary to protect the confidentiality of the HIV- related information; (d) the standards shall specify that no person shall have access to HIV- related information except those persons designated in accordance with 211 CMR 36.00; (e) the standards shall ensure that HIV-related information, whether stored in electronic or paper format, is protected by reasonable security safeguards; and (f) the standards shall ensure that HIV-related information shall be accessible only to the minimum necessary number of those persons or entities designated to have access pursuant to 211 CMR 36.04(2)(a)4., 5. and (3)(c) and (d).

(2) Carriers shall be required to notify an individual of any disclosure of HIV-related information to any of the designated persons or entities other than the carrier, its employees, reinsurers, attorneys, and contractors solely on a need to know basis for use for underwriting, claims or another business purpose in connection with the insurance transaction, or any insurance support organization. This disclosure shall include the name and address of the person or entity receiving the information. Individuals should be informed of this policy pursuant to 211 CMR 36.04(3)(d).

(3) A carrier or insurance producer shall be required to notify an individual of any subpoena for the company's records relating to HIV-related information concerning that individual, which notice shall be given as soon as possible, and before responding to the subpoena with an opportunity for the individual to object to such disclosure.

(4) A carrier or insurance producer may be subject to sanctions by the Division in the event of any breach of confidentiality made by any person or entity acting on its behalf, including without limitation, any laboratory, contractor whose purpose is to provide underwriting or claims services in connection with the insurance transaction, insurance support organization, reinsurer or attorney.

36.07 Applications

36.07: Applications

(1) Carriers and insurance producers are prohibited from requesting any information related to: (a) counseling about HIV or AIDS, or (b) the sexual orientation of the individual, or any applicant, proposed insured, policyholder or beneficiary, including questions relating to proxies for sexual orientation.

(2) A carrier may request an individual to disclose whether he or she has received a positive HIV test result (other than an anonymous result obtained through an HIV counseling and testing site), whether he or she has received a medical diagnosis of, or medical treatment for HIV infection or AIDS by a medical professional, and information about such diagnosis or treatment.

(3) Carriers are permitted to ask questions on application forms that are diagnostic or factual in nature, concerning whether an individual has been diagnosed or treated for HIV infection or AIDS. Questions that are subjective, vague, unfairly discriminatory, overly technical or that ask for the applicant's opinion are not permitted.

211 CMR: DIVISION OF INSURANCE

36.08 Penalties

36.08: Penalties

(1) A violation of any provisions of 211 CMR 36.00 by any carrier, insurance producer or employee, authorized agent or representative thereof, shall be considered to be an unfair or deceptive act or practice on the part of such carrier, insurance producer or employee in violation of M.G.L. c. 176D.

(2) A violation of any provision of 211 CMR 36.00 by any carrier, insurance producer or employee or authorized agent or representative thereof may be grounds for the imposition of sanctions upon such carrier, insurance producer or employee including without limitation, suspension or revocation of the license of such person or entity.

36.09 Severability

36.09: Severability

If any section or portion of a section of 211 CMR 36.00 or the applicability thereof to any person, entity or circumstance is held invalid by a court, the remainder of 211 CMR 36.00 or the applicability of such provision to other persons, entities or circumstances shall not be affected thereby.

REGULATORY AUTHORITY

211 CMR 36.00: M.G.L. chs. 175; 176; 176A; 176B; 176C; 176D; 176E; 176F; and 176G.

.