Sec. 38a-999. Written policies, standards and procedures re medical record information.
Sec. 38a-999. Written policies, standards and procedures re medical record
information. (a) An insurance institution, agent or insurance support organization that
regularly collects, uses or discloses medical record information, as defined in subsection
(r) of section 38a-976, shall develop and implement written policies, standards and
procedures for the management, transfer and security of medical record information,
including policies, standards and procedures to guard against the unauthorized collection, use or disclosure of medical record information by the insurance institution, agent
or insurance support organization or any employee or agent thereof. Such policies, standards and procedures shall include:
(1) Limitation on access to medical record information by only those persons who
need to use the medical record information in order to perform their jobs;
(2) Appropriate training for all employees identified in subdivision (4) of this subsection;
(3) Disciplinary measures for violations of the medical record information policies,
standards and procedures;
(4) Identification of the job titles of persons that are authorized to use or disclose
medical record information;
(5) Procedures for authorizing and restricting the collection, use or disclosure of
medical record information;
(6) Methods for handling, disclosing, storing and disposing of medical record information;
(7) Periodic monitoring of the employees' compliance with the policies, standards
and procedures in a manner sufficient for the insurance institution, agent or insurance
support organization to determine compliance with this section and to enforce its policies, standards and procedures; and
(8) Additional protection against unauthorized disclosure of sensitive health information, which shall include information regarding: Sexually transmitted diseases; mental health; substance abuse; the human immunodeficiency virus and acquired immune
deficiency syndrome; and genetic testing, including the fact that an individual has undergone a genetic test.
(b) An insurance institution, agent or insurance support organization shall make the
medical record information policies, standards and procedures developed pursuant to
this section available for review by the Insurance Commissioner.
(c) A summary of such policies, standards and procedures shall be made available
to enrollees upon enrollment and upon request.
(P.A. 99-284, S. 25, 60.)
History: P.A. 99-284 effective July 1, 2000.