Health Care Communication Laws in the United States, 2013: Implications for Access to Sensitive Services for Insured Dependents

Abstract

Young adults may not seek sensitive health services when confidentiality cannot be ensured. To better understand the policy environment for insured dependent confidentiality, we systematically assessed legal requirements for health insurance plan communications using WestlawNext to create a jurisdiction-level data set of health insurance plan communication regulations as of March 2013. Two jurisdictions require plan communications be sent to a policyholder, 22 require plan communications to be sent to an insured, and 36 give insurers discretion to send plan communications to the policyholder or insured. Six jurisdictions prohibit disclosure, and 3 allow a patient to request nondisclosure of certain patient information. Our findings suggest that in many states, health insurers are given considerable discretion in determining to whom plan communications containing sensitive health information are sent. Future research could use this framework to analyze the association between state laws concerning insured dependent confidentiality and public health outcomes and related sensitive services.

Insured dependents (any person insured under another’s health insurance plan) in the United States may have unique challenges in accessing sensitive health care services, given current health insurance billing and administrative practices. These practices may disclose an insured dependent’s confidential health information when insurance plan communications (eg, explanation of benefit forms [EOBs]) are sent to policyholders.¹ Research has shown that minor and young adult dependents may not seek health care, including sexually transmitted disease (STD) and reproductive health care services, if their parents are likely to find out.^2–5 This may have public health implications because minors and young adults face a disproportionate risk of STD⁶ and unintended pregnancy.⁷ Provisions of the Affordable Care Act (ACA) can be expected to increase this population’s access to certain STD and reproductive health services (notably the provisions requiring coverage of various preventive services with no cost sharing⁸ and the coverage of dependents up to the age of 26 years on parents’ plans⁹). However, health insurer practices may not ensure confidentiality for these visits.

Some resources describe state laws for health insurance plan communications. Namely, the Guttmacher Institute reviewed US state laws that regulate EOBs and protect confidentiality for insured dependents.¹⁰ This study extends previous research to provide a systematic analysis of state laws concerning health insurance billing processes in order to facilitate research, including a specific focus on to whom plan communications must be sent.

Methods

WestlawNext¹¹ (Thompson Reuters, New York City, New York) was used to systematically collect statutes and regulations (as of March 2013) pertaining to private insurance plan communications (those requiring or authorizing health insurance plan communications to be sent or prohibit disclosure of sensitive health information) from all 50 US states and the District of Columbia. Potentially applicable laws that pertained only to publicly administered programs (eg, Medicaid) or supplemental health insurance plans were excluded, as they entail different requirements compared with private insurance plans. In addition, the risk of disclosures under publicly administered programs is generally regarded as lower than it is under private plans.¹² Legal measures were developed for (1) events that trigger insurance plan communications, (2) those to whom communications must be sent, (3) prohibitions on disclosure of health information, and (4) a patient’s ability to request nondisclosure of his or her health information. Special emphasis was placed upon to whom communications must be sent, and whether discretion existed, as this is central to whether a communication may lead to an inadvertent disclosure. This variable was coded as follows: (1) a policyholder, (2) an insured, or (3) a policyholder or an insured. We used the following standard legal definition of “insured”: “A person who is covered or protected by an insurance policy.”¹³ Four potential “triggering events” for sending plan communications were identified: (1) claim submissions—claim sent from a provider has been received by the health insurer; (2) claim acceptances—claim is ready for payment determination; (3) claim denials—a decision to not pay a claim; and (4) requests for more information—more information is needed to process a claim. One researcher coded all jurisdictions, with double-coding in 5 states to ensure reliability (90.6% agreement on preliminary code with k = 0.90; 100% after reconciliation). To provide for national estimates and quantify the comprehensiveness of regulation within jurisdictions, we calculated frequencies for each type of law and event that trigger a disclosure within jurisdictions.

Results

Every US jurisdiction had laws concerning insurance plan communications, although considerable variation existed across jurisdictions. Only 2 jurisdictions (Maine and Texas) explicitly require that plan communications be sent to the policyholder (Figure 1). Twenty-two jurisdictions (43.1%) require plan communications to be sent to an “insured.” Thirty-six jurisdictions (69.2%) give the insurer discretion to send a plan communication to the policyholder or insured.

FIGURE 1.

Jurisdictions That Require Plan Communications to be Sent to the Policyholder, Insured, or Gives Insurer Discretion to Send to Either a Policyholder or an Insured

Jurisdictions ranged from permitting or requiring health plan communications be sent under 0 to 6 different triggering events that could lead to inadvertent disclosure (see Supplemental Digital Content Figure 2, available at: http://links.lww.com/JPHMP/A216). Of jurisdictions that required health plan communications, 11 (21.6%) required communications upon the submission of a claim, 7 (13.7%) upon the acceptance of a claim, 18 (35.3%) upon the denial of a claim, and 8 (15.7%) required communications when additional information was needed. Of jurisdictions that authorized communications, 9 (17.6%) authorized communications upon the submission of a claim, 34 (66.7%) upon the acceptance of a claim, 6 (11.8%) upon the denial of a claim, and 12 (23.5%) authorized communications when additional information was needed.

Six jurisdictions (11.8%) have laws that explicitly prohibit the divulgence of a patient’s receipt of STD services (see Supplemental Digital Content Figure 3, available at: http://links.lww.com/JPHMP/A217). However, New Mexico is the only jurisdiction where the prohibition applies to nonminors. Two jurisdictions (Connecticut and Delaware) specifically require that the minor pay for the STD services in full out-of-pocket. Two jurisdictions (Washington and Hawaii) allow patients to request that their health information remain confidential (see Supplemental Digital Content Figure 4, available at: http://links.lww.com/JPHMP/A218). Only Washington allows a non-minor to make such a request. With the exception of Washington, all laws that limit disclosures or allow patients to request that their health information remain confidential apply exclusively to health care providers and facilities (ie, not an insurer).

Discussion

Although every jurisdiction has at least 1 law pertaining to health insurance plan communications, the conditions that trigger mandatory communications vary significantly across jurisdictions and frequently do not specify to whom plan communications must be sent. Since the definition of “insured” likely applies to anyone covered under a plan, insurers often have discretion to choose who receives plan communications: in 43 jurisdictions (84.3%), the insurer may send plan communications to an insured, or to a policyholder or an insured. This discretion is important because, in these jurisdictions, an insurer potentially has the choice to send communications to the insured dependent directly (ie, confidentially) or to the policyholder. To validate the research, we compared our results and the results of a similar prior analysis¹⁰; this analysis included all relevant laws from the previous analysis as well as laws not previously identified. Consistent with prior research, there are relatively few jurisdictions that require plan communications be sent to a policyholder (ie, unavoidably may result in an inadvertent disclosure).

Jurisdictions most frequently required plan communications upon a claim denial, while most frequently authorized plan communications upon an acceptance (see Supplemental Digital Content Figure 2, available at: http://links.lww.com/JPHMP/A216). This likely occurs because denials almost certainly result in financial liability for the consumer, thus requiring notification. An analysis of Supplemental Digital Content Figure 2 (available at: http://links.lww.com/JPHMP/A216) of how often plan communications are authorized or required may provide an indication of how likely an inadvertent disclosure of an insured dependent’s sensitive health information is within a jurisdiction. Future research could examine associations between the frequency of laws requiring or permitting disclosures and public health outcomes.

Laws that limit the disclosure of patient health information either (1) automatically prohibit the disclosure of health information when certain types of sensitive services are accessed (ie, STD services)¹⁴ or (2) allow a patient to request nondisclosure of certain health information. While the ability to request confidentiality may help maintain privacy, these laws may be limited in practice because they require knowledge of the law and action from patients. Minors may especially lack awareness of these laws. In addition, most of these laws apply exclusively to minors: only 2 jurisdictions extend these protections to nonminors. This may reduce the potential public health impact of these laws, especially considering that the ACA requires that dependents up to the age of 26 years be able to remain on their parent’s health insurance plan. Many insured dependents may thus be excluded from these protections.

After our research was completed, 2 states (California and Oregon) passed laws that explicitly require health insurers to honor requests to maintain the confidentiality of insured dependents’ health information. While California’s law limits requests to disclosure of sensitive services that would endanger a patient,¹⁵ Oregon’s law does not limit the type of service for which confidentiality can be requested.¹⁶ These laws are unique in that they explicitly address health insurers (rather than health care providers and facilities). By binding all entities involved in the health care transaction, these new laws ensure that confidentiality is maintained throughout the entire billing process and may therefore be an important development for insured dependent confidentiality.

This analysis has limitations. Our ability to compare jurisdictions’ laws is limited because of variation in legal definitions. Definitions of key terms, such as “insured” and “policyholder,” may differ across jurisdictions; our analyses were based on standard industry terminology. Several areas of law were excluded from this analysis; this may underestimate the number of potential situations where confidentiality could be compromised. Laws that did not identify a recipient of a plan communication were also excluded, as it is difficult to predict the effect of a law that does not specify to whom a plan communication must be sent.

Conclusion

There is considerable legal variation regarding the sending of plan communications across US jurisdictions. Importantly, in most jurisdictions, health insurers are given considerable discretion in determining to whom to send plan communications. This research may provide a framework for policy makers and other stakeholders to use in considering how their jurisdiction’s laws affect health care confidentiality for young adults, as well as facilitate research to evaluate the association between public health outcomes and policies related to sensitive health care services for insured dependents.

Implications for Policy & Practice.

This manuscript may provide a framework for policy makers and other stakeholders to use in considering how their jurisdictions’ laws affect health care confidentiality for young adults, as well as facilitate research to evaluate the association between public health outcomes and policies related to sensitive health care services for insured dependents.