Iowa § 228.7 - 228.7 Disclosures for claims administration and peer review — safeguards — penalty.

§ 228.7. 228.7 Disclosures for claims administration and peer review — safeguards — penalty.

1. Mental health information may be disclosed, in accordance with the prior written consent of the patient or the patient’s legal representative, by a mental health professional, data collector, or employee or agent of a mental health professional, a data collector, or a mental health facility to a third-party payor or to a peer review organization if the third-party payor or the peer review organization has filed a written statement with the commissioner of insurance in which the filer agrees to: a. Instruct its employees and agents to maintain the confidentiality of mental health information and of the penalty for unauthorized disclosure. b. Comply with the limitations on use and disclosure of the information specified in subsection 2 of this section. c. Destroy the information when it is no longer needed for the purposes specified in subsection 2 of this section. 2. a. An employee or agent of a third-party payor or of a peer review organization shall not use mental health information or disclose mental health information to any person, except to the extent necessary to administer claims submitted or to be submitted for payment to the third-party payor, to conduct a utilization and quality control review of mental health care services provided or proposed to be provided, to conduct an audit of claims paid, or as otherwise authorized by law. b. Employees of a self-insured employer, and agents of a self-insured employer which have not filed a statement with the commissioner of insurance pursuant to subsection 1, shall not be granted routine or ongoing access to mental health information unless the employees or agents have signed a statement indicating that they are aware that the information shall not be used or disclosed except as provided in this subsection and that they are aware of the penalty for unauthorized disclosure. 3. An employee or agent of a third-party payor or a peer review organization who willfully uses or discloses mental health information in violation of subsection 2 of this section is guilty of a serious misdemeanor, and, notwithstanding section 903.1, the sentence for a person convicted under this subsection is a fine not to exceed five hundred dollars in the case of a first offense, and not to exceed five thousand dollars in the case of each subsequent offense. 88 Acts, ch 1226, §1; 2009 Acts, ch 41, §263 Referred to in §228.2 Thu Dec 11 19:02:27 2025 Iowa Code 2026, Section 228.7 (19, 0)