Ohio § 3904.13

§ 3904.13.

No insurance institution, agent, or insurance support organization shall disclose

any personal or privileged information about an individual collected or received in

connection with an insurance transaction, unless the disclosure is made pursuant to

any of the following: (A) With the written authorization of the individual, provided: (1) If such authorization is submitted by another insurance institution, agent, or insurance

support organization, the authorization meets the requirements of section 3904.06 of the Revised Code ; (2) If such authorization is submitted by a person other than an insurance institution,

agent, or insurance support organization, the authorization is dated, signed by the

individual, and obtained one year or less prior to the date a disclosure is sought

under this division. (B) To a person other than an insurance institution, agent, or insurance support organization,

provided such disclosure is reasonably necessary for the following reasons: (1) To enable such person to perform a business, professional, or insurance function

for the disclosing insurance institution, agent, or insurance support organization,

and such person agrees not to disclose the information further without the individual's

written authorization unless the further disclosure either: (a) Would otherwise be permitted by this section if made by an insurance institution,

agent, or insurance support organization; (b) Is reasonably necessary for such person to perform the person's function for the

disclosing insurance institution, agent, or insurance support organization. (2) To enable such person to provide information to the disclosing insurance institution,

agent, or insurance support organization for the purpose of either: (a) Determining an individual's eligibility for an insurance benefit or payment; (b) Detecting or preventing criminal activity, fraud, material misrepresentation, or

material nondisclosure in connection with an insurance transaction. (C) To an insurance institution, agent, insurance support organization, or self-insurer,

provided the information disclosed is limited to that which is reasonably necessary

either: (1) To detect or prevent criminal activity, fraud, material misrepresentation, or material

nondisclosure in connection with insurance transactions; (2) For either the disclosing or receiving insurance institution, agent, or insurance

support organization to perform its function in connection with an insurance transaction

involving the individual. (D) To a medical care institution or medical professional for the purpose of verifying

insurance coverage or benefits, informing an individual of a medical problem of which

the individual may not be aware, or conducting an operations or services audit to

verify the individuals treated by the medical professional or at the medical care

institution.  However, only such information may be disclosed as is reasonably necessary to accomplish

any of the purposes set forth in this division. (E) To an insurance regulatory authority; (F) To a law enforcement or other governmental authority to protect the interests of

the insurance institution, agent, or insurance support organization in preventing

or prosecuting the perpetration of fraud upon it;  or if the insurance institution,

agent or insurance support organization reasonably believes that illegal activities

have been conducted by the individual; (G) As otherwise permitted or required by law; (H) In response to a facially valid administrative or judicial order, including a search

warrant or subpoena; (I) Made for the purpose of conducting actuarial or research studies, provided the following

conditions are met: (1) No individual may be identified in any actuarial or research report; (2) Materials allowing the individual to be identified are returned or destroyed as soon

as they are no longer needed; (3) The actuarial or research organization agrees not to disclose the information unless

the disclosure would otherwise be permitted by this section if made by an insurance

institution, agent, or insurance support organization. (J) To a party or representative of a party to a proposed or consummated sale, transfer,

merger, or consolidation of all or part of the business of the insurance institution,

agent, or insurance support organization, provided the following conditions are met: (1) Prior to the consummation of the sale, transfer, merger, or consolidation, only such

information is disclosed as is reasonably necessary to enable the recipient to make

business decisions about the purchase, transfer, merger, or consolidation; (2) The recipient agrees not to disclose the information, unless the disclosure would

otherwise be permitted by this section if made by an insurance institution, agent,

or insurance support organization. (K) To a person whose only use of such information will be in connection with the marketing

of a product or service, provided the following conditions are met: (1) No medical record information, privileged information, or personal information relating

to an individual's character, personal habits, mode of living, or general reputation

is disclosed, and no classification derived from such information is disclosed; (2) The individual has been given an opportunity to indicate that the individual does

not want personal information disclosed for marketing purposes and has given no indication

that the individual does not want the information disclosed; (3) The person receiving such information agrees not to use it except in connection with

the marketing of a product or service. (L) To an affiliate whose only use of the information will be in connection with an audit

of the insurance institution or agent or the marketing of an insurance product or

service, provided the affiliate agrees not to disclose the information for any other

purpose or to unaffiliated persons; (M) By a consumer reporting agency, provided the disclosure is to a person other than

an insurance institution or agent; (N) To a group policyholder for the purpose of reporting claims experience or conducting

an audit of the insurance institution's or agent's operations or services, provided

the information disclosed is reasonably necessary for the group policyholder to conduct

the review or audit; (O) To a group policyholder as provided in section 3901.89 of the Revised Code ; (P) To a professional peer review organization for the purpose of reviewing the service

or conduct of a medical care institution or medical professional; (Q) To a governmental authority for the purpose of determining the individual's eligibility

for health benefits for which the governmental authority may be liable; (R) To a certificate holder or policyholder for the purpose of providing information

regarding the status of an insurance transaction; (S) To a lienholder, mortgagee, assignee, lessor, or other person shown on the records

of an insurance institution or agent as having a legal or beneficial interest in a

policy of insurance, provided the following conditions are met: (1) No medical record information is disclosed unless the disclosure would otherwise

be permitted by this section; (2) The information disclosed is limited to that which is reasonably necessary to permit

such person to protect its interests in such policy.