July 3, 1996
Evelyn Terry, General Counsel State of North Carolina Teachers’ and State Employees’ Comprehensive Major Medical Plan 4509 Creedmoor Road, Suite 102 Raleigh, NC 27612
RE: Advisory Opinion; Confidentiality Requirements for State Health Plan Member Information
Dear Ms. Terry:
In a memorandum dated May 1, 1996, you requested our opinion as to the confidentiality requirements for State Health Plan member information as related to forty-two individuals or entities who may request information from the State Health Plan. You gave no factual background as to what information, if any, had been requested by each of the forty-two listed entities nor in what context such requests had arisen.
For purposes of drawing a legal conclusion, we must apply the pertinent laws to specific facts on a case-by-case basis. In the absence of the necessary factual background, we herein provide basic guidelines for your use in evaluating future requests for information from the Plan.
Article 3 of Chapter 135, the enabling legislation for the State Employees’ Comprehensive Major Medical Plan (hereinafter the Plan), states that certain information in possession of the Plan is confidential. N.C.G.S. § 135-37 (1986) is cited in pertinent part: Any information as herein described in this section which is in the possession of the Executive Administrator and the Board of Trustees of the Teachers’ and State Employees’ Comprehensive Major Medical Plan or its Claims Processor . . . shall be confidential and shall be exempt from the provisions of Chapter 132 of the General Statutes or any other provision requiring information and records held by State agencies to be made public or accessible to the public. This section shall apply to all information concerning individuals including the fact of coverage or noncoverage, whether or not a claim has been filed, medical information, whether or not a claim has been paid, and any other information or materials concerning a Plan participant.
This section specifically applies to the Plan, the Executive Administrator, the Board of Trustees, or the Claims Processor and to the information within their possession or control. Basically, any information about individual plan participants, often referred to as "patient-level data", is protected under this confidentiality provision. This provision expressly carves out an exception to the Public Records Law found in N.C.G.S. § 132-1 et seq.
Whenever the Plan receives an information request, the Plan must first determine whether the requested information is patient-level data as described in the statute. If so, the information is not available pursuant to the Public Records Law or any other provision applicable to information in the possession or control of a public agency. If the information requested does not fall into the above-cited definition, then the data is not considered confidential and may be released to the extent allowed by other applicable statutes.
The confidentiality statute does provide for release of confidential information in limited circumstances. In pertinent part, the statute reads as follows: Provided, however, such information may be released to the State Auditor, or the Attorney General, or to the persons designated under N.C.G.S. § 135-39.3 in furtherance of their statutory duties and responsibilities, or to such persons or organizations as may be designated and approved by the Executive Administrator and Board of Trustees of the Teachers’ and State Employees’ Comprehensive Major Medical Plan, but any information so released shall remain confidential as stated above and any party obtaining such information shall assume the same level of responsibility for maintaining such confidentiality as that of the Executive Administrator and Board of Trustees of the Teachers’ and State Employees’ Comprehensive Major Medical Plan. N.C.G.S. § 135-37 (1986).
Clearly, confidential information may be released by the Plan to the State Auditor, the Attorney General or to persons designated under N.C.G.S. § 135-39.3, or to such persons or organizations as jointly designated by the Executive Administrator and Board of Trustees. It is important to note that the requirement to maintain confidentiality attaches to and follows the released information. Any party obtaining confidential information from the Plan pursuant to N.C.G.S. § 135-37 must maintain the same level of confidentiality as required of the Executive Administrator and Board of Trustees. It would therefore be unlawful for the entity receiving the confidential information to release it to non-authorized persons. The Plan should routinely inform recipients of their continuing duty to maintain such confidentiality.
You also asked what information in possession of the mental health case manager may the Executive Administrator require the case manager to produce. According to N.C.G.S. § 135-40, the term "Claims Processor" is defined as "the administrator, third party administrator or other party contracting with the State to administer the Plan benefits." Therefore, whenever the duties of the Claims Processor are set out by statute, those same duties apply to the mental health case manager as a "party contracting with the State to administer the Plan benefits." The confidentiality requirements set out above are also applicable to the mental health case manager. Further, the mental health case manager as " a party contracting with the State to administer the Plan benefits" is assisting the Executive Administrator "in the performance of his duties and responsibilities under [Article 3 of Chapter 135]." N.C.G.S. § 135-30.4A(f)(1991). The Executive Administrator may require the mental health case manager to produce any documents which could be required of the Claims Processor; that is, documents relating to the contractual obligations between the third party and the Plan.
In practical terms, the Plan should include such provisions in its contracts with third parties who administer the Plan benefits.
We hope you find this information useful. As specific factual circumstances arise relating to these issues, there may be new factors which could require additional analysis. Please do not hesitate to contact us when you deem such analysis is appropriate.
Reginald L. Watkins Senior Deputy Attorney General
V. Lori Fuller
Assistant Attorney General