This statement is submitted on behalf of the American Council of Life Insurance (ACLI). The ACLI is a national trade association with 580 member life insurance companies representing approximately 90 percent of the life insurance in force in the United States. Many of our member companies also sell disability income and long term care insurance. The ACLI appreciates being given the opportunity to present its views to the National Committee on Vital and Health Statistics Subcommittee on Privacy and Confidentiality (Subcommittee) regarding the privacy of individually identifiable health information, as defined in the Administrative Simplification Subtitle of the Health Insurance Portability and Accountability Act of 1996 (HIPA).
The ACLI is committed to the principle that individuals have a legitimate interest in the proper collection and use of their health information and that insurers have an obligation to assure individuals of the confidentiality of that information. As an industry, life, disability income, and long term care insurers have a long history of dealing with highly sensitive personal information in a professionally appropriate manner. We are proud of our record as custodians of this information.
The policy position of the ACLI regarding the confidentiality of individually identifiable health information is grounded in our long-standing support of the NAIC Insurance Information and Privacy Protection Model Act (Privacy Model Act). The ACLI believes this model strikes a proper balance between consumers' legitimate expectations of privacy and insurers' information needs. The Privacy Model Act governs insurers' practices in relation to all types of information including individually identifiable health information.
The Privacy Model Act provides requirements for the collection of individually identifiable health information and limits redisclosure of that information through, among other things, disclosure limitations and conditions. Under the Privacy Model Act insurers generally may not obtain or disclose individually identifiable health information without obtaining a signed, written authorization form that contains specified information. In addition, the Privacy Model Act provides individuals with the right to see and copy personal health information obtained during the underwriting process and to receive a list of those individuals and institutions from which information was obtained and to which information was disclosed, if any. The Privacy Model Act sets forth civil and criminal penalties for disclosures made in violation of its requirements.
The ACLI is among the strongest supporters of state regulation of insurance. The ACLI continues to be supportive of the adoption of insurance information and privacy protection legislation at the state level through the enactment of the Privacy Model Act. However, in recognition of the increased focus at the federal level on possible standards for the confidentiality of medical information, which may result in federal standards in this area, the ACLI will support federal confidentiality standards regarding health information provided, among other things, such standards are substantially similar to those contained in the Privacy Model Act and the federal legislation contains broad preemption provisions that supersede state privacy laws.
The ability of life, disability income and long term care insurers' to properly collect and use individually identifiable health information is essential. If limited in their collection and use of this information, these insurers will be jeopardized in their ability to continue to underwrite in a fair and financially prudent manner and to evaluate claims pursuant to the terms of their contracts. It does not appear that the Administrative Simplification Subtitle of HIPA contemplated the Secretary of Health and Human Resources (Secretary) making recommendations to the Congress with respect to privacy standards which would govern these insurers' use of individually identifiable health information.
Regardless of whether the privacy standards ultimately adopted are intended to directly govern life, disability income or long term care insurers' information practices, these insurers will be fundamentally impacted by the standards. This is true because the standards will govern entities, primarily health care providers, from whom life, disability income and long term care insurers must collect individually identifiable health information. This is of particular concern because life, disability income and long term care insurers' needs and practices in relation to this information are likely to be substantially different from those of other entities, such as health care providers, whose practices are clearly required to be addressed in the Subcommittee's recommendations.
A privacy standard which would operate as a prohibition or limitation on third parties' disclosure of individually identifiable health information, including genetic information, to life, disability income or long term care insurers or a standard which would operate as a prohibition or limitation on such insurers' use of individually identifiable health information, including genetic information, would operate as a prohibition or limitation of medical underwriting by these insurers. This would jeopardize the risk classification process and consequently, the existing private life, disability income and long term care insurance markets.
Risk classification, based to a large extent on medical underwriting, continues to be the cornerstone of the existing private life, disability income and long term care insurance markets. It is a process that involves the separation of applicants into different categories, each category containing insureds with similar risk characteristics and expectations of loss. Risk classification makes it possible for insurers to determine premiums which are fair in relation to proposed insureds' risk of dying prematurely and financially adequate to insure insurers' ability to honor future claims obligations. It is the mechanism which has made it possible for life, disability income and long term care insurance to be widely available at affordable prices. Elimination or significant restriction of the risk classification process would necessitate fundamental structural changes to the existing private life, disability income and long term care insurance markets. Ultimately, these changes would have to result in some form of socialized risk or public insurance program to satisfy insurance needs now handled privately.
Access to and use of individually identifiable health information is also essential to life, disability income and long term care insurers' ability to evaluate claims submitted under their insurance contracts. It is often necessary for an insurer to evaluate individually identifiable health information in order to determine appropriate benefits payable under a particular policy. Consequently a limitation or prohibition on life, disability income and long term care insurers' information practices could also fundamentally interfere with fulfillment of their contractual obligations.
The ACLI appreciates the Subcommittee's consideration of its views. We look forward to working with staff of the Subcommittee as well as the Secretary in their development of recommended privacy standards which do not inadvertently, but fundamentally, jeopardize the life, disability income and long term care insurance markets and the financial security of the millions of American consumers insured under these markets. Thank you.
Respectfully submitted on behalf of the American Council of Life Insurance
By Roberta B. Meyer