Sec. 34.

(1) A TPA shall provide for the confidentiality of personal data identifying an individual covered by a plan. A TPA shall not disclose records containing personal information that may be associated with an identifiable individual covered by a plan to a person other than the individual to whom the information pertains. Except as is necessary to comply with a court order, an administrator shall not disclose personal data concerning a covered individual without the prior consent of the covered individual. If the individual covered by a plan has authorized the release of information to a third person, the third person shall not release that information unless the individual executes in writing another consent authorizing the additional release.

(2) Subsection (1) shall not be construed to apply to information disclosed for any of the following reasons:

(a) For claims adjudication.

(b) For claims verification.

(c) For other proper plan administration.

(d) For an audit conducted pursuant to ERISA.

(e) To an insurer for the purchase of excess loss insurance and for claims under the excess loss insurance. However, an insurer obtaining information under this subdivision shall be subject to the requirements of subsection (1).

(f) To the plan or a fiduciary of the plan.

(g) To the commissioner. However, information obtained by the commissioner under this subdivision shall be exempt from disclosure under the freedom of information act, Act No. 442 of the Public Acts of 1976, being sections 15.231 to 15.246 of the Michigan Compiled Laws.

(h) As required by law.

History: 1984, Act 218, Eff. Jan. 1, 1985