(a) kept confidential in accordance with applicable state and federal laws; and

(b) shared only with the enrollee, the enrollee's designee, the enrollee's health care provider and those who are authorized by law to receive such information. 2. Summary data shall not be considered confidential if it does not provide information to allow identification of individual patients. 3. Any health care professional who makes determinations regarding the medical necessity of health care services during the course of utilization review shall be appropriately licensed, registered or certified. 4. A utilization review agent shall not, with respect to utilization review activities, permit or provide compensation or anything of value to its employees, agents, or contractors based on:

(a) either a percentage of the amount by which a claim is reduced for payment or the number of claims or the cost of services for which the person has denied authorization or payment; or

(b) any other method that encourages the rendering of an adverse determination. 5. If a health care service has been specifically pre-authorized or approved for an enrollee by a utilization review agent, a utilization review agent shall not, pursuant to retrospective review, revise or modify the specific standards, criteria or procedures used for the utilization review for procedures, treatment and services delivered to the enrollee during the same course of treatment. 6. Utilization review shall not be conducted more frequently than is reasonably required to assess whether the health care services under review are medically necessary. 7. When making prospective, concurrent and retrospective determinations, utilization review agents shall collect only such information as is necessary to make such determination and shall not routinely require health care providers to numerically code diagnoses or procedures to be considered for certification or routinely request copies of medical records of all patients reviewed. During prospective or concurrent review, copies of medical records shall only be required when necessary to verify that the health care services subject to such review are medically necessary. In such cases, only the necessary or relevant sections of the medical record shall be required. A utilization review agent may request copies of partial or complete medical records retrospectively. This subdivision shall not apply to health maintenance organizations licensed pursuant to article forty-three of the insurance law or certified pursuant to article forty-four of this chapter. 8. In no event shall information be obtained from the health care providers for the use of the utilization review agent by persons other than health care professionals, medical record technologists or administrative personnel who have received appropriate training. 9. The utilization review agent shall not undertake utilization review at the site of the provision of health care services unless the utilization review agent:

(a) Identifies himself or herself by name and the name of his or her organization, including displaying photographic identification which includes the name of the utilization review agent and clearly identifies the individual as representative of the utilization review agent;

(b) Whenever possible, schedules review at least one business day in advance with the appropriate health care provider;

(c) If requested by a health care provider, assures that the on-site review staff register with the appropriate contact person, if available, prior to requesting any clinical information or assistance from the health care provider;

(d) Obtains consent from the enrollee or the enrollee's designee before interviewing the patient's family, or observing any health care service being provided to the enrollee; and

(e) This subdivision shall not apply to health care professionals engaged in providing care, case management or making on-site discharge decisions. 10. A utilization review agent shall not base an adverse determination on a refusal to consent to observing any health care service. 11. A utilization review agent shall not base an adverse determination on lack of reasonable access to a health care provider's medical or treatment records unless the utilization review agent has provided reasonable notice to the enrollee, the enrollee's designee or the enrollee's health care provider, in which case the enrollee must be notified, and has complied with all provisions of subdivision nine of this section. 12. Neither the utilization review agent nor the entity for which the agent provides utilization review shall take any action with respect to a patient or a health care provider that is intended to penalize such enrollee, the enrollee's designee, or the enrollee's health care provider for, or to discourage such enrollee, the enrollee's designee, or the enrollee's health care provider from undertaking an appeal, dispute resolution or judicial review of an adverse determination. 13. In no event shall an enrollee, an enrollee's designee, an enrollee's health care provider, any other health care provider, or any other person or entity, be required to inform or contact the utilization review agent prior to the provision of emergency care, including emergency treatment or emergency admission. 14. No contract or agreement between a utilization review agent and a health care provider shall contain any clause purporting to transfer to the health care provider by indemnification or otherwise any liability relating to activities, actions or omissions of the utilization review agent as opposed to the health care provider. 15. A health care professional providing health care services to an enrollee shall be prohibited from serving as the clinical peer reviewer for such enrollee in connection with the health care services being provided to the enrollee.