58-39-75. Disclosure limitations and conditions.

An insurance institution, agent, or insurance-support organization shall not disclose any personal or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure is:

(1) With the written authorization of the individual, provided:

a. If such authorization is submitted by another insurance institution, agent, or insurance-support organization, the authorization meets the requirements of G.S. 58-39-35; or

b. If such authorization is submitted by a person other than an insurance institution, agent, or insurance-support organization, the authorization meets the requirements of G.S. 58-39-35 and is:

1. Dated;

2. Signed by the individual; and

3. Obtained one year or less before the date a disclosure is sought pursuant to this paragraph; or

(2) To a person other than an insurance institution, agent, or insurance-support organization, provided such disclosure is reasonably necessary:

a. To enable that person to perform a business, professional, or insurance function for the disclosing insurance institution, agent, or insurance-support organization, including, but not limited to, performing marketing functions and other functions regarding the provision of information concerning the disclosing institution's own products, services, and programs, and that person agrees not to disclose the information further without the individual's written authorization unless the further disclosure:

1. Would otherwise be permitted by this section if made by an insurance institution, agent, or insurance-support organization; or

2. Is reasonably necessary for that person to perform its function for the disclosing insurance institution, agent, or insurance-support organization; or

b. To enable that person to provide information to the disclosing insurance institution, agent, or insurance-support organization for the purpose of:

1. Determining an individual's eligibility for an insurance benefit or payment; or

2. Detecting or preventing criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with an insurance transaction; or

(3) To an insurance institution, agent, insurance-support organization, or self-insurer, provided the information disclosed is limited to that which is reasonably necessary:

a. To detect or prevent criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with insurance transactions; or

b. For either the disclosing or receiving insurance institution, agent, or insurance-support organization to perform its function in connection with an insurance transaction involving the individual; or

(4) To a medical-care institution or medical professional for the purpose of (i) verifying insurance coverage or benefits, (ii) informing an individual of a medical problem of which the individual may not be aware, or (iii) conducting an operations or services audit, provided only such information is disclosed as is reasonably necessary to accomplish the foregoing purposes; or

(4a) To a person making an inquiry under G.S. 58-58-97 when providing funeral service to a deceased insured; or

(5) To an insurance regulatory authority; or

(6) To a law-enforcement or other government authority:

a. To protect the interests of the insurance institution, agent, or insurance-support organization in preventing or prosecuting the perpetration of fraud upon it; or

b. If the insurance institution, agent, or insurance-support organization reasonably believes that illegal activities have been conducted by the individual; or

(7) Otherwise permitted or required by law; or

(8) In response to a facially valid administrative or judicial order, including a search warrant or subpoena; or

(9) Made for the purpose of conducting actuarial or research studies, provided:

a. No individual may be identified in any actuarial or research report;

b. Materials allowing the individual to be identified are returned or destroyed as soon as they are no longer needed; and

c. The actuarial or research organization agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by an insurance institution, agent, or insurance-support organization; or

(10) To a party or a representative of a party to a proposed or consummated sale, transfer, merger, or consolidation of all or part of the business of the insurance institution, agent, or insurance-support organization, provided:

a. Prior to the consummation of the sale, transfer, merger, or consolidation only such information is disclosed as is reasonably necessary to enable the recipient to make business decisions about the purchase, transfer, merger, or consolidation, and

b. The recipient agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by an insurance institution, agent or insurance-support organization; or

(11) To a person whose only use of such information will be in connection with the marketing of a product or service, provided:

a. No medical-record information, privileged information, or personal information relating to an individual's character, personal habits, mode of living, or general reputation is disclosed, and no classification derived from such information is disclosed;

b. The individual has been given an opportunity to indicate that he does not want personal information disclosed for marketing purposes and has given no indication that such individual does not want the information disclosed; and

c. The person receiving such information agrees not to use it except in connection with the marketing of a product or service; or

(12) To an affiliate whose only use of the information will be in connection with an audit of the insurance institution or agent or the marketing of an insurance product or service, provided the affiliate agrees not to disclose the information for any other purpose or to unaffiliated persons; and further provided that no medical record information may be disclosed to the affiliate for the marketing of an insurance product or service; or

(13) By a consumer reporting agency, provided the disclosure is to a person other than an insurance institution or agent; or

(14) To a group policyholder for the purpose of reporting claims experience or conducting an audit of the insurance institution's or agent's operations or services, provided the information disclosed is reasonably necessary for the group policyholder to conduct the review or audit; or

(15) To a professional peer review organization for the purpose of reviewing the service or conduct of a medical-care institution or medical professional; or

(16) To a governmental authority for the purpose of determining the individual's eligibility for health benefits for which the governmental authority may be liable; or

(17) To a certificate holder or policyholder for the purpose of providing information regarding the status of an insurance transaction; or

(18) To a lienholder, mortgagee, assignee, lessor, or other person shown on the records of an insurance institution or agent as having a legal or beneficial interest in a policy of insurance only if:

a. No medical record information is disclosed unless the disclosure would otherwise be permitted by this section; and

b. The information disclosed is limited to that which is reasonably necessary to permit such person to protect its interest in such policy; or

(19) To authorized personnel of the Division of Motor Vehicles upon requests pursuant to G.S. 20-309(c) or G.S. 20-309(f).

(20) To the Department of Health and Human Services and the information disclosed is immunization information described in G.S. 130A-153.

(21) To a person whose only use of an applicant's or policyholder's personal information, but not including medical record information, will be in connection with the marketing of a financial product or service intended to be provided by participants in a marketing program where the program participants and the types of information to be shared are identified to the applicant or policyholder when the applicant or policyholder is first offered the financial product or service. As used in this subdivision:

a. "Financial institution" means any institution the business of which is engaging in activities that are financial in nature or incidental to such financial activities as described in section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)).

b. "Financial product or service" means any product or service that a financial holding company could offer by engaging in an activity that is financial in nature or incidental to such financial activity under section 4(k) of the Bank Holding Company Act of 1956 (12 U.S.C. 1843(k)).

c. "Marketing program" includes only those programs established by written agreement by the insurance institution and one or more financial institutions under which they jointly offer, endorse, or sponsor a financial product or service.