SECTION 13. Personal or privileged information from insurance transactions; disclosure

An insurance institution, insurance representative or insurance-support organization shall not disclose any personal or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure is:

(1) with the written authorization of the individual, provided that:

(i) if such authorization is submitted by another insurance institution, insurance representative or insurance-support organization, the authorization meets the requirement of section six; or

(ii) if such authorization is submitted by a person other than an insurance institution, insurance representative or insurance-support organization, the authorization is:

(A) dated;

(B) signed by the individual; and

(C) obtained one year or less prior to the date a disclosure is sought pursuant to this subsection; or

(2) to a person other than an insurance institution, insurance representative or insurance-support organization; provided, however, that such disclosure is reasonably necessary:

(i) to enable such person to perform a specific business, professional or insurance function for the disclosing insurance institution, insurance representative or insurance-support organization and such person agrees not to disclose the information further without such individual's written authorization unless the further disclosure:

(A) would otherwise be permitted by this section if made by an insurance institution, insurance representative or insurance-support organization; or

(B) is reasonably necessary for such person to perform its specific business, professional or insurance function for the disclosing insurance institution, insurance representative or insurance-support organization; or

(ii) to enable such person to provide information to the disclosing insurance institution, insurance representative or insurance-support organization for the purpose of:

(A) determining an individual's eligibility for an insurance benefit or payment; or

(B) detecting or preventing criminal activity, fraud or material misrepresentation in connection with an insurance transaction; or

(3) to an insurance institution, insurance representative, or insurance-support organization; provided, however, that the information disclosed is limited to that which is reasonably necessary:

(i) to detect or prevent criminal activity, fraud or material misrepresentation in connection with insurance transactions; or

(ii) for the receiving or disclosing insurance institution, insurance representative or insurance-support organization to perform its function in connection with an insurance transaction involving an individual; provided, however, that the recipient of the information is prohibited from redisclosing the information without explicit written authorization according to the requirements of paragraph (1) or that the individual is notified, either concurrently with the application or otherwise prior to disclosure of the information, that the disclosure of the information may be made and can find if the disclosure has been made; or

(4) to a medical-care institution or medical professional for the purpose of:

(i) verifying insurance coverage or benefits; or

(ii) informing an individual of a medical problem of which the individual may not be aware; or

(iii) conducting an operations or services audit to verify the individuals treated by the medical professional or at the medical-care institution, provided only such information is disclosed as is reasonably necessary to accomplish the foregoing purposes; or

(5) to an insurance regulatory authority; or

(6) to a law enforcement or other governmental authority:

(i) to protect the interests of the insurance institution, insurance representative or insurance-support organization in preventing or prosecuting the perpetration of fraud upon it; or

(ii) if the insurance institution, insurance representative or insurance-support organization reasonably believes that illegal activities have been conducted by the individual; or

(7) otherwise permitted or required by law; or

(8) in response to a facially valid administrative or judicial order, including a search warrant or subpoena; or

(9) made for the purpose of conducting actuarial or research studies, provided that:

(i) no individual may be identified in any actuarial or research report;

(ii) information allowing the individual to be identified is removed to the extent practicable and where such removal is not practicable, is returned or destroyed as soon as it is no longer needed; and

(iii) the actuarial or research organization agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by an insurance institution, insurance representative or insurance-support organization and the disclosure is made in connection with such actuarial or research studies; or

(10) to a party or representative of a party to a proposed or consummated sale, transfer, merger or consolidation of all or part of the business of the insurance of the insurance institution, insurance representative or insurance-support organization, provided that:

(i) prior to the consummation of the sale, transfer, merger or consolidation only such information is disclosed as is reasonably necessary to enable the recipient to make business decisions about the purchase, transfer, merger or consolidation; and

(ii) the recipient agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by an insurance institution, insurance representative or insurance-support organization and the disclosure is made in connection with such sale, transfer, merger or consolidation; or

(11) to a person whose only use of such information will be in connection with the marketing of a product or service, provided that:

(1) no medical-record information, privileged information, or personal information relating to an individual's health, character, personal habits, mode of living or general reputation is disclosed, and no classification derived from such information is disclosed;

(2) the individual has been given an opportunity to indicate that he does not want personal information disclosed for marketing purposes and has given no indication that he does not want the information disclosed; and

(3) the person receiving such information agrees not to use it except in connection with the marketing of a product or service; or

(12) to an affiliate whose only use of the information will be in connection with an audit of the insurance institution or insurance representative or the marketing of an insurance product or service; provided, however, that the affiliate agrees not to disclose the information for any other purpose or to unaffiliated persons; or

(13) by a consumer reporting agency; provided, however, that the disclosure is to a person other than an insurance institution or insurance representative; or

(14) to a group policyholder for the purpose of reporting claims experience or conducting an audit of the insurance institution's or insurance representative's operations or services; provided, however, that the information disclosed is reasonably necessary for the group policyholder to conduct the review or audit; or

(15) to a professional peer review organization for the purpose of reviewing the service or conduct of a medical-care institution or medical professional; or

(16) to a governmental authority for the purpose of determining the individual's eligibility for health benefits for which the governmental authority may be liable; or

(17) to a certificate holder or policyholder for the purpose of providing information regarding the status of an insurance transaction; or

(18) to a lienholder, mortgagee, assignee, lessor or other person shown on the records of an insurance institution or insurance representative as having a legal or beneficial interest in a policy of insurance; provided, however, that:

(i) no medical-record information is disclosed unless the disclosure would otherwise be permitted by this section; and

(ii) the information disclosed is limited to that which is reasonably necessary to permit such person to protect its interests in such policy.