S07262 Summary:

BILL NOS07262
 
SAME ASSAME AS A07329
 
SPONSORTHOMAS
 
COSPNSR
 
MLTSPNSR
 
Add 3239-a, Ins L
 
Establishes the wellness program privacy act; requires employers and insurers to take certain measures to protect the security of wellness program participants' private information.
Go to top    

S07262 Actions:

BILL NOS07262
 
01/15/2020REFERRED TO INSURANCE
Go to top

S07262 Committee Votes:

Go to top

S07262 Floor Votes:

There are no votes for this bill in this legislative session.
Go to top

S07262 Memo:

Memo not available
Go to top

S07262 Text:



 
                STATE OF NEW YORK
        ________________________________________________________________________
 
                                          7262
 
                    IN SENATE
 
                                    January 15, 2020
                                       ___________
 
        Introduced  by  Sen.  THOMAS -- read twice and ordered printed, and when
          printed to be committed to the Committee on Insurance
 
        AN ACT to amend the insurance law, in relation to the  establishment  of
          the "Wellness Program Privacy Act"
 
          The  People of the State of New York, represented in Senate and Assem-
        bly, do enact as follows:

     1    Section 1. This act shall be known and may be cited as  the  "Wellness
     2  Program Privacy Act".
     3    §  2.  The  insurance law is amended by adding a new section 3239-a to
     4  read as follows:
     5    § 3239-a. Wellness program privacy. (a) Definitions. For  purposes  of
     6  this section:
     7    (1) "Employer" means:
     8    (i)  any  person who directly employs fifty or more persons to perform
     9  services for a wage or salary; or
    10    (ii) the state and any political or civil subdivision of the state, or
    11  any county or city or other municipality.
    12    (2) "Collects," "collected," or "collection"  means  buying,  renting,
    13  gathering,  obtaining,  receiving, or accessing any personal information
    14  or protected health information pertaining to a consumer by  any  means.
    15  This  includes receiving information from such consumer, either actively
    16  or passively, or by observing such consumer's behavior.
    17    (3) "Administration and operation of a wellness program" means, but is
    18  not limited to, the use of personal information when  reasonably  neces-
    19  sary and proportionate to achieve one of the following purposes:
    20    (i)  detecting  and  responding  to  security incidents arising from a
    21  wellness program and protecting against  malicious,  deceptive,  fraudu-
    22  lent, or illegal activity related to a wellness program;
    23    (ii)  executing functions of a wellness program for the benefit of the
    24  insured;
    25    (iii) undertaking internal research for technological development  and
    26  demonstration related to a wellness program; or
    27    (iv) undertaking activities to verify or maintain the quality or safe-
    28  ty  of  a  service or device that is owned by, manufactured by, manufac-
 
         EXPLANATION--Matter in italics (underscored) is new; matter in brackets
                              [ ] is old law to be omitted.
                                                                   LBD11029-01-9

        S. 7262                             2
 
     1  tured for, or controlled by the insurer,  or  to  improve,  upgrade,  or
     2  enhance  the  service or device that is owned by, manufactured by, manu-
     3  factured for, or  controlled  by  the  insurer  related  to  a  wellness
     4  program.
     5    (4)  "Personal information" means information that identifies or could
     6  reasonably be linked, directly or indirectly, with a particular  consum-
     7  er,  household,  or  consumer  device.  "Personal information" shall not
     8  include publicly available information.
     9    (5) "Publicly available"  means  information  that  is  lawfully  made
    10  available  from  federal,  state,  or  local  government records, if any
    11  conditions associated with such information. "Publicly available"  shall
    12  not mean information collected by an employer or insurer about an enrol-
    13  lee  without  the  enrollee's knowledge. "Personal information" does not
    14  include enrollee information that is de-identified or aggregate enrollee
    15  information.
    16    (6) "Retaliatory" or "adverse action" in the context  of  an  employer
    17  offering  a  wellness  program to its employees shall include: denial of
    18  coverage, termination  of  employment,  requiring  one  hundred  percent
    19  payment  of medical care premiums when an employer pays a portion of the
    20  premium for wellness program participants, or reducing contributions  to
    21  participants' health savings accounts.
    22    (7)  "Retaliatory"  or  "adverse  action" in the context of an insurer
    23  offering a wellness program shall include: denial  of  coverage,  termi-
    24  nation  of  coverage  based  on  non-participation or failure to achieve
    25  wellness targets, or adjustments to insurance premiums.
    26    (b) Fair collection and use of personal information. (1)  Any  insurer
    27  or  employer  that  collects  a  wellness program participant's personal
    28  information in the administration and operation of  a  wellness  program
    29  shall  limit  its  collection to what is reasonably necessary to operate
    30  the wellness program in which a consumer is enrolled.
    31    (2) Any insurer or employer that collects a wellness  program  partic-
    32  ipant's  personal  information  in the administration and operation of a
    33  wellness program shall limit its use and retention of personal  informa-
    34  tion to what is reasonably necessary to administer and operate the well-
    35  ness program in which a consumer is enrolled and for related administra-
    36  tive and operational purposes.
    37    (3) No insurer or employer shall share with third parties any personal
    38  information or data collected through a wellness program.
    39    (4)  Following  the  close of a wellness program, an employee's termi-
    40  nation, or the end of an enrollee's  term  of  insurance,  any  personal
    41  information or data shall be deleted or de-identified.
    42    (5)  Wellness  program  participants  shall have the right to obtain a
    43  copy of their wellness program data, and shall have the right  to  chal-
    44  lenge  the  completeness  and accuracy of any data the program has about
    45  them.
    46    (6) The requirements described in this subdivision shall apply, to the
    47  extent that they are applicable,  to  any  entity  that  an  insurer  or
    48  employer  contracts  with  for  purposes of administering or operating a
    49  wellness program on such insurer or employer's behalf.
    50    (c) Transparency. Any insurer or an employer that collects a  wellness
    51  program  participant's  personal  information  in the administration and
    52  operation of a wellness program shall provide such  participant  with  a
    53  written explanation of:
    54    (1) all data collected in the program;
    55    (2)  practices related to data sharing, including who will have access
    56  to such data; and

        S. 7262                             3
 
     1    (3) the wellness program enrollee's  rights  concerning  the  wellness
     2  program under federal and state laws, rules, and regulations.
     3    (d)  Prohibition  of  discrimination  based  on participation. (1) Any
     4  employer that offers a wellness program to its employees, or any insurer
     5  that offers a wellness program to enrollees, shall not engage in retali-
     6  atory or adverse action against individuals who do  not  participate  in
     7  wellness programs.
     8    (2)  The  total  amount  of  all  wellness program incentives shall be
     9  limited to an amount deemed by the superintendent not to be coercive.
    10    (e) Enforcement and enrollee private right of action. (1) Any consumer
    11  who has suffered from a violation of this  section  by  an  employer  or
    12  insurer  may  bring  a  lawsuit  against  such  employer  or  insurer. A
    13  violation of this section shall be deemed to  constitute  an  injury  in
    14  fact  to  the  consumer  who  has  suffered from such violation, and the
    15  consumer need not suffer a loss of money or property as a result of  the
    16  violation in order to bring an action for a violation of this section.
    17    (2) A consumer who prevails in such a lawsuit shall obtain the follow-
    18  ing remedies:
    19    (i) damages in an amount not greater than the increased health or life
    20  insurance  premium  cost  due  to penalties or lost incentives, or seven
    21  hundred fifty dollars per consumer  per  incident,  or  actual  damages,
    22  whichever is greater;
    23    (ii) injunctive or declaratory relief, as the court deems proper;
    24    (iii) reasonable attorneys' fees and costs; and
    25    (iv) any other relief the court deems proper.
    26    (3)  In  assessing  the  amount  of statutory damages, the court shall
    27  consider any one or more of the relevant circumstances presented by  any
    28  of  the  parties  to the case, including, but not limited to, the nature
    29  and seriousness  of  the  misconduct,  the  number  of  violations,  the
    30  persistence of the misconduct, the length of time over which the miscon-
    31  duct  occurred,  the  willfulness of the defendant's misconduct, and the
    32  defendant's assets, liabilities, and net worth.
    33    (4) A consumer bringing an action shall notify  the  attorney  general
    34  within thirty days that the action has been filed.
    35    (5)  The attorney general may bring a civil action, in the name of the
    36  people of the state, against any employer or  insurer  in  violation  of
    37  this section.
    38    (6) The department may pursue enforcement action against health insur-
    39  ers, health plans, or life insurers in violation of this section.
    40    (7)  Any  employer or insurer that violates this section may be liable
    41  for a civil penalty of up to seven thousand  five  hundred  dollars  for
    42  each  intentional violation, and up to two thousand five hundred dollars
    43  for each unintentional violation.
    44    § 3. This act shall take effect immediately.
Go to top

S07262 LFIN:

 NO LFIN
Go to top

S07262 Chamber Video/Transcript:

Go to top