Confidentiality - 40 Pa. Stat. Ann. § 991.2131

Managed care plans and utilization review entities must ensure that all identifiable information regarding enrollee health, diagnosis and treatment remains confidential in compliance with applicable laws, regulations and professional ethical standards.  Information regarding an enrollee’s health or treatment must be available to the enrollee, his designee and as is necessary to prevent death or serious injury.  If a managed care plan maintains medical records, it must ensure that enrollees have timely access to their records unless otherwise prohibited by law.  Disclosure and use of information regarding enrollee health, diagnosis and treatment is permissible under the following circumstances:

•         To determine coverage, review complaints and grievances, conduct utilization review and facilitate payment of a claim;
•         For quality assurance, investigation of complaints or grievances and other activities related to compliance by the insurance department and the department of public welfare;
•         For utilization review by such entities as is necessary;
•         For internal quality review by managed care plans; during such review, the enrollee must remain anonymous to the greatest extent possible; 
•         For patient care management, outcomes improvement and research by managed care plans, health care providers and their respective designees; the enrollee must remain anonymous to the greatest extent possible.