Disclosure of personal medical information – Wis. Stat. Ann. § 610.70

The law sets forth standards that any disclosure form to any insurer authorizing the disclosure of personal medical information must follow.  The form must:

• Be in plain language;
• Be dated;
• Specify the individuals authorized to disclose the information;
• Specify the information to be disclosed;
• Specify the name of the insurer;
• Specify the purpose of the disclosure.

If an individual or authorized representative requests from the insurer in writing, access to the recorded personal medical information, the insurer must within 30 days, give the individual the requested information, allow the individual to inspect and copy the information, disclose the individual the names of people to whom the medical information has been disclosed, and/or give the individual a summary of procedures on how to correct, modify or amend his or her record.  An insurer may charge a reasonable fee to cover costs for copying records. 

Within 30 days of receiving an individual’s request to correct, amend or delete personal medical information, the insurer must do one of the following:

1. Comply with the request;
2. Notify the individual that the insurer refuses to comply with the request, including the reasons for the denial.

Any disclosure of an individual’s personal medical information must comply with the signed disclosure form, unless the disclosure is made for other reasons specified in the statute, including for a claim, to protect the insurer’s interests, or to verify an individual’s benefits. 

A person may not be held liable under this statute for disclosing personal medical information or providing such information to an insurer.

A person who knowingly and willfully obtains personal medical information from an insurer under false pretenses can be fined up to $25,000, be imprisoned for 9 months or both.  Such a person may also be liable to the individual for actual damages, exemplary damages up to $25,000, costs and attorney’s fees.