Required and Prohibited Practices for Utilization Review Agents – N.Y. Ins. Law § 4905

Every utilization review agent must have procedures to assure that patient-specific information obtained during the utilization review process is kept confidential and disclosed only to those authorized by law to receive such information.  Summary data need not be kept confidential if it does not identify any individual patients.  When making determinations, utilization review agents may only collect as much information as is necessary to make such determination and may not routinely request copies of patient medical records.  During prospective or concurrent review, copies of patient medical records will only be required when necessary to verify that the health care services subject to review are medical necessary, and only necessary or relevant sections of such records will be available.