Required and Prohibited Practices for Utilization Review Agents and Confidentiality of Information – N.Y. Pub. Health Law § 4905

Utilization review agents must create written procedures for disclosing patient information used in a utilization review to authorized persons (e.g. the enrollee, the enrollee’s physician) and for otherwise safeguarding the confidentiality of such information. 

Summary data that does not contain patient identifying information is not confidential. 

In order to prospectively or concurrently review the medical necessity of a service, utilization review agents may obtain sections of patient medical records relevant to their inquiry. Agents

“may request copies of partial or complete medical records retrospectively.”