33-19-301. Access to recorded personal information. (1) If an individual, after proper identification, submits a written request to an insurance institution, insurance producer, or insurance-support organization for access to recorded personal information about the individual that is reasonably described by the individual and reasonably locatable and retrievable by the insurance institution, insurance producer, or insurance-support organization, the insurance institution, insurance producer, or insurance-support organization shall, within 30 business days from the date that the request is received:

(a) inform the individual of the nature and substance of the recorded personal information in writing, by telephone, or by other oral communication, whichever the insurance institution, insurance producer, or insurance-support organization prefers;

(b) permit the individual to see and copy, in person, the recorded personal information pertaining to the individual or to obtain a copy of the recorded personal information by mail, whichever the individual prefers. If the recorded personal information is in coded form, an accurate translation in plain language must be provided in writing.

(c) except for the tracking of disclosures of medical record information that must be recorded and disclosed under subsection (2), disclose to the individual the identity, if recorded, of those persons to whom the insurance institution, insurance producer, or insurance-support organization has disclosed the personal information within 2 years prior to the request and, if the identity is not recorded, the names of those insurance institutions, insurance producers, insurance-support organizations, or other persons to whom the information is normally disclosed; and

(d) provide the individual with a summary of the procedures that the individual may use to request correction, amendment, or deletion of recorded personal information.

(2) (a) If an individual, after proper identification, submits a written request to a licensee for a record of disclosures of medical record information, the licensee shall provide to the individual a record of all disclosures of medical record information made by the licensee pursuant to 33-19-306(8), (9), other than disclosures made to law enforcement authorities, (10)(b), (12)(a)(iii), (13), (14), only as to medical record information that has not been deidentified, (15), (21), only as to medical record information that has not been deidentified, or (22) or 33-19-307. The record of those disclosures must include:

(i) the name, address, and institutional affiliation, if any, of each person receiving or examining the medical information during the preceding 2 years;

(ii) the date of the receipt or examination; and

(iii) to the extent practicable, a description of the information disclosed.

(b) If an individual submits a written request to a licensee for a record of disclosures of medical record information and the licensee may have made medical record information disclosures pursuant to 33-19-306(4)(b), (5), (11), (12)(a)(i), (12)(a)(ii), (12)(b), (16), (18), or (19), the licensee shall provide the individual with a description of the types of medical record information that the licensee may disclose under those exceptions, along with a general description of the usual recipients of that information. Individual tracking of each disclosure of medical record information is not required.

(3) Personal information provided pursuant to subsection (1) must identify the source of the information if the source is an institutional source.

(4) Medical record information supplied by a medical care institution or medical professional and requested under subsection (1), together with the identity of the medical professional or medical care institution that provided the information, must be supplied either directly to the individual or to a medical professional designated by the individual and licensed to provide medical care with respect to the condition to which the information relates, whichever the insurance institution, insurance producer, or insurance-support organization prefers. If it elects to disclose the information to a medical professional designated by the individual, the insurance institution, insurance producer, or insurance-support organization shall notify the individual, at the time of the disclosure, that it has provided the information to the medical professional. The medical professional may review and interpret the information and, at the request of the affected individual, shall consult with the affected individual.

(5) Except for personal information provided under 33-19-303, an insurance institution, insurance producer, or insurance-support organization may charge a reasonable fee to cover the costs incurred in providing a copy of recorded personal information to individuals.

(6) The obligations imposed by this section upon an insurance institution or insurance producer may be satisfied by another insurance institution or insurance producer authorized to act on its behalf. With respect to the copying and disclosure of recorded personal information pursuant to a request under subsection (1), an insurance institution, insurance producer, or insurance-support organization may make arrangements with an insurance-support organization or a consumer reporting agency to copy and disclose recorded personal information on its behalf.

(7) The rights granted to individuals in this section extend to all natural persons to the extent information about them is collected, maintained, and disclosed by an insurance institution, insurance producer, or insurance-support organization in connection with an insurance transaction. The rights granted to all natural persons by this subsection do not extend to information about them that relates to and is collected in connection with or in reasonable anticipation of a claim or civil or criminal proceeding involving them, except for the tracking of medical record information as provided for in subsection (2).

(8) For the purposes of this section, the term "insurance-support organization" does not include "consumer reporting agency".