District of Columbia Administrative Code

3512 POINT OF SERVICE PLAN 3512.1 If an employer, association, or other private group arrangement offers health benefit plan coverage to employees or individuals only through an HMO, the HMO with which the employer, association, or other private group arrangement is contracting f…

3513 PROHIBITED PRACTICES 3513.1 An HMO may include in its individual contract a provision setting forth reasonable exclusions or limitations of services for preexisting conditions at time of enrollment. However, no such exclusions or limitations shall be for a period greater tha…

3514 OTHER REQUIREMENTS 3514.1 An HMO shall provide its enrollees with a list of the names and locations of all of its participating providers no later than the time of enrollment or the time the group or individual contract and evidence of coverage are issued, whichever is later…

3515 REGULATION OF HMO PRODUCERS 3515.1 No person shall act or hold himself to be an HMO producer unless duly licensed and appointed as such in accordance with these rules. 3515.2 No HMO doing business in the District of Columbia shall pay, directly or indirectly, any commission …

3516 POWERS OF INSURANCE CORPORATIONS 3516.1 An insurance company licensed to do business in the District may organize and operate an HMO directly, through a subsidiary or affiliate, pursuant to section 18 of the Act, D.C. Code § 35-4517. 3516.2 Any two (2) or more insurance comp…

3517 DENIAL, SUSPENSION OR REVOCATION OF THE CERTIFICATE OF AUTHORITY 3517.1 The Commissioner may deny an application for a certificate of authority, and suspend or revoke a certificate of authority issued under the Act and these rules, for the following reasons: (a) The HMO is o…

3518 INVESTMENTS 3518.1 The funds of an HMO shall be invested in accordance with section 5(a)(1) of the Act, D.C. Code § 35-4504(a)(1), or the HMO Investment Guidelines adopted by the Commissioner. SOURCE: Final Rulemaking published at 46 DCR 7291(September 17, 1999).

3519 FORMS 3519.1 Each form submitted by an HMO for the purpose of receiving a certificate of authority must be in duplicate. It also must have a letter that lists each form with a brief description of it. The Commissioner will retain one copy of each submittal in the original fo…

3520 REVIEW OF COMPLAINTS BY THE COMMISSIONER 3520.1 Any person, group, association, corporation, or other entity having exhausted the HMO's internal grievance and appeals procedure, unless no process exists, or exhaustion would be futile, may file a written complaint with the Co…

3521 PUBLIC DOCUMENTS All applications, filings, and reports required under the Act shall be treated as public documents, except those which are trade secrets, privileged or quality assurance, commercial, and financial information, other than any annual financial statement that m…

3599 DEFINITIONS 3599.1 "Act" means the Health Maintenance Organization Act of 1996, effective April 9, 1997, D.C. Law 11-235, D.C. Code § 35-4500 et seq. 3599.2 "Annual Dues Revenues" means sources of income received by the Health Maintenance Organization (HMO) for health servic…

3600 APPLICABILITY 3600.1 These regulations shall apply to the treatment of nonpublic personal information about individuals who obtain products or services from licensees primarily for personal, family, or household purposes. 3600.2 These regulations shall not apply to informati…

3601 INITIAL PRIVACY NOTICE TO CONSUMERS REQUIRED 3601.1 A licensee shall provide a clear and conspicuous notice that accurately reflects the licensee's privacy policies and practices to: (a) Any person who becomes a licensee's customer, not later than when the time that the lice…

3602 ANNUAL PRIVACY NOTICE TO CUSTOMERS REQUIRED 3602.1 A licensee shall provide a clear and conspicuous notice to all customers for whom the licensee possesses the name and address that accurately reflects the licensee's privacy policies and practices not less than annually duri…

3603 INFORMATION TO BE INCLUDED IN PRIVACY NOTICES 3603.1 The initial, annual and revised privacy notices that a licensee provides about its privacy policies and practices under §§ 3601 and 3602 shall include each of the following items of information: (a) The categories of nonpu…

3604 LIMITATION ON DISCLOSURE OF NONPUBLIC PERSONAL INFORMATION ABOUT CONSUMERS TO NONAFFILIATED THIRD PARTIES 3604.1 Except as otherwise authorized in this regulation, a licensee may not, directly or through any affiliate, disclose any nonpublic personal information about a cons…

3605 FORM AND METHOD OF PROVIDING OPT OUT NOTICE TO CONSUMERS; DELIVERY 3605.1 If a licensee is required to provide an opt out notice under § 3604.1 through § 3604.4, the licensee shall provide a clear and conspicuous notice to each of its consumers that accurately explains the r…

3606 EXCEPTION TO OPT OUT REQUIREMENTS FOR SERVICE PROVIDERS AND JOINT MARKETING 3606.1 The opt out requirements in §§ 3604 and 3605 do not apply when a licensee provides nonpublic personal information about a consumer to a nonaffiliated third party to perform services for the li…

3607 EXCEPTIONS TO NOTICE AND OPT OUT REQUIREMENTS FOR PROCESSING AND SERVICING TRANSACTIONS 3607.1 The requirements for initial notice to consumers in subsection 3601.1(b), the opt out notice in §§ 3604 and 3605 and service providers and joint marketing in § 3606 do not apply if…

3608 OTHER EXCEPTIONS TO NOTICE AND OPT OUT REQUIREMENTS 3608.1 The requirements for initial notice to consumers in § 3601.1(b), the opt out in §§ 3604 and 3605, and service providers and joint marketing in § 3606 do not apply when the licensee discloses nonpublic personal inform…

3609 LIMITS ON REDISCLOSURE AND REUSE OF INFORMATION 3609.1 Except as otherwise provided in this regulation, if a licensee receives nonpublic personal information about a consumer from a nonaffiliated financial institution, the licensee shall not, directly or through an affiliate…

3610 LIMITS ON SHARING OF ACCOUNT NUMBER INFORMATION FOR MARKETING PURPOSES 3610.1 A licensee shall not, directly or through an affiliate, disclose other than to a consumer reporting agency, an account number or similar form of access number or access code for consumer's credit c…

3611 PROTECTION OF FAIR CREDIT REPORTING ACT Nothing in this part shall be construed to modify, limit, or supersede the operation of the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.), and no inference shall be drawn on the basis of the provisions of this part regarding wheth…

3612 GRANDFATHER PROVISION Until July 1, 2002, a contract that a licensee has entered into with a nonaffiliated third party to perform services for the licensee has entered into with a nonaffiliated third party to perform services for the licensee or functions on the licensee's b…

3613 INFORMATION SECURITY PROGRAM 3613.1 Each licensee shall implement a comprehensive written information security program that includes administrative, technical and physical safeguards for the protection of customer information. The administrative, technical and physical safeg…

3614 OBJECTIVES OF INFORMATION SECURITY PROGRAM 3614.1 A licensee's information security program shall be designed to: (a) Ensure the security and confidentiality of customer information; (b) Protect against any anticipated threats or hazards to the security or integrity of the i…

3615 EXAMPLES OF METHODS OF DEVELOPMENT AND IMPLEMENTATION 3615.1 Actions and procedures described in §§ 3616 through 3619 of these rules are examples of methods of implementation of the requirements of §§ 3613 and 3614 of this regulation. These examples are non-exclusive illustr…

3616 ASSESS RISK 3616.1 The licensee shall: (a) Identify reasonably foreseeable internal or external threats that could result in unauthorized disclosure, misuse, alteration or destruction of customer information or customer information systems; (b) Assess the likelihood and pote…

3617 MANAGE AND CONTROL RISK 3617.1 The licensee shall: (a) Design its information security program to control the identified risks, commensurate with the sensitivity of the information, as well as the complexity and scope of the licensee's activities; (b) Train staff, as appropr…

3618 OVERSEE SERVICE PROVIDER ARRANGEMENTS 3618.1 The licensee shall: (a) Exercise appropriate due diligence in selecting its service providers; and (b) Require its service providers to implement appropriate measures designed to meet the objectives of this regulation, and, where …

3619 ADJUST THE PROGRAM 3619.1 The licensee shall monitor, evaluate and adjust, as appropriate, the information security program in light of any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and the licen…

3620 DETERMINED VIOLATION 3620.1 Violation of these rules shall constitute an unfair trade practice under § 101(9) of the Insurance Trade and Economic Development Amendment Act of 2000, effective April 3, 2001 (D.C. Law 13-265, D.C. Official Code § 31-2231.01(9)). SOURCE: Emergen…

3621 RESERVED SOURCE: Emergency Rulemaking published at 47 DCR 9052(November 10, 2000) [EXPIRED]; Emergency Rulemaking published at 48 DCR 2356(March 16, 2001) [EXPIRED]; as Emergency Rulemaking published at 48 DCR 6119(July 1, 2001) [EXPIRED]; as Final Rulemaking published at 48…

3622 RESERVED SOURCE: Emergency Rulemaking published at 47 DCR 9052(November 10, 2000) [EXPIRED]; Emergency Rulemaking published at 48 DCR 2356(March 16, 2001) [EXPIRED]; as Emergency Rulemaking published at 48 DCR 6119(July 1, 2001) [EXPIRED]; as Final Rulemaking published at 48…

3623 RESERVED SOURCE: Emergency Rulemaking published at 47 DCR 9052(November 10, 2000) [EXPIRED]; Emergency Rulemaking published at 48 DCR 2356(March 16, 2001) [EXPIRED]; as Emergency Rulemaking published at 48 DCR 6119(July 1, 2001) [EXPIRED]; as Final Rulemaking published at 48…

3624 RESERVED SOURCE: Emergency Rulemaking published at 47 DCR 9052(November 10, 2000) [EXPIRED]; Emergency Rulemaking published at 48 DCR 2356(March 16, 2001) [EXPIRED]; as Emergency Rulemaking published at 48 DCR 6119(July 1, 2001) [EXPIRED]; as Final Rulemaking published at 48…

3625 RESERVED SOURCE: Emergency Rulemaking published at 47 DCR 9052(November 10, 2000) [EXPIRED]; Emergency Rulemaking published at 48 DCR 2356(March 16, 2001) [EXPIRED]; as Emergency Rulemaking published at 48 DCR 6119(July 1, 2001) [EXPIRED]; as Final Rulemaking published at 48…

3626 RESERVED SOURCE: Emergency Rulemaking published at 47 DCR 9052(November 10, 2000) [EXPIRED]; Emergency Rulemaking published at 48 DCR 2356(March 16, 2001) [EXPIRED]; as Emergency Rulemaking published at 48 DCR 6119(July 1, 2001) [EXPIRED]; as Final Rulemaking published at 48…

3627 RESERVED SOURCE: Emergency Rulemaking published at 47 DCR 9052(November 10, 2000) [EXPIRED]; Emergency Rulemaking published at 48 DCR 2356(March 16, 2001) [EXPIRED]; as Emergency Rulemaking published at 48 DCR 6119(July 1, 2001) [EXPIRED]; as Final Rulemaking published at 48…

3628 RESERVED SOURCE: Emergency Rulemaking published at 47 DCR 9052(November 10, 2000) [EXPIRED]; Emergency Rulemaking published at 48 DCR 2356(March 16, 2001) [EXPIRED]; as Emergency Rulemaking published at 48 DCR 6119(July 1, 2001) [EXPIRED]; as Final Rulemaking published at 48…

3629 RESERVED SOURCE: Emergency Rulemaking published at 47 DCR 9052(November 10, 2000) [EXPIRED]; Emergency Rulemaking published at 48 DCR 2356(March 16, 2001) [EXPIRED]; as Emergency Rulemaking published at 48 DCR 6119(July 1, 2001) [EXPIRED]; as Final Rulemaking published at 48…

3630 RESERVED SOURCE: Emergency Rulemaking published at 47 DCR 9052(November 10, 2000) [EXPIRED]; Emergency Rulemaking published at 48 DCR 2356(March 16, 2001) [EXPIRED]; as Emergency Rulemaking published at 48 DCR 6119(July 1, 2001) [EXPIRED]; as Final Rulemaking published at 48…

3631 RESERVED SOURCE: Emergency Rulemaking published at 47 DCR 9052(November 10, 2000) [EXPIRED]; Emergency Rulemaking published at 48 DCR 2356(March 16, 2001) [EXPIRED]; as Emergency Rulemaking published at 48 DCR 6119(July 1, 2001) [EXPIRED]; as Final Rulemaking published at 48…

3632 RESERVED SOURCE: Emergency Rulemaking published at 47 DCR 9052(November 10, 2000) [EXPIRED]; Emergency Rulemaking published at 48 DCR 2356(March 16, 2001) [EXPIRED]; as Emergency Rulemaking published at 48 DCR 6119(July 1, 2001) [EXPIRED]; as Final Rulemaking published at 48…

3633 RESERVED SOURCE: Emergency Rulemaking published at 47 DCR 9052(November 10, 2000) [EXPIRED]; Emergency Rulemaking published at 48 DCR 2356(March 16, 2001) [EXPIRED]; as Emergency Rulemaking published at 48 DCR 6119(July 1, 2001) [EXPIRED]; as Final Rulemaking published at 48…

3634 RESERVED SOURCE: Emergency Rulemaking published at 47 DCR 9052(November 10, 2000) [EXPIRED]; Emergency Rulemaking published at 48 DCR 2356(March 16, 2001) [EXPIRED]; as Emergency Rulemaking published at 48 DCR 6119(July 1, 2001) [EXPIRED]; as Final Rulemaking published at 48…

3635 RESERVED SOURCE: Emergency Rulemaking published at 47 DCR 9052(November 10, 2000) [EXPIRED]; Emergency Rulemaking published at 48 DCR 2356(March 16, 2001) [EXPIRED]; as Emergency Rulemaking published at 48 DCR 6119(July 1, 2001) [EXPIRED]; as Final Rulemaking published at 48…

3636 RESERVED SOURCE: Emergency Rulemaking published at 47 DCR 9052(November 10, 2000) [EXPIRED]; Emergency Rulemaking published at 48 DCR 2356(March 16, 2001) [EXPIRED]; as Emergency Rulemaking published at 48 DCR 6119(July 1, 2001) [EXPIRED]; as Final Rulemaking published at 48…

3637 RESERVED SOURCE: Emergency Rulemaking published at 47 DCR 9052(November 10, 2000) [EXPIRED]; Emergency Rulemaking published at 48 DCR 2356(March 16, 2001) [EXPIRED]; as Emergency Rulemaking published at 48 DCR 6119(July 1, 2001) [EXPIRED]; as Final Rulemaking published at 48…

3638 RESERVED SOURCE: Emergency Rulemaking published at 47 DCR 9052(November 10, 2000) [EXPIRED]; Emergency Rulemaking published at 48 DCR 2356(March 16, 2001) [EXPIRED]; as Emergency Rulemaking published at 48 DCR 6119(July 1, 2001) [EXPIRED]; as Final Rulemaking published at 48…