Title 33

(1) Except as provided in subsection (5), the obligations imposed under this chapter do not apply to a licensee that is a covered entity under the provisions of federal regulations that are part of the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), 4…

The commissioner may adopt rules to carry out the provisions of this chapter.

(1) Except as provided in subsection (2), an insurance institution, insurance producer, or insurance-support organization may not use or authorize the use of pretext interviews to obtain information in connection with an insurance transaction. (2) A pretext interview may be under…

A licensee shall provide a clear and conspicuous notice of information practices that accurately reflects its privacy policies and practices to individuals about whom personal information is collected and disclosed by the licensee in connection with insurance transactions as foll…

An insurance institution or insurance producer shall clearly specify the questions that are designed to obtain information from an individual in connection with an insurance transaction solely for marketing or research purposes.

(1) An insurance institution, insurance producer, or insurance-support organization may not prepare or request an investigative consumer report about an individual in connection with an insurance transaction involving an application for insurance, a policy renewal, a policy reins…

If a disclosure authorization is required by this chapter, the following requirements apply: (1) A valid authorization to disclose personal information must be in written form, or in electronic form as provided by applicable law, and must contain the following: (a) the identity o…

(1) If an individual, after proper identification, submits a written request to an insurance institution, insurance producer, or insurance-support organization for access to recorded personal information about the individual that is reasonably described by the individual and reas…

(1) Within 30 business days from the date of receipt of a written request from an individual to correct, amend, or delete any recorded personal information in its possession about the individual, an insurance institution, insurance producer, or insurance-support organization shal…

(1) If an adverse underwriting decision is made, the insurance institution or insurance producer responsible for the decision shall: (a) either provide the applicant, policyholder, or individual proposed for coverage with the specific reason or reasons for the adverse underwritin…

An insurance institution, insurance producer, or insurance-support organization may not seek information in connection with an insurance transaction concerning: (1) any previous adverse underwriting decision experienced by an individual unless the inquiry also requests the reason…

An insurance institution or insurance producer may not base an adverse underwriting decision in whole or in part: (1) on the fact of a previous adverse underwriting decision or on the fact that an individual previously obtained insurance coverage through a residual market mechani…

(1) Except as provided in this section, a licensee may not disclose personal or privileged information about an individual collected or received in connection with an insurance transaction. (2) Disclosure may be made with the written authorization of the individual. The authoriza…

(1) Except as permitted in this section, a licensee may not use or disclose personal information for a marketing purpose. For the purposes of this section, an insurance producer who describes to the producer's clients products or services available through the producer is not eng…

(1) An insurance institution or insurance-support organization shall, within 30 days of receiving a written request from an entity listed in subsection (2) that it provides coverage for, disclose to that entity the following information that the entity specifically requests about…

(1) A health carrier as defined in 33-2-2402 shall establish and maintain the following application programming interfaces for the benefit of the carrier's insureds and contracted providers: (a) a patient access application programming interface, pursuant to 42 CFR 422.119(a) thr…

(1) Any licensee or insurance-support organization that conducts business in Montana and that owns or licenses computerized data that includes personal information shall provide notice of any breach of the security of the system following discovery or notice of the breach of the …

(1) The commissioner has the power to examine and investigate the affairs of every insurance institution or insurance producer doing business in this state to determine whether the insurance institution or insurance producer has been or is engaged in any conduct in violation of t…

For the purpose of this chapter, an insurance-support organization transacting business outside this state that has an effect on a person residing in this state is considered to have appointed the commissioner to accept service of process on its behalf. The party seeking service …

A person who violates this chapter is subject to the civil penalty provided in 33-1-317.

(1) If any insurance institution, insurance producer, or insurance-support organization fails to comply with 33-19-301, 33-19-302, or 33-19-303 with respect to the rights granted under those sections, any person whose rights are violated may apply to the district court of this st…

A cause of action or claim for relief in the nature of defamation, invasion of privacy, or negligence does not arise against any person for disclosing personal or privileged information in accordance with this chapter, nor does such a cause of action or claim for relief arise aga…

Any person who knowingly and willfully obtains information about an individual from an insurance institution, insurance producer, or insurance-support organization under false pretenses shall be fined not more than $10,000 or imprisoned for not more than 1 year, or both.