Montana Title 33. Insurance and Insurance Companies § 33-19-105. Exemption based on federal standards for privacy of individually identifiable health information--notice to commissioner required--rules

(1) The obligations imposed under this chapter do not apply to a licensee that is a covered entity under the provisions of federal regulations that are part of the federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), 45 CFR, parts 160 and 164, standards for privacy of individually identifiable health information or security standards for the protection of electronic health information as to any use or disclosure of personal information that is covered under the HIPAA privacy and security regulations, except for the following provisions:

(2) The commissioner may adopt rules regarding the exceptions from the exemption provisions described in subsection (1), including additional exceptions that embody substantive provisions of this chapter but would not be preempted by HIPAA privacy regulations.

(3) If a licensee considers itself exempt from a provision of this chapter for the reason provided in subsection (1), the licensee shall give written notice to the commissioner of that exemption and a brief statement describing why the licensee is a HIPAA-covered entity.

(4) A licensee may claim an exemption only for those lines of business that are subject to HIPAA privacy regulations. All other lines of business are subject to this chapter.

(5) A business associate, as defined in the HIPAA privacy regulations, 45 CFR 160.103, that is a party to a valid business associate agreement required by HIPAA privacy regulations is exempt from the provisions of this chapter, but only as to the scope of that particular agreement. Any activity of the business associate that falls outside of the scope of that agreement is subject to the provisions of this chapter.

(6) The commissioner retains the authority to conduct complete market conduct examinations of the licensee as to the privacy policies and practices that are subject to state privacy laws.

(7) Beginning July 1, 2011: