HMO brokers and identifiable utilization data

Overview

Brokers requested employee diagnoses, procedures and confinement details for utilization analysis. The NPC said a broker pursuing its own purposes may be a separate personal information controller. Processing identifiable health data needs an appropriate Section 13 basis and transparency; aggregate statistics may meet the analysis purpose without patient-level disclosure.

Practice implications

Parao Law practice guidance

For physicians

Before releasing utilization reports, ask whether the recipient needs patient-level diagnoses or whether aggregate figures answer the question. Route identifiable requests to the HMO or privacy team. Do not assume a broker’s accreditation or a corporate client’s request authorizes access to clinical details.

For lawyers

Document each party’s role and each purpose, including analytics, research, overseas sharing and insurance sales. Identify the Section 13 basis; if consent is the only available basis, ensure it is informed and specific. Negotiate data minimization and safeguards rather than relying on an unrestricted broker request.