Bill Text: NY S07262 | 2019-2020 | General Assembly | Introduced
Bill Title: Establishes the wellness program privacy act; requires employers and insurers to take certain measures to protect the security of wellness program participants' private information.
Spectrum: Partisan Bill (Democrat 1-0)
Status: (Introduced - Dead) 2020-01-15 - REFERRED TO INSURANCE [S07262 Detail]
Download: New_York-2019-S07262-Introduced.html
STATE OF NEW YORK ________________________________________________________________________ 7262 IN SENATE January 15, 2020 ___________ Introduced by Sen. THOMAS -- read twice and ordered printed, and when printed to be committed to the Committee on Insurance AN ACT to amend the insurance law, in relation to the establishment of the "Wellness Program Privacy Act" The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. This act shall be known and may be cited as the "Wellness 2 Program Privacy Act". 3 § 2. The insurance law is amended by adding a new section 3239-a to 4 read as follows: 5 § 3239-a. Wellness program privacy. (a) Definitions. For purposes of 6 this section: 7 (1) "Employer" means: 8 (i) any person who directly employs fifty or more persons to perform 9 services for a wage or salary; or 10 (ii) the state and any political or civil subdivision of the state, or 11 any county or city or other municipality. 12 (2) "Collects," "collected," or "collection" means buying, renting, 13 gathering, obtaining, receiving, or accessing any personal information 14 or protected health information pertaining to a consumer by any means. 15 This includes receiving information from such consumer, either actively 16 or passively, or by observing such consumer's behavior. 17 (3) "Administration and operation of a wellness program" means, but is 18 not limited to, the use of personal information when reasonably neces- 19 sary and proportionate to achieve one of the following purposes: 20 (i) detecting and responding to security incidents arising from a 21 wellness program and protecting against malicious, deceptive, fraudu- 22 lent, or illegal activity related to a wellness program; 23 (ii) executing functions of a wellness program for the benefit of the 24 insured; 25 (iii) undertaking internal research for technological development and 26 demonstration related to a wellness program; or 27 (iv) undertaking activities to verify or maintain the quality or safe- 28 ty of a service or device that is owned by, manufactured by, manufac- EXPLANATION--Matter in italics (underscored) is new; matter in brackets [] is old law to be omitted. LBD11029-01-9S. 7262 2 1 tured for, or controlled by the insurer, or to improve, upgrade, or 2 enhance the service or device that is owned by, manufactured by, manu- 3 factured for, or controlled by the insurer related to a wellness 4 program. 5 (4) "Personal information" means information that identifies or could 6 reasonably be linked, directly or indirectly, with a particular consum- 7 er, household, or consumer device. "Personal information" shall not 8 include publicly available information. 9 (5) "Publicly available" means information that is lawfully made 10 available from federal, state, or local government records, if any 11 conditions associated with such information. "Publicly available" shall 12 not mean information collected by an employer or insurer about an enrol- 13 lee without the enrollee's knowledge. "Personal information" does not 14 include enrollee information that is de-identified or aggregate enrollee 15 information. 16 (6) "Retaliatory" or "adverse action" in the context of an employer 17 offering a wellness program to its employees shall include: denial of 18 coverage, termination of employment, requiring one hundred percent 19 payment of medical care premiums when an employer pays a portion of the 20 premium for wellness program participants, or reducing contributions to 21 participants' health savings accounts. 22 (7) "Retaliatory" or "adverse action" in the context of an insurer 23 offering a wellness program shall include: denial of coverage, termi- 24 nation of coverage based on non-participation or failure to achieve 25 wellness targets, or adjustments to insurance premiums. 26 (b) Fair collection and use of personal information. (1) Any insurer 27 or employer that collects a wellness program participant's personal 28 information in the administration and operation of a wellness program 29 shall limit its collection to what is reasonably necessary to operate 30 the wellness program in which a consumer is enrolled. 31 (2) Any insurer or employer that collects a wellness program partic- 32 ipant's personal information in the administration and operation of a 33 wellness program shall limit its use and retention of personal informa- 34 tion to what is reasonably necessary to administer and operate the well- 35 ness program in which a consumer is enrolled and for related administra- 36 tive and operational purposes. 37 (3) No insurer or employer shall share with third parties any personal 38 information or data collected through a wellness program. 39 (4) Following the close of a wellness program, an employee's termi- 40 nation, or the end of an enrollee's term of insurance, any personal 41 information or data shall be deleted or de-identified. 42 (5) Wellness program participants shall have the right to obtain a 43 copy of their wellness program data, and shall have the right to chal- 44 lenge the completeness and accuracy of any data the program has about 45 them. 46 (6) The requirements described in this subdivision shall apply, to the 47 extent that they are applicable, to any entity that an insurer or 48 employer contracts with for purposes of administering or operating a 49 wellness program on such insurer or employer's behalf. 50 (c) Transparency. Any insurer or an employer that collects a wellness 51 program participant's personal information in the administration and 52 operation of a wellness program shall provide such participant with a 53 written explanation of: 54 (1) all data collected in the program; 55 (2) practices related to data sharing, including who will have access 56 to such data; andS. 7262 3 1 (3) the wellness program enrollee's rights concerning the wellness 2 program under federal and state laws, rules, and regulations. 3 (d) Prohibition of discrimination based on participation. (1) Any 4 employer that offers a wellness program to its employees, or any insurer 5 that offers a wellness program to enrollees, shall not engage in retali- 6 atory or adverse action against individuals who do not participate in 7 wellness programs. 8 (2) The total amount of all wellness program incentives shall be 9 limited to an amount deemed by the superintendent not to be coercive. 10 (e) Enforcement and enrollee private right of action. (1) Any consumer 11 who has suffered from a violation of this section by an employer or 12 insurer may bring a lawsuit against such employer or insurer. A 13 violation of this section shall be deemed to constitute an injury in 14 fact to the consumer who has suffered from such violation, and the 15 consumer need not suffer a loss of money or property as a result of the 16 violation in order to bring an action for a violation of this section. 17 (2) A consumer who prevails in such a lawsuit shall obtain the follow- 18 ing remedies: 19 (i) damages in an amount not greater than the increased health or life 20 insurance premium cost due to penalties or lost incentives, or seven 21 hundred fifty dollars per consumer per incident, or actual damages, 22 whichever is greater; 23 (ii) injunctive or declaratory relief, as the court deems proper; 24 (iii) reasonable attorneys' fees and costs; and 25 (iv) any other relief the court deems proper. 26 (3) In assessing the amount of statutory damages, the court shall 27 consider any one or more of the relevant circumstances presented by any 28 of the parties to the case, including, but not limited to, the nature 29 and seriousness of the misconduct, the number of violations, the 30 persistence of the misconduct, the length of time over which the miscon- 31 duct occurred, the willfulness of the defendant's misconduct, and the 32 defendant's assets, liabilities, and net worth. 33 (4) A consumer bringing an action shall notify the attorney general 34 within thirty days that the action has been filed. 35 (5) The attorney general may bring a civil action, in the name of the 36 people of the state, against any employer or insurer in violation of 37 this section. 38 (6) The department may pursue enforcement action against health insur- 39 ers, health plans, or life insurers in violation of this section. 40 (7) Any employer or insurer that violates this section may be liable 41 for a civil penalty of up to seven thousand five hundred dollars for 42 each intentional violation, and up to two thousand five hundred dollars 43 for each unintentional violation. 44 § 3. This act shall take effect immediately.
