Ohio Code § 3901.89

§ 3901.89.

(A) As used in this section: (1) “ Full-time employee ” means an employee working an average of at least thirty hours of service per week

during a calendar month, or at least one hundred thirty hours of service during the

calendar month. (2) “ Group policyholder ” means a policyholder for a health insurance policy covering fifty or more full-time

employees.  “ Group policyholder ” includes an authorized representative of a group policyholder. (3) “Health plan issuer” has the same meaning as in section 3922.01 of the Revised Code . (B)(1)(a) A health plan issuer shall, upon request, release to each group policyholder monthly

claims data and shall provide this data within thirty business days of receipt of

the request. (b) A health plan issuer shall not be required to release claims information as required

in division (B)(1)(a) of this section more than once per calendar year per group policyholder. (2) The data released shall include all of the following with regard to the policy in

question for the policy period immediately preceding or the current policy period,

as requested by the policyholder: (a) The net claims paid or incurred by month; (b)(i) If the group policyholder is an employer, the monthly enrollment data by employee

only, employee and spouse, and employee and family; (ii) If the group policyholder is not an employer, the monthly enrollment data shall be

provided and organized in a relevant manner. (c) Monthly prescription claims information; (d) Paid claims over thirty thousand dollars, including claim identifier other than name

and the date of occurrence, the amount paid toward each claim, and claimant health

condition or diagnosis. (C) A health plan issuer that discloses data or information in compliance with division

(B) of this section may condition any such disclosure upon the execution of an agreement

with the policyholder absolving the health plan issuer from civil liability related

to the use of such data or information. (D) A health plan issuer that provides data or information in compliance with division

(B) of this section shall be immune from civil liability for any acts or omissions

of any person's subsequent use of such data or information. (E) This section shall not be construed as authorizing the disclosure of the identity

of a particular individual covered under the group policy, nor the disclosure of any

covered individual's particular health insurance claim, condition, or diagnosis, which

would violate federal or state law. (F) A group policyholder is entitled to receive protected health information under this

section only after an appropriately authorized representative of the group policyholder

makes to the health plan issuer a certification substantially similar to the following: “I hereby certify and have demonstrated that the plan documents comply with the requirements

of 45 C.F.R. 164.504(f)(2) and that the group policyholder will safeguard and limit the use and disclosure of

protected health information that the policyholder may receive from the group health

plan to perform plan administration functions.” (G) A group policyholder that does not provide the certification required in division

(F) of this section is not entitled to receive the protected health information described

in division (B)(2)(d) of this section, but is entitled to receive a report of claim

information that includes the other information described under division (B) of this

section. (H) Committing a series of violations of this section that, taken together, constitute

a practice or pattern shall be considered an unfair or deceptive practice under sections 3901.19 to 3901.26 of the Revised Code . (I) Nothing in this section shall be construed as prohibiting a health plan issuer from

disclosing additional claims information beyond what is required by this section.