S 8203: Requires that a contract between an insurer and a hospital shall include a provision that provides for medical records requested by the insurer or its utilization review agent to be made available electronically by the hospital; limits the use of disclosed records.

  
  STATE OF NEW YORK ________________________________________________________________________ 8203 2025-2026 Regular Sessions  IN SENATE May 21, 2025 ___________ Introduced by Sen. BAILEY -- read twice and ordered printed, and when printed to be committed to the Committee on Insurance AN ACT to amend the insurance law and the public health law, in relation to requiring providers to share electronic medical records with healthcare plans The People of the State of New York, represented in Senate and Assem- bly, do enact as follows: 1 Section 1. Section 3217-b of the insurance law is amended by adding a 2 new subsection (p) to read as follows: 3 (p) A contract between an insurer and a hospital shall include a 4 provision that provides for medical records requested by the insurer or 5 its utilization review agent to be made available electronically by the 6 hospital in accordance with subdivision fifteen of section twenty-eight 7 hundred three of the public health law, including direct access by the 8 insurer or its utilization review agent to retrieve such records to 9 perform utilization review pursuant to title one of article forty-nine 10 of this chapter. 11 § 2. Section 4325 of the insurance law is amended by adding a new 12 subsection (p) to read as follows: 13 (p) A contract between a corporation and a hospital shall include a 14 provision that provides for medical records requested by the corporation 15 or its utilization review agent to be made available electronically by 16 the hospital in accordance with subdivision fifteen of section twenty- 17 eight hundred three of the public health law, including direct access by 18 the corporation or its utilization review agent to retrieve such records 19 to perform utilization review pursuant to title one of article forty- 20 nine of this chapter. 21 § 3. Subsection (g) of section 4905 of the insurance law, as amended 22 by section 5 of subpart C of part AA of chapter 57 of the laws of 2022, 23 is amended to read as follows: EXPLANATION--Matter in italics (underscored) is new; matter in brackets [ ] is old law to be omitted. LBD11577-01-5 
 S. 8203 2 1 (g) When making prospective, concurrent and retrospective determi- 2 nations, utilization review agents shall collect only such information 3 as is necessary to make such determination and shall not routinely 4 require health care providers to numerically code diagnoses or proce- 5 dures to be considered for certification or routinely request copies of 6 medical records of all patients reviewed. During prospective or concur- 7 rent review, copies of medical records shall only be required when 8 necessary to verify that the health care services subject to such review 9 are medically necessary. In such cases, only the necessary or relevant 10 sections of the medical record shall be required. A utilization review 11 agent may request copies of partial or complete medical records retros- 12 pectively. Medical records requested by utilization review agents for 13 purposes of this subsection shall be provided electronically by partic- 14 ipating hospitals pursuant to subdivision fifteen of section twenty- 15 eight hundred three of the public health law. 16 § 4. Section 4406-c of the public health law is amended by adding a 17 new subdivision 14 to read as follows: 18 14. A contract between a health care plan and a hospital shall include 19 a provision that provides for medical records requested by the health 20 care plan or its utilization review agent to be made available electron- 21 ically by the hospital in accordance with subdivision fifteen of section 22 twenty-eight hundred three of this chapter, including direct access by 23 the health care plan or its utilization review agent to retrieve such 24 records to perform utilization review pursuant to title one of article 25 forty-nine of this chapter. 26 § 5. Section 2803 of the public health law is amended by adding a new 27 subdivision 15 to read as follows: 28 15. (a) The commissioner shall require every general hospital subject 29 to this article that participates in a health care plan's provider 30 network to timely share electronic medical records with such health care 31 plan or their utilization review agent for purposes of utilization 32 review performed pursuant to article forty-nine of this chapter or arti- 33 cle forty-nine of the insurance law. Such sharing and transmission of 34 electronic medical records shall be set forth in the contract between 35 the health care plan and the general hospital, in accordance with the 36 requirements of this subdivision. 37 (b) Records disclosed pursuant to paragraph (a) of this subdivision 38 shall: 39 (i) be used exclusively for individual claim care review, adjudication 40 and to promote patient privacy and shall not be used for any auditing 41 function or to detect any historical patterns of billing or abuse; 42 (ii) include the entire medical record and not exclude data which may 43 limit access to admission, discharge, and treatment information; and 44 (iii) not be used by a health care plan to separately request addi- 45 tional information to support a coverage determination if the informa- 46 tion is otherwise available in an electronic medical record. 47 (c) A health care plan using electronic medical records under this 48 subdivision shall not seek information that they are not already permit- 49 ted to receive. Health care plans shall prioritize the safeguarding of 50 their enrollees' data, including their protected health information and 51 personally identifiable information, and must implement interoperability 52 protocols that ensure different billing systems promote access to 53 records. To the extent feasible and necessary, health care plans shall 54 also seek to be Health Information Trust Alliance (HITRUST) certified, 55 which requires demonstrating and following global standards for data 56 security and privacy compliance. 
 S. 8203 3 1 (d) For purposes of this subdivision, "health care plan" means a 2 health maintenance organization certified pursuant to article forty-four 3 of this chapter, an insurer licensed to write accident and health insur- 4 ance pursuant to article thirty-two of the insurance law, a corporation 5 organized pursuant to article forty-three of the insurance law, a munic- 6 ipal cooperative health benefit plan certified pursuant to article 7 forty-seven of the insurance law, or a student health plan established 8 or maintained pursuant to section one thousand one hundred twenty-four 9 of the insurance law. 10 § 6. Subdivision 7 of section 4905 of the public health law, as 11 amended by section 6 of subpart C of part AA of chapter 57 of the laws 12 of 2022, is amended to read as follows: 13 7. When making prospective, concurrent and retrospective determi- 14 nations, utilization review agents shall collect only such information 15 as is necessary to make such determination and shall not routinely 16 require health care providers to numerically code diagnoses or proce- 17 dures to be considered for certification or routinely request copies of 18 medical records of all patients reviewed. During prospective or concur- 19 rent review, copies of medical records shall only be required when 20 necessary to verify that the health care services subject to such review 21 are medically necessary. In such cases, only the necessary or relevant 22 sections of the medical record shall be required. A utilization review 23 agent may request copies of partial or complete medical records retros- 24 pectively. Medical records requested by utilization review agents for 25 purposes of this subdivision shall be provided electronically by health 26 care providers pursuant to subdivision fifteen of section twenty-eight 27 hundred three of this chapter. 28 § 7. This act shall take effect on the ninetieth day after it shall 29 have become a law; provided that sections one, two and four of this act 30 shall apply to contracts issued, renewed, modified, altered or amended 31 on or after such date.