Confidentiality of medical information
N.D. Cent. Code § 26.1-36-12.4
in effect26.1-36-12.4. Confidentiality of medical information
1. An insurance company, as defined in section 26.1-02-01, health maintenance
organization, or any other entity providing a plan of health insurance subject to state
insurance regulation may not deliver, issue, execute, or renew a health insurance
policy or health service contract unless confidentiality of medical information is
assured pursuant to this section. An insurer shall adopt and maintain procedures to
ensure that all identifiable information maintained by the insurer regarding the health,
diagnosis, and treatment of persons covered under a policy or contract is adequately
protected and remains confidential in compliance with all federal and state laws and
regulations and professional ethical standards. Unless otherwise provided by law, any
data or information pertaining to the health, diagnosis, or treatment of a person
covered under a policy or contract, or a prospective insured, obtained by an insurer
from that person or from a health care provider, regardless of whether the information
is in the form of paper, is preserved on microfilm, or is stored in computer-retrievable
form, is confidential and may not be disclosed to any person except:
a. If the data or information identifies the covered person or prospective insured
upon a written, dated, and signed approval by the covered person or prospective
insured, or by a person authorized to provide consent pursuant to section
23-12-13 for a minor or an incapacitated person;
b. If the data or information identifies the health care provider upon a written, dated,
and signed approval by the provider. However, this subdivision may not be
construed to prohibit an insurer from disclosing data or information pursuant to
chapter 23-01.1 or from disclosing, as part of a contract or agreement in which
the health care provider is a party, data or information that identifies a provider as
part of mutually agreed-upon terms and conditions of the contract or agreement;
c. If the data or information does not identify either the covered person or
prospective insured or the health care provider, the data or information may be
disclosed upon request for use for statistical purposes or research;
d. Pursuant to statute or court order for the production or discovery of evidence; or
e. In the event of a claim or litigation between the covered person or prospective
insured and the insurer in which the data or information is pertinent.
2. An insurer may claim any statutory privileges against disclosure that the health care
provider who furnished the information to the insurer is entitled to claim.
3. This section may not be construed to prevent disclosure necessary for an insurer to
conduct utilization review or management consistent with the standards imposed by
chapter 26.1-26.4, to facilitate payment of a claim, to analyze health plan claims or
health care records data, to conduct disease management programs with health care
providers, or to reconcile or verify claims under a shared risk or capitation
arrangement. This section does not apply to data or information disclosed by an
insurer as part of a biomedical research project approved by an institutional review
board established under federal law. Nor may this section be construed to limit the
insurance commissioner's access to records of the insurer for purposes of
enforcement or other activities related to compliance with state or federal laws;
however, medical records acquired by the commissioner as part of an examination of
an insurer's business practices under section 26.1-03-19.2 or any other regulatory
action or proceeding commenced by the commissioner are confidential.
Source: Open US Law by Vaquill AI (CC BY 4.0)URL: https://ndlegis.gov/cencode/t26-1c36.pdf#nameddest=26p1-36-12p4Fetched: 10/16/2026