The following words and terms, when used in this subchapter, shall have the following meanings, unless the context clearly indicates otherwise. Unless otherwise defined in this subchapter, each term that is used in this subchapter that is defined in subchapter A of this chapter shall have the meaning assigned by subchapter A of this chapter.
  (1) Authorization--Executed document that signifies that the signer of the authorization is providing informed permission that nonpublic personal health information held by a covered entity and described in the document may be released to other parties pursuant to the terms of the document.
  (2) Authorization form--A form provided by a covered entity which, if signed and dated by a consumer as set forth in this subchapter, constitutes an authorization under this subchapter.
  (3) Consumer--An individual or that individual's representative who seeks to obtain, obtains or has obtained an insurance product or service from a covered entity, and about whom the covered entity has nonpublic personal health information.
  (4) Covered entity--A person who holds or is required to hold a license, registration, certificate of authority, or other authority under the Insurance Code or another insurance law of this state. The term includes, but is not limited to, an insurance company, group hospital service corporation, mutual insurance company, local mutual aid association, statewide mutual assessment company, stipulated premium insurance company, health maintenance organization, reciprocal or interinsurance exchange, Lloyd's plan, fraternal benefit society, county mutual insurer, farm mutual insurer, viatical or life settlement provider or broker, or insurance agent. For purposes of this subchapter, "covered entity" has the same meaning as "licensee" as used in Article 28B.01(2), Insurance Code.
  (5) Health care operations--As set forth in the Health Insurance Portability and Accountability Act and Privacy Standards. The term does not include marketing as described in 45 C.F.R. §164.514(e) and any subsequent amendments.
  (6) Health Insurance Portability and Accountability Act and Privacy Standards--The privacy requirements of the Administrative Simplification subtitle of the Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. Section 1320d et seq.) and the final rules adopted on December 28, 2000, and published at 65 Fed. Reg. 82798 et seq., and any subsequent amendments.
  (7) Marketing--The promotion or advertisement, by a covered entity, of specific products or services if the covered entity receives, directly or indirectly, a financial incentive or remuneration for the use, access, or disclosure of protected health information. Marketing includes, but is not limited to, communications to an individual based on prescription patterns or protected health information intended to encourage or discourage the individual's use of prescription or non-prescription medicine, medical devices or any other product. Marketing does not include a communication, by a covered entity, health care provider, or participants in an organized health care arrangement or their affiliated covered entities or business associates, necessary to provide treatment or perform health care operations.
  (8) Nonpublic personal health information--Has the same meaning as "protected health information."
  (9) Prescription information--Any information, whether oral or recorded in any form or medium, that:
    (A) relates to or concerns a prescription created or received by a covered entity, health care provider, public health authority, employer, school or university, or health care clearinghouse; and
    (B) relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to the individual, or the utilization of health care by the individual.
  (10) Prescription pattern--A profile or other summary of an individual's prescription information.
  (11) Protected health information--Individually identifiable health information collected from an individual, including the individual's name, address, social security number and demographic information, that:
    (A) relates to:
      (i) the past, present, or future physical or mental health or condition of the individual;
      (ii) the provision of health care to the individual; or
      (iii) the past, present, or future payment for the provision of health care to the individual; and
    (B) either identifies the individual or provides a reasonable basis to believe the information can be used to identify the individual.
  (12) Request for authorization--A written or electronic transmission requesting an authorization pursuant to this subchapter.

Source Note: The provisions of this §22.52 adopted to be effective September 1, 2002, 27 TexReg 6504