If you’re enrolled in a health insurance policy held in another person’s name, like a parent or spouse, that person is considered the policy holder of your health plan. Your health insurance company sends some of your confidential health information – like the name of your provider and the services you received and when – to the policy holder, as part of regular health insurance communications. If you’re under 18 and want more information about your rights to access confidential health services, visit TeenSource.org.
You are here
Frequently Asked Questions
Thanks to the Confidential Health Information Act, if you have health insurance under another person’s plan (like a parent or spouse), you can take action to protect your private health information. Learn more below.
Why is this important?
What problem does this fix?
Why does my health insurance company send information to the policy holder in the first place?
Consumer protection law sometimes requires insurance companies to send the person who owns an insurance plan, called the policy holder, information about how and when an insurance plan is being used. Many times health insurance companies do this even when it is not required because they think it helps the owner of the plan understand how their plan is being used. Unfortunately, this can lead to your private health information being shared. Now, California law requires insurance companies to accept Confidential Communications Requests and stop sharing that information. It just takes you sending in the request. (Download the Confidential Communication Request.)
Who should think about submitting a Confidential Communications Request (CCR)?
What does "confidential" mean?
If information is "confidential," that means that it will be kept private and won't be shared unless you say that it is OK to do so.
The basics of a Confidential Communications Request
What is a Confidential Communications Request (CCR)?
When you send your health insurance company a Confidential Communications Request (CCR), they must stop sharing your confidential health information with your health plan’s policyholder (usually a parent or spouse). Health insurance companies must accept your request. (Download a Confidential Communications Request.)
Does an insurance company have to honor my Confidential Communications Request (CCR)?
Your insurance company must accept your CCR in two situations:
- When you ask for confidentiality regarding sensitive services you might receive. "Sensitive services" are defined by the law to include, among other services:
- sexual and reproductive health services
- birth control
- STD / HIV testing and treatment
- pap smear/ annual exam
- sexual assault services
- drug treatment
Note: You can ask for confidential communications for other types of information and health services – but the health insurance company does not have to accept the CCR in those other situations.
Does sending in a Confidential Communications Request (CCR) mean that my health insurance company cannot send communications out about me and my health treatment at all?
No. The insurance company can send an Explanation of Benefits (EOB) or other communications, but it has to send it to you:
- At the new mailing address you provide them in your CCR, or
- In the alternate format you request, such as by email.
For this reason, it is important you provide them good and clear information on where to send communications and keep the information up to date. (Download the Confidential Communications Request.)
Does a CCR cover billing communications? If I submit a CCR, will it prevent my insurance provider from sending bills to the policyholder?
Yes, a CCR covers all communications from the insurance company to the policyholder - either those related to sensitive services or all communications - depending on which reason you state in your CCR. This means that a CCR prevents your insurance provider from sending bills and communications related to billing the policyholder.
Completing a Confidential Communications Request
What does a Confidential Communications Request (CCR) need to look like? What do I need to say or include in one?
A CCR can be made verbally on the phone or in writing. Many health insurance companies will have a form they will ask you to fill out if you want to file a CCR. It might be online or on paper. If your insurance company doesn’t have a specific CCR form, you can use the form on this website.
If you choose to write your own CCR, you have to include the following information:
- Your name
- Your insurance card number
- that you are making a “confidential communication request” (this specific language is important!)
- The information you want to keep confidential and why. The insurance company must accept your request if you say one of the following two things:
- For any sensitive services you might receive. “Sensitive services" is defined by the law to include, among other services:
- mental health counseling
- sexual and reproductive health services (including birth control, abortion, pap smear/ annual exam, STD services)
- sexual assault services
- and drug treatment
- If sharing of all or part of the information that might be revealed in an health insurance communication to the policy holder could lead to harm or harrassment, regardless of the type of health care sought. You don’t have to say why it might endanger you.
- How you want communications sent to you (email, fax, text, U.S. Mail)
- Contact information for sending the communication in your preferred method
- A last-resort mailing address the insurance company can send communications to, in case they aren’t able to send something in the manner requested above
Does a Confidential Communications Request (CCR) have to be in writing?
A CCR does not have to be in writing; but California law gives a health insurance company the right to ask you to put your CCR in writing. Call your health insurance company to find out whether it accepts CCR requests by phone or whether they want to receive something online or by email, fax, or regular U.S.mail. You can use this script to talk to your health insurer. It’s a good idea to put the request in writing in case anything goes wrong, but in an emergency you might contact the company to see whether it can act on a telephone request. You can find customer service information on your health plan's website or on the back of your health insurance card.
Can I call my health insurance company to submit a CCR? How do I explain that I want to submit a CCR?
You can contact your health insurer to find out whether it accepts CCR requests by phone or whether they want to receive something online or by email, fax, or regular U.S. mail. You can do so by calling the toll-free number listed on the back of your health insurance card. You can use this script to make the request.
Timing of requests and health appointments
Could I complete a Confidential Communications Request (CCR) the same day as my health service and be assured that an Explanation of Benefits (EOB) or other communication will not go home to the policyholder?
Maybe. To make sure an EOB will not go home to a partner or parent, you should talk with your health care provider about the timing of your request and their insurance billing process. The insurance company must put your CCR into effect within 7 days of receiving the CCR by phone or email/online. The company has 14 days to put the CCR into effect after they receive a request sent by first-class mail. You can call your insurance company to find out the status of your request and whether it is in effect. By law, they must let you know.
Does a new Confidential Communications Request (CCR) have to be completed at each health appointment?
No. A new CCR does NOT have to be completed at each health appointment. Once a CCR is in place, your insurance company must continue to follow it until you either change your CCR by completing a new form OR you write to your insurance company to say that you no longer want a CCR in place.
Questions from health care providers
What if there is a co-pay owed for the service being provided? How does the provider communicate with the patient about payment of the co-pay if there is a Confidential Communications Request (CCR) in place?
Health care providers may communicate freely with their patients regarding payments. A CCR only restricts communications from the insurance company to a policyholder. It does not limit a provider’s ability to communicate with a patient or others responsible for payment of services.
Who is responsible for paying for services not covered by insurance?
This depends on the age of the patient and the type of services provided. Typically, adult patients, including young adult patients, are financially responsible for their own health services – even if the patient’s insurance is in someone else’s name. Some patients that are minors may also be financially liable for their own health services in some cases. This is a good question to talk through with your legal counsel and billing department.
May I communicate with a health insurance company regarding a patient’s Confidential Communications Request (CCR)?
Yes. A CCR only limits an insurance company’s ability to send communications to a policyholder. It does not limit an insurance company from communicating with a health care provider and it does not limit a provider from communicating with an insurance company.
Questions from policy holders
If I am the policyholder, am I responsible for paying the co-pays for my child under age 18 when he or she accesses services confidentially and makes a Confidential Communications Request (CCR)?
In most cases, no, but it depends on your child’s age and the type of services obtained. In almost all situations, when teenagers under 18 obtain confidential “sensitive services” without parent or guardian knowledge, the parent or guardian is not liable for payment for any of the health care received.
However, if teenagers under age 18 obtain health care that is not a “sensitive service,” such as a physical for school, their parent or guardian is typically, but not always, liable. That is also true for younger children. If there are legal custody or support orders in place, that order may control which parent or guardian is liable for the care and which parent or guardian may submit a CCR on behalf of the child.
No matter who is responsible, it is important to know that because of the Affordable Care Act, health plans now are required to cover many prevenitive services without charging a co-pay. Find a list of prevenitive services that are available without a co-pay. If you are unsure about whether you would have to pay out of pocket, contact your health care provider and your insurance provider.
Can I find out about deductibles and out-of-pocket costs on my health plan, even if members of my family insured on my policy have Confidential Communications Requests (CCRs) in place?
Yes. All plans have out-of-pocket maximums and deductible caps. Once your family has reached the cap or maximum, you no longer have to pay deductibles received or out-of-pocket costs. So knowing how much has been paid by everyone insured on your plan is important. You may find out about general amounts charged to get to your deductible cap or out-of-pocket maximum. However, if a CCR is in place, then you may not require the insurance company to provide details of the care under your plan or which dependent obtained it.
Who is covered under SB 138?
How can I know if my health insurance plan is covered under SB 138?
Most health insurance plans in California are covered by SB 138, meaning they must accept your CCR. However, there are some exceptions.
For example, you may not be covered if the primary policyholder (likely your parent or partner) works for an employer who is self-insured. The best way to find out if your plan is self-insured is to contact your insurance provider’s customer service department. Even if it is self-insured, your insurance provider still may choose to accept your CCR as provided under a national law called "HIPAA." If you have any problems submitting a CCR or getting your CCR accepted and honored by your health plan, please contact us for support.
I have a Medi-Cal Managed health plan. Am I covered under SB 138?
Most likely, yes. Most Medi-Cal Managed plans are required to comply with SB 138, but there are a few exceptions. If your Medi-Cal Managed plan is through a County Organized Health System, contact your plan to make sure they will honor your CCR. If you have any problems submitting a CCR or getting your CCR accepted and honored by your health plan, please contact us for support.
If my health insurance plan is based outside of California, am I covered under SB 138?
If your insurance provider does business in California but is based in another state, your insurance plan may have to comply with SB 138.
For example, is a college student in California covered if she is on her parent's insurance and both her parent and the insurance plan are based in Ohio?The best way to find out if your plan will comply with your CCR is to contact your health plan's customer service department. Even if it is not required to comply with California law, your insurance company still may choose to accept your CCR. In fact, because of another law (HIPAA), insurance companies throughout the United States must accept CCRs in certain cases. If you have any problems submitting a CCR or getting your CCR accepted and honored by your health plan, please contact us for support.