Opt-in

Health information may not be disclosed without the individual's authorization, except for core insurance functions such as underwriting, claims administration and fraud investigation. It is stricter than the opt-out rule for financial information.