4 states have confidentiality protections specific to EOBs. These states allow insurers to mail an EOB directly to the patient instead of the policy holder.Communications between an insurance company and its policyholderare not inherently protected from disclosure to third parties. The PAC stated that the lease terms did not include information obtained from a person or business as provided in Sec. 7(1)(g).