Can a state agency hand an employee's bank account information to a private third-party administrator that runs the agency's flexible spending account program?
Plain-English summary
NC Flex, the state employees' flexible spending account program, wanted to offer direct deposit for reimbursements. Aon Consulting, the third-party administrator running the spending accounts, needed employees' bank account numbers and routing numbers to make those deposits. The State Personnel Director asked the Attorney General whether handing Aon that information was a disclosure barred by G.S. 126-22, the personnel-records confidentiality statute.
Senior Deputy AG Ann Reed and Special Deputy AG Alexander Peters concluded the release was permissible. Their reasoning turned on agency law. Aon was not an outside entity receiving employee records; Aon was acting as NC Flex's contractual agent in administering the spending accounts. Information moving from NC Flex to its agent is not a "disclosure" in the relevant sense, because the agent stands in the principal's place. The opinion cited Branch Banking & Trust Co. v. Creasy for the standard definition: "An agent is one who acts for or in the place of another by authority from him."
The opinion did not stop at the agency point. It stressed that Aon, as agent, owed a duty of confidentiality to NC Flex equivalent to the duty NC Flex itself owed under G.S. 126-22, and that Aon's employees should be aware of G.S. 126-27, which makes it a Class 3 misdemeanor (up to a $500 fine) to give unauthorized persons access to confidential state-employee information. The AG noted Aon's contract with NC Flex already addressed confidentiality.
Currency note
This opinion was issued in 1999. Subsequent statutory amendments, court decisions, or later AG opinions may have changed the analysis. Treat this page as historical context, not current legal advice. Verify current law before relying on any specific rule, deadline, or remedy mentioned here.
NC Flex still exists, but the state's third-party administrator has changed multiple times since 1999 and federal privacy law (HIPAA, particularly for the medical FSA component) has changed dramatically. The agency-law analysis here remains a useful starting point, but any current state agency considering a similar data-sharing arrangement should also look at HIPAA business associate rules, the State Privacy Act provisions added after 1999, and any modern Office of State Human Resources guidance on FSA administration.
Common questions
Q: Was the AG saying a state agency can hand employee data to any private vendor?
A: No. The opinion is narrow. It hinged on Aon being NC Flex's contractual agent for purposes of administering the spending accounts. A vendor in some other relationship, like a research firm buying employee data, would not have the same agent-law shield.
Q: What was G.S. 126-22 doing in this analysis?
A: G.S. 126-22 declares state employee personnel files confidential and not subject to inspection under the general public-records statute G.S. 132-6. The opinion quoted the broad sweep of "personnel file" in the statute (application, selection, promotion, demotion, transfer, leave, salary, suspension, performance evaluations, disciplinary actions, termination, "wherever located and in whatever form"). Bank deposit information held by a state employer to pay an employee fell within that definition.
Q: What was the duty Aon owed?
A: As agent, Aon owed NC Flex a fiduciary duty of confidentiality. Practically, that meant the same nondisclosure standard the state itself was bound by, enforced through both the agency contract and (for Aon's employees) the criminal sanction in G.S. 126-27.
Q: What was G.S. 126-27's penalty?
A: A Class 3 misdemeanor, with a fine of up to $500.00, for providing any unauthorized person access to confidential state-employee information.
Q: Did the AG flag any other concern?
A: The opinion was straightforward. The only caution was the assumption that Aon's existing contract addressed confidentiality. If a future TPA contract did not contain explicit confidentiality terms, the analysis would shift.
Background and statutory framework
State employees can elect to put pre-tax dollars into flexible spending accounts for unreimbursed medical expenses or dependent care expenses. The accounts are administered under N.C. Flex by a third-party administrator, paid for by participant fees and state contributions. Aon Consulting was the TPA at the time of this opinion.
For an employee to receive a reimbursement, the TPA must process a claim, verify eligibility, and issue payment. Direct deposit requires the employee's bank routing and account number on file with the TPA. Without an agency-law theory of the relationship, that data transfer would be a disclosure of confidential personnel information to a private company.
G.S. 126-22's blanket confidentiality was the strict starting point. G.S. 126-27 backed up the confidentiality with criminal sanction. The AG threaded these statutes by treating Aon as standing in NC Flex's shoes for the spending-account program, then layered the criminal-statute warning over Aon's own employees as additional protection.
Citations
- N.C. Gen. Stat. § 126-22 (confidentiality of state employee personnel files)
- N.C. Gen. Stat. § 126-27 (Class 3 misdemeanor for unauthorized disclosure)
- N.C. Gen. Stat. § 132-6 (right to inspect public records, qualified by personnel-records exemption)
- Branch Banking & Trust Co. v. Creasy, 301 N.C. 44, 56, 269 S.E.2d 117, 124 (1980) (definition of agent)
Source
Original opinion text
Reply to: ALEXANDER MCC. PETERS SERVICE TO STATE AGENCIES 919.716.6800 FAX: 919.716.6755 E-MAIL: [email protected]
November 30, 1999
Mr. Ronald Penny State Personnel Director Office of State Personnel 116 West Jones Street Raleigh, North Carolina 27603-8004
Re: Advisory Opinion: N.C. GEN. STAT. § 126-22 Direct Deposit for Spending Account Participants of NC Flex by Aon Consulting as Agent of the State of North Carolina
Dear Mr. Penny:
You have asked for our opinion regarding NC Flex's proposal to provide, through its third-party administrator, for the direct deposit of payments to spending account participants. Specifically, you have asked whether the contractual arrangement with Aon Consulting, which acts as third-party administrator for the spending accounts, legally allows for the release of participant's bank account information to Aon Consulting, and also whether any confidentiality or privacy laws will be violated by such a release of direct deposit information to Aon Consulting. For reasons set out below, it is our opinion that NC Flex may release direct deposit information to Aon Consulting as proposed.
N.C. GEN. STAT. § 126-22 provides, in pertinent part:
Personnel files of State employees, former State employees, or applicants for State employment shall not be subject to inspection and examination as authorized by G.S. 132-6. For purposes of this Article, a personnel file consists of any information gathered by the department, division, bureau, commission, council, or other agency subject to Article 7 of this Chapter which employs an individual, previously employed an individual, or considered an individual's application for employment, or by the office of State Personnel, and which information relates to the individual's application, selection or nonselection, promotions, demotions, transfers, leave, salary, suspension, performance evaluation forms, disciplinary actions, and termination of employment wherever located and in whatever form.
Aon Consulting acts as the agent of the State of North Carolina and of NC Flex in administering the spending accounts of participants of NC Flex. Since Aon Consulting acts as NC Flex's agent in this regard, NC Flex may appropriately provide Aon Consulting with the information necessary to carry out this agency on behalf of NC Flex and of the State. Indeed, because Aon Consulting acts as NC Flex's agent, it is our opinion that there is no disclosure of information involved in NC Flex's proposal, because Aon Consulting acts in the place of and on behalf of NC Flex rather than functioning as a outside entity. See, e.g., Branch Banking & Trust Co. v. Creasy, 301 N.C. 44, 56, 269 S.E.2d 117, 124 (1980) ("[a]n agent is one who acts for or in the place of another by authority from him").
We would stress that, inasmuch as Aon Consulting will be acting as the agent of NC Flex, Aon Consulting will have the duty to strictly maintain the confidentiality of any information that it receives pursuant to that agency. Furthermore, employees of Aon Consulting should be aware of the provisions of N.C. GEN. STAT. § 126-27, which makes it a Class 3 misdemeanor, punishable by a fine of up to $500.00, to provide any unauthorized person access to confidential information regarding State employees. It is our understanding that NC Flex's contract with Aon Consulting specifically address the duty to keep this information confidential.
For the foregoing reasons, it is our opinion that NC Flex may release direct deposit information to Aon Consulting as proposed.
Very truly yours,
Ann Reed
Senior Deputy Attorney General
Alexander McC. Peters
Special Deputy Attorney General
AMP/hs