When conducting a utilization review, a health insurance issuer shall do all of the following:
(1) Accept any evidence-based information from a provider that will assist in the utilization review.
(2) Collect only the information necessary to authorize the service and maintain a process for the provider to submit the records.
(3) If medical records are requested, require only the portion of the medical record necessary in that specific case to determine medical necessity or appropriateness of the service to be delivered, including admission or extension of stay, frequency, or duration of service.
(4) Base review determinations on the medical information in the enrollee's records obtained by the health insurance issuer up to the time of the review determination.