18.3 Privacy, Fraud, and Consumer Protection

Privacy: GLBA and the Insurance Information Models

The Gramm-Leach-Bliley Act (GLBA) and the NAIC privacy models protect a consumer's nonpublic personal information (NPI). Two pieces matter most on the exam:

• Financial Privacy Rule — insurers must deliver a privacy notice at the start of the relationship and annually thereafter, describing what information is collected and shared.
• Opt-out right — before sharing NPI with a nonaffiliated third party (outside an exception such as servicing the policy or legal compliance), the consumer must be given a reasonable chance to opt out.
• Safeguards Rule — firms must maintain administrative, technical, and physical safeguards for customer data.

Protected health information in insurance is also governed by state insurance-information privacy acts modeled on the NAIC privacy framework; consumers generally must authorize disclosure of medical information, and the authorization must be specific and time-limited. The exam distinguishes a customer (an ongoing policyholder owed annual notices) from a consumer (someone who merely applies or inquires), because the notice obligations differ.

The opt-out has limited reach: it does not block sharing needed to service the policy, process claims, comply with law, or work with the insurer's own affiliates, so a question implying the consumer can stop all data flow is wrong.

FCRA and Credit-Based Insurance Scores

The Fair Credit Reporting Act (FCRA) governs the use of consumer reports (including credit-based insurance scores) in underwriting. Key duties:

An adverse action notice must tell the consumer which agency supplied the report and that the agency did not make the decision, plus the right to a free copy and to dispute errors.

Insurance Fraud: Soft vs. Hard

Insurance fraud is an intentional misrepresentation or concealment of a material fact to obtain a benefit. The exam distinguishes:

Producers commit fraud through application fraud (falsifying applications), premium theft, and fictitious policies. Most states require a fraud-warning statement on applications and claim forms (e.g., "Any person who knowingly files a false claim is guilty of a crime") and grant immunity for good-faith fraud reporting to authorities or the NAIC.

Money Laundering and OFAC

Federal anti-money-laundering (AML) rules and OFAC sanctions apply to covered insurance products (notably cash-value life and annuities, but producers must understand the framework):

• Screen parties against the OFAC Specially Designated Nationals (SDN) list; blocked-party transactions must be frozen and reported.
• File Suspicious Activity Reports (SARs) for red flags such as overpayment of premium followed by a request for a refund to a third party, or reluctance to provide identifying information.
• Maintain a written AML program with training and a designated compliance officer for covered products.

State Fraud Statutes and Warning Statements

Virtually every state has an Insurance Fraud Prevention Act that criminalizes the knowing presentation of false claims and false applications. Two mechanics recur on the exam. First, applications and claim forms must carry a fraud-warning statement, typically reading that any person who knowingly files a statement of claim containing false or misleading information is guilty of a crime and subject to fines and confinement. Second, statutes grant civil immunity to insurers, producers, and others who report suspected fraud in good faith to law enforcement or a fraud bureau, so a fear-of-being-sued answer choice is a trap.

Defenses, Penalties, and Special Investigation Units

Proving fraud generally requires showing a material misrepresentation made knowingly with intent to cause the insurer to rely on it. Penalties scale with the loss and can include felony charges, restitution, civil fines, and license revocation. Many insurers maintain a Special Investigation Unit (SIU) and most states require carriers to report suspected fraud to a state fraud bureau. The producer's role is to recognize red flags, such as claims filed shortly after a policy is bound, inflated repair estimates, or reluctance to provide documentation, and to escalate rather than ignore them.

Consumer Protection Wrap-Up

Producers must also honor do-not-call rules, CAN-SPAM email requirements, and state replacement and suitability disclosures. The unifying theme: the consumer is entitled to accurate information, control over their data, and protection from deception, and the producer's license is the leverage regulators use to enforce all three.

Common Exam Traps

• GLBA uses OPT-OUT, not opt-in, for sharing NPI with nonaffiliated third parties.
• An adverse action under FCRA includes a rate increase or reduced coverage, not just outright declination.
• Soft fraud (padding a real claim) is still fraud, not a victimless overstatement.
• Good-faith fraud reporting is generally immune from civil liability — do not let a "fear of being sued" answer mislead you.