18.3 Privacy (HIPAA/GLBA), Fraud, and Consumer Protection

Privacy Protection

Two federal laws dominate insurance privacy questions.

Gramm-Leach-Bliley Act (GLBA)

GLBA regulates how financial institutions (including insurers) handle nonpublic personal information (NPI) — data a consumer provides on an application or that is generated by the relationship.

Trap: GLBA opt-out applies to sharing with unaffiliated third parties. Sharing with affiliates or as needed to service the policy (e.g., a reinsurer) generally does not require opt-out.

GLBA also requires insurers to distinguish a consumer (someone who merely inquires) from a customer (an ongoing relationship). The recurring annual privacy notice is owed to customers, while the safeguards duty to protect data applies to all collected NPI regardless of relationship status.

HIPAA

The Health Insurance Portability and Accountability Act (HIPAA) has two relevant pillars: (1) the Privacy Rule protecting individually identifiable health information, called protected health information (PHI); and (2) portability provisions that limit how group health plans can exclude preexisting conditions and that prohibit health-status discrimination among similarly situated employees. PHI may not be disclosed without authorization except for treatment, payment, or healthcare operations.

Fair Credit Reporting Act (FCRA)

When an insurer obtains a consumer report or investigative consumer report to underwrite, it must notify the applicant. If coverage is declined or rated based on such a report (an adverse action), the insurer must tell the applicant and identify the reporting agency so the applicant can dispute inaccuracies.

An investigative consumer report goes further than a standard credit report — it gathers information through personal interviews with the applicant's neighbors, friends, or associates about character and lifestyle. Because it is more intrusive, FCRA requires that the applicant be told within three days that such a report may be ordered and has the right to request its nature and scope.

Insurance Fraud

Fraud is intentional deception for unlawful gain. The federal Fraud and False Statements Act (18 U.S.C. 1033/1034) makes it a crime to provide false information in insurance transactions affecting interstate commerce; a person convicted of a felony involving dishonesty may not work in insurance without written consent of the regulator.

Consumer Protection Tools

• Free-look period — A new policyowner may return the policy within a stated window (commonly 10 days, often 10–30 days depending on state and product, and longer for replacements or seniors) for a full premium refund.
• Buyer's Guide and Policy Summary — Generic product education and policy-specific cost figures delivered at or before delivery.
• Illustrations — Must be labeled, with guaranteed and non-guaranteed elements clearly distinguished.

Worked free-look example: A policy is delivered Monday June 1 with a 10-day free look. The owner has through June 11 to return it for a full refund of premium paid, with no surrender charge.

Taxation Trap: The MEC 7-Pay Test

A Modified Endowment Contract (MEC) arises when a life policy is funded faster than the 7-pay test allows — paying more in the first 7 years than would buy a paid-up policy with seven level annual premiums. Consequences are tax, not consumer-fraud, related but commonly tested alongside ethics.

Worked example: If the 7-pay annual limit for a policy is $9,000 and the owner pays $12,000 in year one, the contract fails the 7-pay test and becomes a MEC. Loans and withdrawals are then taxed LIFO (gain first) and may incur the 10% early-distribution penalty before 59½.

HIPAA, GLBA, and Consumer Privacy Notices

Two federal privacy regimes dominate the exam. HIPAA protects Protected Health Information (PHI) held by covered entities and business associates, requiring an authorization before health data is shared for underwriting and imposing security/breach-notification duties (via HITECH). The Gramm-Leach-Bliley Act (GLBA) governs nonpublic personal financial information (NPI), requiring financial institutions (including insurers) to give consumers a privacy notice and an opt-out before sharing NPI with nonaffiliated third parties.

Worked logic: an insurer must obtain a HIPAA authorization before ordering an Attending Physician Statement, and must hand the applicant a GLBA privacy notice at the point of sale describing information-sharing practices. Fraud is attacked through criminal statutes, mandatory fraud-warning language, and SIUs. Consumer protection also includes the NAIC Privacy Model, Do-Not-Call rules, and CAN-SPAM for marketing. A breach of PHI triggers notification to affected individuals and regulators within statutory windows, and willful HIPAA violations carry tiered civil and criminal penalties.