18.3 Privacy, Fraud, and Consumer Protection

Privacy: GLBA and the NAIC model

The federal Gramm-Leach-Bliley Act (GLBA) and the NAIC Privacy of Consumer Financial and Health Information model regulation govern how insurers collect, use, and disclose nonpublic personal information (NPI). The exam distinguishes two categories: financial information and health information, and two parties: a customer (ongoing relationship) versus a consumer (one-time inquiry).

Key GLBA requirements:

• Provide an initial privacy notice to customers at the start of the relationship and an annual notice thereafter (annual notice may be excused if practices and sharing have not changed).
• Give consumers a chance to opt out before sharing NPI with nonaffiliated third parties (with exceptions for servicing, claims, and law).
• Health information generally requires opt-in (affirmative authorization), a stricter standard than financial opt-out.

FCRA, adverse action, and HIPAA

The Fair Credit Reporting Act (FCRA) applies when an insurer uses a consumer/credit report or an insurance score in underwriting. If the insurer takes adverse action (declination, higher premium, or less favorable terms) based on a report, it must give the applicant an adverse action notice identifying the reporting agency and the right to a free copy and to dispute errors.

An investigative consumer report (based on interviews about character/reputation) requires the insurer to notify the applicant in advance that such a report may be obtained.

Insurance fraud

Insurance fraud is a knowing misrepresentation of material fact to obtain a benefit or payment not entitled to. It is tested as soft fraud (padding an otherwise legitimate claim — e.g., inflating repair costs) versus hard fraud (a fabricated or staged loss — e.g., deliberately torching an insured building). Both are crimes; many states make insurance fraud a felony and require a fraud warning statement on applications and claim forms.

The federal Fraud and False Statements (18 U.S.C. 1033/1034) provisions bar anyone convicted of a felony involving dishonesty or breach of trust from working in the business of insurance without written consent (a 1033 waiver) from the regulator. The exam expects you to know that a prohibited person cannot transact insurance and that violations carry fines and imprisonment.

Consumer protection and replacement

Consumer protection rules require full disclosure at the point of sale and limit replacement abuses. When replacing P&C coverage, the producer must compare coverages honestly so the insured does not lose protection (avoiding twisting). Key consumer safeguards:

• Free-look rights on certain policies, allowing return for a full refund within a stated window
• Defined claims-handling timeframes under the UCSPA (Section 18.1)
• Guaranty associations that pay covered claims if an insurer becomes insolvent, up to statutory caps — producers may not advertise guaranty fund protection as a sales inducement
• Cancellation/nonrenewal notice requirements (commonly 10 days for nonpayment, 30+ days for other reasons), giving the insured time to replace coverage

Privacy, Fraud Statutes, and Replacement Disclosure

Three regulatory clusters close out the ethics-and-compliance material. On privacy, the Gramm-Leach-Bliley Act requires insurers to give privacy notices and an opt-out for sharing nonpublic personal financial information, and the Fair Credit Reporting Act requires an adverse-action notice whenever information in a consumer or credit report leads to declination, cancellation, or a higher rate, telling the applicant which agency supplied the report.

On fraud, the federal 18 U.S.C. 1033/1034 bars anyone convicted of a felony involving dishonesty or breach of trust from working in the business of insurance without the regulator's written consent, with criminal penalties for violations; states layer their own insurance-fraud statutes on top. On replacement, producers must follow disclosure rules designed to protect consumers from twisting and churning, giving the policyholder the information needed to compare existing and proposed coverage.

Tying each consumer protection to the statute that creates it — GLBA for privacy, FCRA for adverse action, 1033/1034 for fraud — is the precise exam expectation.

Anti-Money-Laundering and the Producer's Reporting Duties

Federal and state compliance reaches beyond privacy and fraud statutes. Although property-casualty products carry lower money-laundering risk than cash-value life products, producers must still be alert to suspicious transactions and follow each insurer's anti-money-laundering (AML) and know-your-customer procedures where applicable. Many insurers require producers to complete periodic AML and ethics training as part of the continuing-education and appointment process.

On the consumer-protection front, producers must observe replacement disclosure rules, provide required buyer's guides and policy summaries where mandated, and respect do-not-call/anti-spam marketing limits. Violations of any of these regimes — privacy (GLBA), credit-report adverse action (FCRA), felony-bar employment (1033/1034), or fraudulent claims — can trigger overlapping state license discipline and federal penalties. The exam expects candidates to see compliance as a layered system in which the producer is the front-line gatekeeper for honest, transparent dealing with consumers.

Why the Felony Bar (1033) Matters to Producers

A practical 1033/1034 point candidates miss is that the bar reaches anyone in the business of insurance — not just producers — and applies to felonies involving dishonesty or breach of trust even when unrelated to insurance. A producer who hires an office manager with such a conviction, without first obtaining the regulator's written consent (a 1033 waiver), violates federal law. The waiver process and the breadth of the bar make it a recurring compliance question.