18.3 Privacy (HIPAA/GLBA), Fraud, and Consumer Protection

Privacy laws producers must follow

Producers gather sensitive medical and financial data, so several privacy laws apply at once. Know which law governs which type of information:

HIPAA (the Health Insurance Portability and Accountability Act) protects individually identifiable health information. In health underwriting, the producer collects PHI and must keep it confidential and disclose it only with proper authorization or as the law permits. HIPAA also created guaranteed-issue and portability protections that limit pre-existing-condition exclusions in group health coverage.

A practical compliance point: any medical authorization the applicant signs to release records to the insurer must be specific, dated, and limited in duration. The producer should explain why the information is needed and never disclose an applicant's health findings to third parties such as a spouse or employer without authorization.

GLBA and FCRA in practice

GLBA divides personal data into categories and focuses on nonpublic personal financial information. Financial institutions, including insurers and producers, must give consumers an initial privacy notice at the start of the relationship and an annual notice thereafter, describing what information is collected and shared. Before sharing nonpublic information with a nonaffiliated third party for marketing, the consumer must be given a reasonable chance to opt out. Sharing with affiliates or to service the policy is generally permitted.

FCRA governs consumer reports used in underwriting. When an insurer orders an investigative consumer report (one based on interviews about character, reputation, or lifestyle), the applicant must receive written notice that the report may be obtained and may request disclosure of its nature and scope. If coverage is declined or rated based on a report, the applicant must be told and given the reporting agency's identity so the data can be reviewed and disputed.

Trap to remember: HIPAA = health data; GLBA = financial data; FCRA = consumer-report process.

Insurance fraud and the federal 1033/1034 bar

Insurance fraud is a knowing and willful act to obtain money or value under an insurance contract through deception. It runs in both directions: an applicant who lies about health on an application commits fraud, and a producer or insurer who deceives a consumer also commits it. State law commonly makes serious insurance fraud a felony punishable by fines, restitution, and imprisonment, in addition to license revocation.

A federal law every producer must know is the Fraud and False Statements provision, 18 U.S.C. 1033 and 1034. It makes it a federal crime for anyone convicted of a felony involving dishonesty or breach of trust to engage in the business of insurance affecting interstate commerce without written consent from the state insurance regulator. The practical effect: a felony conviction for theft or fraud bars a person from the insurance business unless a regulator grants a written 1033 waiver. The exam tests that the bar covers felonies involving dishonesty and that written regulatory consent is the only path back in.

Producers should also know the anti-money-laundering (AML) training requirement: producers who sell covered products such as permanent life insurance and annuities must complete AML training and help the insurer identify and report suspicious activity. Failing to report a suspicious cash transaction, or helping a client structure deposits to evade reporting, is itself a serious offense.

Built-in consumer protections

The sales and claims process is layered with disclosure rights that protect consumers:

• Free-look period: typically 10 to 30 days (often longer for replacements or seniors) during which the policyowner may return the policy for a full premium refund.
• Buyer's guide and policy summary: generic product education plus a policy-specific summary that must be delivered at or before policy delivery so the buyer can evaluate the purchase.
• Replacement disclosure: signed notices and a side-by-side comparison when an existing policy is replaced.
• Claim denial explanation: the insured is entitled to a prompt, reasonable written explanation of the basis for any denial.
• Outline of coverage: required for Medicare Supplement and long-term care, summarizing benefits, limits, and exclusions.

A worked timing example: a buyer receives the policy on the 1st with a 10-day free look, decides on the 8th that the premium is unaffordable, and returns it. Because the return is within the free-look window, the insurer must refund the full premium paid, treating the contract as never having taken effect.

Replacement and senior-marketing rules often extend the free-look period (commonly to 20 or 30 days) precisely because those buyers are at higher risk of an unsuitable sale. Producers must also deliver the policy and required disclosures in a timely manner, since several consumer rights, including the free-look clock, start at delivery. Documenting delivery date and what was provided protects both the client and the producer if a dispute later arises.