18.3 Privacy, Fraud, and Consumer Protection

The Federal Privacy Framework

Insurance is state-regulated, but several federal privacy laws overlay producer conduct, and the exam expects you to match each acronym to its trigger.

Exam Key: GLBA = FINANCIAL data + privacy notice/opt-out. FCRA = CREDIT reports + adverse action notice. HIPAA = HEALTH data + authorization. Mismatching these acronyms is the single most common privacy-question trap.

The NAIC Privacy Model and Opt-Out vs. Opt-In

The NAIC built model privacy regulations on the GLBA framework. The key distinction: financial information is governed by an opt-out standard (the insurer may share NPI with nonaffiliated third parties unless the consumer says no), while health information generally requires opt-in consent (the insurer may not share it without affirmative authorization). A producer must deliver the initial privacy notice no later than when the customer relationship is established and must not condition the sale on waiving privacy rights.

Fair Credit Reporting Act and Adverse-Action Notices

When an insurer uses a consumer report or credit-based insurance score in underwriting, the Fair Credit Reporting Act (FCRA) governs the process. If the insurer takes an adverse action — declining coverage, charging a higher rate, or non-renewing — based in whole or part on such a report, it must give the applicant an adverse-action notice identifying the reporting agency and the consumer's right to a free copy of the report and to dispute its accuracy.

The exam tests that the insurer, not the credit bureau, bears the disclosure duty, and that the consumer's remedy is to request and correct the report. Investigative consumer reports (involving personal interviews) carry additional advance-notice requirements the exam may reference.

Insurance Fraud, SIUs, and Immunity Reporting

Insurance fraud is a recognized crime on both the applicant/claimant side (staged losses, inflated claims, false applications) and the industry side (premium theft, fictitious policies, fee churning). Many states require insurers to maintain a Special Investigations Unit (SIU) and to report suspected fraud to a fraud bureau, granting the reporting insurer civil immunity for good-faith reports.

The exam pairs this with anti-fraud warning statements that must appear on applications and claim forms, notifying signers that false statements are a crime. A claimant who knowingly inflates a theft claim commits soft fraud; a fully staged loss is hard fraud. Recognizing the mandatory reporting duty and the good-faith immunity that protects insurers who report is the tested point.

Gramm-Leach-Bliley and Notice Timing

The federal Gramm-Leach-Bliley Act (GLBA) underpins insurance privacy: a financial institution, including an insurer, must give consumers an initial privacy notice describing its information-sharing practices and an opt-out opportunity before sharing nonpublic personal financial information with unaffiliated third parties, plus an annual notice while the relationship continues.

Nonpublic personal health information generally requires the stronger opt-in (affirmative authorization) before disclosure. The exam tests the financial-information opt-out versus the health-information opt-in distinction and that the notice must precede the sharing.

Insurance Fraud and Anti-Fraud Laws

Fraud is a knowing misrepresentation of material fact to obtain money or coverage to which one is not entitled. It runs both directions: claimant fraud (staging losses, inflating damages, phantom injuries) and insurer/producer fraud (premium theft, fake policies, application clean-sheeting).

Two federal statutes anchor the topic:

• The Fraud and False Statements provision (18 U.S.C. 1033/1034) makes it a federal crime for anyone engaged in the business of insurance to knowingly make false statements, embezzle, or commit related acts affecting interstate commerce.
• Section 1033 prohibition: a person convicted of a felony involving dishonesty or breach of trust may not work in insurance without written consent (a 1033 waiver) from the state insurance commissioner. Hiring a barred person, or working without the waiver, is itself a federal violation.

Most states also mandate that policies carry a fraud warning on applications and claim forms and require insurers to maintain a Special Investigations Unit (SIU) and report suspected fraud to the department or a fraud bureau.

Consumer Protection Mechanisms

Beyond prohibitions, the regulatory system gives consumers affirmative protections the exam likes to list:

• Free-look period — a window (commonly 10-30 days) to review a policy and obtain a full refund.
• Guaranty associations — state funds that pay covered claims if an admitted insurer becomes insolvent, subject to per-line caps; note that surplus lines/non-admitted insurers are not protected, a heavily tested trap.
• Complaint and market-conduct exams — the department investigates consumer complaints and audits insurer practices.
• Replacement regulations — disclosure forms and comparison notices when a producer recommends replacing an existing policy, designed to prevent twisting/churning.

Worked example: An insured buys from a non-admitted surplus lines carrier that later becomes insolvent and cannot pay a covered $50,000 claim. The state guaranty association will pay $0, because guaranty-fund protection applies only to admitted insurers. The surplus-lines broker should have disclosed this gap at the point of sale — a documented disclosure protects against an E&O claim.