18.3 Privacy (HIPAA/GLBA), Fraud, and Consumer Protection

The privacy framework: GLBA and HIPAA

Two federal privacy laws dominate the exam:

• Gramm-Leach-Bliley Act (GLBA) governs financial privacy. It requires financial institutions (including insurers) to give consumers a privacy notice and the chance to opt out of sharing nonpublic personal financial information with nonaffiliated third parties.
• HIPAA governs protected health information (PHI). Its Privacy Rule restricts use/disclosure of health data, and HIPAA's portability provisions limit pre-existing condition exclusions in group health.

The trap: GLBA is opt-out (the consumer must act to stop sharing), which students often reverse as opt-in.

Fair Credit Reporting Act and the investigative report

The Fair Credit Reporting Act (FCRA) governs information gathered by consumer reporting agencies for underwriting. Key tested points:

• The applicant must be notified that an investigative consumer report may be obtained, generally within 3 days of the report being ordered.
• The applicant has the right to know the nature and scope of the investigation if they request it (insurer must respond, often within 5 days).
• If a policy is declined or rated based on the report, the applicant must receive notice and the source of the information (adverse action notice).

The Medical Information Bureau (MIB) is a clearinghouse of coded medical impairment data; insurers may report to and check it but cannot decline a risk solely on an MIB report.

Insurance fraud and the federal backstop

Fraud is a knowing misrepresentation of a material fact to obtain a benefit. The exam separates two sides:

The federal Fraud and False Statements provision (18 U.S.C. 1033/1034) makes it a crime for anyone convicted of a felony involving dishonesty or breach of trust to work in insurance affecting interstate commerce without written consent (a 1033 waiver) from the state commissioner. Penalties include fines and up to 10–15 years imprisonment depending on harm caused.

Consumer protection mechanics: replacement notice and free look

Two consumer safeguards round out the unit:

• Free-look period — every life/health policy must allow the owner to return it for a full premium refund, typically 10 days (often 20–30 days for replacement or senior policies). The clock starts at delivery, not issue.
• Replacement regulation — on a replacement, the producer must give a signed replacement notice and a comparison, and the existing insurer gets the chance to conserve the policy.

Worked free-look example: a client pays $90/month and exercises a 10-day free look 6 days after delivery. The refund is the entire premium paid ($90), not a prorated portion — the free look is a full refund, distinguishing it from a mid-term surrender.

Defamation of producers, advertising rules, and Do-Not-Call

Consumer protection also constrains how producers advertise and contact prospects. Advertising must not be misleading about benefits, dividends, or an insurer's standing; testimonials must be genuine and disclose any compensation. The federal Telephone Consumer Protection Act (TCPA) and the National Do-Not-Call Registry restrict unsolicited sales calls; a producer generally may not cold-call registered numbers, and an established business relationship has time limits.

Finally, the identity-theft Red Flags Rule (FTC/FCRA) requires insurers to maintain programs detecting suspicious activity in covered accounts. The thread tying privacy, fraud, and advertising together for the exam: the producer is a gatekeeper of consumer information and trust — improper handling of data, deceptive solicitation, or failure to disclose all create regulatory exposure independent of whether a sale ever closes.

Privacy Laws — GLBA, HIPAA, and Fair Credit Reporting

Three federal privacy frameworks are tested. The Gramm-Leach-Bliley Act (GLBA) requires financial institutions, including insurers, to give consumers a privacy notice describing information-sharing practices and the right to opt out of certain disclosures of nonpublic personal financial information. HIPAA protects protected health information (PHI), limiting use and disclosure of medical data and granting access rights. The Fair Credit Reporting Act (FCRA) governs consumer/investigative reports used in underwriting.

FCRA and the Investigative Consumer Report Disclosure

When an insurer orders a consumer report (e.g., from an inspection company) to evaluate an applicant, FCRA requires that the applicant be notified in writing that a report may be obtained, given the report's nature/scope on request, and — if coverage is declined or rated because of the report (an adverse action) — told the reason and the source so the applicant can dispute inaccurate information. An investigative consumer report (based on interviews about character and lifestyle) carries extra disclosure timing requirements.

Fraud Prevention and the MIB

Insurance fraud — material misstatements on applications, fictitious claims, or producer theft — is a crime under state and federal law (the federal Fraud and False Statements provisions, 18 U.S.C. 1033/1034, bar persons convicted of a felony involving dishonesty from the insurance business without written consent). The Medical Information Bureau (MIB) is a member-insurer data exchange that flags inconsistencies across applications to deter fraud; insurers may not decline coverage solely on an MIB code without independent confirmation.

Worked Privacy/Adverse-Action Example

An insurer rates an applicant as substandard based partly on an inspection report stating a poor driving record. Under FCRA, the insurer must notify the applicant of the adverse action, identify the reporting agency, and inform the applicant of the right to obtain a free copy of the report and dispute errors. If the negative information was inaccurate and the applicant corrects it, the insurer must reconsider — illustrating how FCRA's adverse-action and dispute mechanics protect consumers from underwriting on faulty data.