18.3 Privacy (HIPAA/GLBA), Fraud, and Consumer Protection

HIPAA and protected health information

The Health Insurance Portability and Accountability Act (HIPAA) has two exam-relevant pillars. The portability rules limit pre-existing condition exclusions and guarantee renewability in group health, while the Privacy Rule protects Protected Health Information (PHI) — individually identifiable health information held by covered entities.

General rule: PHI may be used or disclosed without the individual's authorization only for treatment, payment, and health care operations (TPO). Most other disclosures — for example, releasing records to an employer or marketer — require a signed authorization.

• Minimum necessary standard — disclose only the least PHI needed for the purpose.
• Right of access — individuals may inspect and obtain copies of their records.
• Violations carry tiered civil penalties and, for knowing misuse, criminal penalties.

Exam tip: TPO is the gateway to permitted disclosure without authorization. If a use falls outside treatment, payment, or operations, assume written authorization is required.

GLBA financial privacy

The Gramm-Leach-Bliley Act (GLBA) governs nonpublic personal financial information (NPI) — data such as account balances, premiums paid, and application details. GLBA imposes three duties on financial institutions, including insurers:

Key distinctions:

• Sharing with affiliates generally does not require opt-out; sharing with nonaffiliated parties for marketing does.
• HIPAA covers health information; GLBA covers financial information. An exam item that mentions account balances or premium history points to GLBA, while one mentioning diagnoses or treatment points to HIPAA.

Fair Credit Reporting Act (FCRA)

The FCRA regulates the collection and use of consumer reports (and investigative consumer reports, which involve interviews about character and reputation). For insurance underwriting:

• The applicant must be told that a report may be obtained.
• If an adverse decision (declination, rating, or higher premium) is based wholly or partly on the report, the insurer must notify the applicant and identify the reporting agency.
• The consumer may request the nature and substance of the information and dispute inaccuracies.

An investigative consumer report goes beyond credit data to gather information about a person's character, general reputation, and mode of living through personal interviews. Because it is more intrusive, FCRA requires the applicant be notified in writing that such a report may be requested, usually within three days of ordering it, and the applicant may request a complete disclosure of its scope. These rules ensure underwriting based on third-party data remains transparent and contestable.

Insurance fraud and the federal felon prohibition

Insurance fraud is the intentional misrepresentation of material facts to obtain a benefit or payment to which one is not entitled. It can be committed by applicants, insureds, producers, or insurers, and is generally a felony.

The federal Fraud and False Statements provision, 18 U.S.C. Section 1033, makes it a federal crime for anyone engaged in the business of insurance affecting interstate commerce to commit fraud. Section 1034 authorizes civil penalties and injunctions.

Critical rule: Under Section 1033, a person convicted of a felony involving dishonesty or breach of trust may NOT work in the business of insurance unless they obtain written consent from the state insurance regulator (a 1033 waiver). Violation is punishable by fines and imprisonment.

Producers are often subject to mandatory anti-fraud and anti-money-laundering (AML) training, including filing Suspicious Activity Reports (SARs) for certain transactions on cash-value and annuity products.

Common fraud schemes the exam expects you to recognize include clean-sheeting (omitting known medical conditions on an application), fictitious claims (filing for a loss that never occurred), and premium diversion (a producer pocketing premiums instead of remitting them). Each is intentional and therefore outside any E&O coverage, leaving the producer personally and criminally liable.

Consumer-protection disclosure tools

Several required disclosures exist specifically to protect the buyer at the point of sale. Know each by name and timing.

• Free-look period — a window (commonly 10 days, often longer for replacement or for seniors) after delivery during which the policyowner may return the policy for a full premium refund.
• Buyer's Guide — a generic, insurer-neutral booklet explaining how a product type works (life or annuity); delivered at or before policy delivery.
• Policy Summary — product-specific figures (premiums, values, surrender charges) for the actual policy purchased.
• Notice Regarding Replacement — signed when a sale replaces existing coverage, ensuring the buyer understands surrender charges and new contestable periods.
• Advertising rules — sales material must be truthful and not misleading, reinforcing the UTPA prohibitions on false advertising.

Free-look refund comparison

Trap: Do not confuse the grace period (time to pay a late premium after issue to keep coverage in force) with the free-look period (time to cancel after delivery for a refund). They protect different things at different stages.