18.3 Privacy (HIPAA/GLBA), Fraud, and Consumer Protection

Federal Privacy Frameworks: GLBA and HIPAA

Two federal laws dominate insurance privacy questions. The Gramm-Leach-Bliley Act (GLBA) governs how financial institutions, including insurers, handle nonpublic personal financial information. GLBA requires an initial privacy notice at the start of the relationship, an annual privacy notice (with limited exceptions), and an opt-out opportunity before sharing nonpublic information with unaffiliated third parties for marketing.

The Health Insurance Portability and Accountability Act (HIPAA) protects protected health information (PHI). Its Privacy Rule limits use and disclosure of health data, and its Portability provisions limit how health plans treat pre-existing conditions and guarantee certain coverage continuity. On the exam, match GLBA to financial data and HIPAA to medical data.

The Fair Credit Reporting Act and Consumer Reports

The Fair Credit Reporting Act (FCRA) governs how insurers obtain and use consumer reports and investigative consumer reports in underwriting. Key tested rules:

• The applicant must receive notice that a report may be obtained.
• An investigative consumer report (information gathered through interviews about character, reputation, lifestyle) requires the consumer be told within 3 days and have the right to request the nature and scope of the investigation.
• If an insurer takes adverse action (declines, rates up, or cancels) based on a report, it must give the applicant the reason and the source so the consumer can dispute inaccuracies.

The MIB (Medical Information Bureau) is an inter-company database that flags impairments; it is a clue, not a basis for declination by itself — insurers may not decline solely on an MIB code.

Notices, Opt-Outs, and the Fair Credit Reporting Act

Privacy law layers three regimes. HIPAA protects health information (PHI). The Gramm-Leach-Bliley Act (GLBA) governs financial privacy: insurers must give an initial and annual privacy notice describing information practices and must allow consumers to opt out of sharing nonpublic personal information with unaffiliated third parties.

The Fair Credit Reporting Act (FCRA) governs consumer/investigative reports used in underwriting. The applicant must be notified that a report may be ordered; if coverage is declined or rated because of the report, the insurer must give the reason and the source so the applicant can dispute errors.

Worked trap: an investigative consumer report (interviews with neighbors/associates) requires that the applicant be told they may request the nature and scope of the investigation - a stricter notice than an ordinary credit report. Insurance fraud (false claims, false applications) is a felony in most states and triggers mandatory reporting to the fraud bureau or DIFS.

Insurance Fraud and Federal Enforcement

Fraud is an intentional deception for unlawful gain. It can be committed by applicants (lying on applications, faking claims), producers (forging signatures, pocketing premiums), or insurers (bad-faith denials). The Fraud and False Statements provision (commonly cited as 18 U.S.C. 1033/1034) makes it a federal crime for anyone convicted of a felony involving dishonesty or breach of trust to work in the business of insurance affecting interstate commerce without written consent (a 1033 waiver) from the state insurance commissioner.

Penalties for violations can include fines and imprisonment up to 10 years (longer if the act jeopardizes an insurer's safety and soundness). The exam answer: a felon needs a 1033 consent waiver to be licensed.

States reinforce this with fraud reporting requirements: most insurers must maintain a Special Investigations Unit (SIU) and report suspected fraud to a fraud bureau, often with immunity from civil liability for good-faith reports. Common life and health schemes the exam tests include clean-sheeting (omitting known conditions from an application), viatical/STOLI abuse (stranger-originated life insurance lacking insurable interest), and premium diversion by a producer. Insurable interest must exist at policy inception; its absence is a fraud red flag, not merely a technicality.

Consumer Protection at Point of Sale

Several disclosure and timing protections safeguard buyers:

The free-look period runs from policy delivery, not from the application date — a frequent exam trap. For replacement transactions some states extend the free look (often to 20-30 days). During the free look the client may cancel for any reason and receive a refund, which for variable products may be based on account value.

Also know the guaranty association rule: it protects policyholders if an insurer becomes insolvent, but a producer may never advertise or use its existence to sell a policy. Finally, the NAIC Advertising Rules require that materials avoid words like "investment" or "savings plan" for products that are insurance, disclose the full company name, and never imply a policy is a deposit or is endorsed by a government agency. These point-of-sale safeguards exist so a buyer makes an informed, pressure-free decision.