18.3 Privacy (HIPAA/GLBA), Fraud, and Consumer Protection
Key Takeaways
- The Gramm-Leach-Bliley Act (GLBA) requires a privacy notice and an opt-out before sharing nonpublic personal financial information with nonaffiliated third parties.
- HIPAA protects protected health information (PHI) and supports portability, including using creditable coverage to reduce or eliminate preexisting-condition exclusion periods.
- Fair Credit Reporting Act (FCRA): if an insurer orders a consumer or investigative report, the applicant must be notified and may request the nature and scope of the investigation.
- Fraud provisions 18 U.S.C. 1033/1034 bar anyone convicted of a felony involving dishonesty from working in insurance without written 1033 consent from the commissioner.
- The free-look period lets a policyowner return a new policy (commonly 10-30 days) for a full premium refund, a core consumer-protection right.
Gramm-Leach-Bliley Act (GLBA)
The GLBA (Financial Modernization Act) regulates how financial institutions, including insurers and producers, handle a consumer's nonpublic personal information (NPI). Two categories matter:
- Nonpublic personal financial information such as account balances, income, and payment history.
- Personally identifiable health information, subject to even stricter rules.
GLBA imposes three core obligations:
| Requirement | Description |
|---|---|
| Privacy notice | Provide a clear notice of privacy practices at the start of the relationship and annually thereafter. |
| Opt-out | Give consumers the right to opt out before NPI is shared with nonaffiliated third parties. |
| Safeguards | Maintain administrative, technical, and physical safeguards protecting customer data. |
Exam trap: The opt-out applies to sharing with nonaffiliated third parties. Sharing with affiliates, or as needed to service the policy or process a transaction the consumer requested, generally does not require an opt-out.
HIPAA: privacy and portability
The Health Insurance Portability and Accountability Act (HIPAA) has two relevant pillars:
- Privacy of PHI — Protected health information may be used or disclosed only for treatment, payment, and healthcare operations or with the individual's authorization; misuse triggers federal penalties.
- Portability — Protects coverage when workers change jobs. Creditable coverage (prior continuous coverage with no gap exceeding 63 days) can reduce or eliminate a new plan's preexisting-condition exclusion period.
Worked credit example
Suppose a plan imposes a 12-month preexisting-condition exclusion, and the applicant had 8 months of creditable coverage with no significant gap:
- Exclusion period: 12 months
- Less creditable coverage: 8 months
- Remaining exclusion: 4 months
Note: The Affordable Care Act later barred preexisting-condition exclusions in most major-medical plans, but the HIPAA creditable-coverage mechanic remains a testable concept on the life and health exam.
HIPAA also limits how long any exclusion can last. The maximum look-back period for a condition is generally 6 months before enrollment, and the maximum exclusion period is 12 months (or 18 months for a late enrollee), reduced day-for-day by creditable coverage. A break in coverage longer than 63 days can cause earlier coverage to stop counting. These numbers, the 6-month look-back, the 12/18-month maximum, and the 63-day gap, are frequently tested values.
Under GLBA, before sharing a customer's nonpublic personal financial information with a nonaffiliated third party for marketing, an insurer must:
Fair Credit Reporting Act (FCRA)
The FCRA governs the use of consumer reports and investigative consumer reports in underwriting.
| Report type | Content | Applicant rights |
|---|---|---|
| Consumer report | Credit and public-record data | Must be told a report may be obtained |
| Investigative consumer report | Interviews about character, reputation, and lifestyle | Must be notified within 3 days and may request the nature and scope of the investigation |
If an insurer takes adverse action (declines or rates up) based on a report, it must inform the applicant and provide the source of the report so the applicant can dispute inaccuracies and request a free copy.
Exam trap: The MIB (Medical Information Bureau) and the investigative consumer report are different. The MIB stores coded medical information shared among member insurers; an investigative consumer report gathers character and lifestyle data through interviews with neighbors, employers, and associates.
The FCRA was enacted to promote accuracy and protect the privacy of information used in consumer reports. An applicant who is denied coverage because of a report has the right to know which reporting agency supplied it and to obtain a free copy within a limited window so errors can be corrected. The insurer cannot simply rely on stale or unverified third-party data when it makes an adverse underwriting decision.
Insurance fraud: 18 U.S.C. 1033 and 1034
The federal Fraud and False Statements provisions make it a crime for anyone engaged in the business of insurance to make false statements, embezzle funds, or commit fraud affecting interstate commerce.
- Section 1033 — Prohibits a person convicted of a felony involving dishonesty or breach of trust from working in insurance unless they first obtain written consent (a 1033 waiver) from the state insurance commissioner.
- Section 1034 — Authorizes the U.S. Attorney General to bring civil actions and seek monetary penalties and injunctions for 1033 violations.
Exam trap: A felony involving dishonesty is the trigger for the 1033 consent requirement. Working in insurance without that written waiver is itself a federal crime, and knowingly hiring such a person also exposes the insurer or producer to liability.
Free-look and other consumer protections
The free-look provision lets a new policyowner examine the policy and return it for a full premium refund, typically within 10 to 30 days (commonly 10 days, with longer windows often required for replacements and for senior buyers). Other protections include the buyer's guide and policy summary that must be delivered with or before certain life and annuity sales, and replacement regulations requiring notice and comparison disclosures whenever one policy replaces another.
HIPAA, GLBA, and Required Privacy Notices
Two federal privacy regimes recur. HIPAA protects individually identifiable health information (PHI); insurers and producers handling PHI must safeguard it and may use it only for permitted purposes such as treatment, payment, and operations, or with the individual's authorization.
The Gramm-Leach-Bliley Act (GLBA) governs nonpublic personal financial information: financial institutions, including insurers, must provide a privacy notice at the start of the relationship and annually, and must give consumers the right to opt out of certain information sharing with nonaffiliated third parties. Producers must also comply with Do-Not-Call rules and anti-fraud reporting. Trap: a consumer's authorization is generally required before sharing health information for marketing, and a privacy notice alone does not substitute for that authorization.
An applicant has 8 months of creditable coverage with no significant gap. A new group health plan imposes a 12-month preexisting-condition exclusion. Under HIPAA portability rules, the remaining exclusion period is: