18.3 Privacy (HIPAA/GLBA), Fraud, and Consumer Protection

Three Privacy Frameworks the Exam Tests

Insurance privacy questions blend three federal frameworks plus the NAIC privacy model. Know which one applies to which kind of information.

HIPAA

The Health Insurance Portability and Accountability Act has two exam-relevant pillars. Portability guarantees that group health coverage cannot impose excessive pre-existing condition exclusions and that creditable prior coverage reduces waiting periods (much of this is now superseded by the ACA's ban on pre-existing exclusions). Privacy restricts the use and disclosure of PHI; an insurer or producer may use PHI only for treatment, payment, and health-care operations or with the individual's authorization.

GLBA

The Gramm-Leach-Bliley Act requires a financial institution — including an insurer — to give consumers a privacy notice at the start of the relationship and annually, describing what NPI it collects and shares. Before sharing NPI with a nonaffiliated third party for marketing, the institution must give an opt-out right. GLBA also imposes a Safeguards Rule to protect customer data and prohibits pretexting (obtaining personal information under false pretenses).

FCRA and Investigative Consumer Reports

When an insurer orders a report from an outside agency about an applicant's character or reputation (an investigative consumer report), FCRA requires advance notice to the applicant, who may request the nature and scope of the investigation and is entitled to disclosure of adverse information that leads to a declination or higher rate.

GLBA Notices, Opt-Out, and the NAIC Privacy Model

The Gramm-Leach-Bliley Act (GLBA) governs nonpublic personal financial information (NPI). It requires insurers to give an initial and annual privacy notice describing information-sharing practices and to offer consumers an opt-out before sharing NPI with nonaffiliated third parties (sharing with affiliates and for routine servicing is generally exempt). States implement GLBA through the NAIC Privacy of Consumer Financial and Health Information Model Regulation, which adds an opt-in standard for sharing protected health information.

Fraud, the Fraud Warning, and Penalties

Insurance fraud -- by applicants (misrepresentation, staged claims) or by producers (premium theft, fictitious policies) -- is a crime. Applications carry a fraud warning stating that false statements may be a crime, and the federal Fraud and False Statements provisions and state codes impose fines, restitution, and imprisonment, plus license revocation.

Worked Opt-Out Scenario

An insurer wants to sell its customer list (financial NPI) to an unaffiliated marketing firm. Under GLBA it must first deliver a privacy notice and a reasonable opportunity to opt out; a customer who returns the opt-out form may not have her NPI sold. If the data were protected health information, the stricter NAIC/HIPAA rule would require affirmative authorization (opt-in) before any sharing.

Do-Not-Call and Telemarketing

Producers must scrub against the national Do-Not-Call registry and observe calling-time and identification rules; violations carry per-call penalties.

Additional Exam Traps

• GLBA uses opt-out for financial NPI; sharing health PHI generally requires opt-in.
• Sharing with affiliates and for servicing is exempt from the GLBA opt-out.
• The application's fraud warning flags that false statements may be a crime.

Insurance Fraud

Fraud can come from any party. Application fraud (an applicant lying on the form), claims fraud (filing false or inflated claims), and producer fraud (forging signatures, fabricating applications, or pocketing premiums) are all crimes. The federal Violent Crime Control and Law Enforcement Act (18 U.S.C. § 1033/1034) makes it a federal crime for anyone convicted of a felony involving dishonesty or breach of trust to work in insurance without written consent (a 1033 waiver) from the state commissioner.

Exam Tip: A fraud warning statement on applications and claim forms (notifying that knowingly providing false information is a crime) is required in most states. The contestability clause lets the insurer rescind for material misrepresentation — but only within the first two years; after that, only proven fraud may unwind the contract in many states.

Consumer Protection Tools

Several required disclosures exist purely to protect the buyer:

• Free-look period — the insured may return a new policy for a full premium refund (commonly 10–30 days; longer on replacements and for seniors)
• Buyer's Guide and Policy Summary — generic and policy-specific cost information delivered at or before delivery, helping comparison shopping
• Outline of Coverage — required for health, Medicare supplement, and long-term care sales
• Guaranty associations — state funds that pay covered claims if an insurer becomes insolvent; producers may not use guaranty fund protection as a sales inducement (a prohibited advertising practice)

Penalties and Enforcement

Violations are addressed by the state insurance commissioner through cease-and-desist orders, administrative fines (often a per-violation dollar amount with a higher cap for willful violations), and license suspension or revocation. Fraud and §1033 violations add criminal exposure — fines and imprisonment — on top of administrative discipline.

Putting Privacy and Disclosure Together

A single annuity sale can implicate every framework at once. Collecting the applicant's income and assets triggers GLBA privacy-notice and opt-out duties over that financial NPI. Ordering an attending-physician statement or MIB report engages HIPAA authorization for the health data and FCRA notice if an outside investigative report is used.

Delivering the contract triggers the free-look clock and requires the Buyer's Guide and policy summary. If the producer overstates guaranty-fund protection to close the sale, that advertising claim is itself a prohibited unfair trade practice. The exam rewards candidates who can route each fact to the correct rule rather than memorizing acronyms in isolation.