18.3 Privacy, Fraud, and Consumer Protection
Key Takeaways
- GLBA requires privacy notices, an opt-out before sharing NPI with nonaffiliated third parties, and the Safeguards Rule for data security.
- FCRA requires an adverse-action notice whenever a consumer report drives a declination, nonrenewal, or higher rate.
- Insurance fraud is intentional deception for gain; 18 U.S.C. 1033/1034 add federal penalties up to 10-15 years and a 1033 waiver requirement.
- Guaranty associations pay covered claims of insolvent insurers up to statutory per-claim caps.
- Coinsurance penalty = (carried/required) x loss; underinsuring a building below the required percentage shifts part of the loss to the insured.
The Federal Privacy Framework
Insurance is state-regulated, but two federal statutes set a privacy floor. The Gramm-Leach-Bliley Act (GLBA) of 1999 requires financial institutions, including insurers, to protect nonpublic personal information (NPI). GLBA has three core rules:
- Privacy Rule — deliver a privacy notice at the start of the relationship and annually, describing information-sharing practices.
- Opt-out right — consumers may opt out before NPI is shared with nonaffiliated third parties (with exceptions for servicing and claims).
- Safeguards Rule — maintain administrative, technical, and physical security for customer data.
The Fair Credit Reporting Act (FCRA) governs use of consumer reports (including insurance scores and CLUE loss-history reports). If an insurer takes adverse action — declining, nonrenewing, or rating up — based on a report, it must give an adverse-action notice identifying the reporting agency and the consumer's right to a free copy and dispute.
HIPAA, State Privacy, and a Notice Timeline
The HIPAA privacy rule protects health information; in P&C it most often matters for medical records gathered on liability or workers' compensation claims. Many states also adopt the NAIC Insurance Information and Privacy Protection Act, which adds notice and access rights beyond GLBA.
Consider the FCRA adverse-action sequence. An applicant for homeowners insurance is quoted a surcharge because a CLUE report shows two prior water claims. The insurer must, at or near the time of the decision, send an adverse-action notice naming the reporting agency. The consumer then has the right to a free report (typically within 60 days) and to dispute inaccuracies, which the agency must reinvestigate (commonly within 30 days).
Exam Key: GLBA = sharing/opt-out of financial NPI; FCRA = adverse-action notice when a report drives a declination, nonrenewal, or higher rate.
Privacy Protections - GLBA and HIPAA
Producers handle nonpublic personal information and must comply with federal privacy law. The Gramm-Leach-Bliley Act (GLBA) requires financial institutions - including insurers and producers - to give consumers a privacy notice describing information-sharing practices and an opt-out of certain disclosures to nonaffiliated third parties, and to safeguard customer data. The HIPAA privacy rule protects health information relevant to health and some disability/long-term-care underwriting. State versions follow the NAIC privacy model.
The Fair Credit Reporting Act
The Fair Credit Reporting Act (FCRA) governs the use of consumer and credit reports in underwriting. If an insurer takes an adverse action (declination, higher rate, or nonrenewal) based even partly on a consumer/credit report, it must give the applicant an adverse-action notice identifying the reporting agency and the right to obtain and dispute the report. The candidate should know that credit-based insurance scores are regulated and that the consumer has a right to the disclosure.
Insurance Fraud and the Fraud Statutes
Insurance fraud - knowingly presenting false information to obtain a benefit or rate - is criminalized at the state level, and the federal Violent Crime Control Act (18 U.S.C. 1033/1034) bars anyone convicted of a felony involving dishonesty or breach of trust from working in insurance without written consent of the regulator. Producers have a duty to recognize and report suspected fraud; soft fraud (padding a legitimate claim) and hard fraud (staging a loss) are both prohibited, and most states maintain a fraud bureau and require fraud-warning statements on applications and claim forms.
Consumer Protection and the Producer's Role
The unifying theme is that the producer is the front line of consumer protection: delivering required privacy and adverse-action notices, obtaining proper authorizations before pulling reports, safeguarding client data, presenting suitable recommendations, and never facilitating fraud, rebating, or misrepresentation.
A candidate should be able to match a scenario - sharing a client list with an outside marketer, denying coverage on a credit report, a felon seeking to sell insurance, a padded claim - to the controlling rule (GLBA opt-out, FCRA adverse-action notice, the 1033/1034 bar, and the anti-fraud statutes), since each is a recurring exam item.
An insurer declines an auto applicant based partly on an unfavorable insurance score derived from a consumer report. Under federal law, what must the insurer do?
Insurance Fraud and the Federal Backstop
Fraud is an intentional deception for unlawful gain. P&C fraud appears on both sides: a claimant who stages a theft or inflates a damage estimate (soft fraud is padding; hard fraud is fabricating an entire loss), and a producer who fabricates applications, pockets premiums, or sells fake coverage.
Federal law reinforces state fraud statutes. 18 U.S.C. 1033 makes it a federal crime to engage in deceptive acts affecting the business of insurance in interstate commerce — false statements, embezzlement, or false entries — with prison terms up to 10 years (and up to 15 years if the conduct jeopardizes insurer solvency). 18 U.S.C. 1034 authorizes civil penalties. Under 1033/1034, anyone convicted of a felony involving dishonesty or breach of trust is barred from the insurance business absent a 1033 waiver from the regulator.
Consumer Protection Tools and a Coinsurance Disclosure Example
Consumer protection layers onto fraud control. Free-look provisions, mandatory disclosures, suitability standards, and the state guaranty association (which pays covered claims when an insurer becomes insolvent, subject to per-claim caps) all protect buyers. Producers must avoid misrepresenting how a policy limit interacts with valuation.
Work a coinsurance disclosure. A commercial building worth $500,000 carries an 80% coinsurance clause, so the insured must carry at least $400,000. The owner insures only $300,000. A $100,000 partial loss is settled by the formula: (carried / required) x loss = ($300,000 / $400,000) x $100,000 = 0.75 x $100,000 = $75,000, then less any deductible. The insured absorbs $25,000 from underinsurance.
| Item | Value |
|---|---|
| Building value | $500,000 |
| Required (80%) | $400,000 |
| Carried | $300,000 |
| Loss | $100,000 |
| Coinsurance factor | 0.75 |
| Payable before deductible | $75,000 |
Failing to disclose this penalty risk, or misstating that a low limit "fully" protects the building, is a UTPA misrepresentation as well as an E&O exposure.
A building valued at $500,000 has an 80% coinsurance clause. The owner insures it for $300,000 and suffers a $100,000 loss. Ignoring any deductible, how much will the insurer pay?