18.3 Privacy, Fraud, and Consumer Protection
Key Takeaways
- GLBA/NAIC privacy: financial NPI uses an OPT-OUT standard; protected health information uses a stricter OPT-IN authorization.
- FCRA requires an adverse-action notice when a credit/consumer report contributes to declination or a higher rate.
- Hard fraud = staged/fabricated loss; soft (opportunistic) fraud = padding a legitimate claim; fraud is committed by insureds, producers, and insurers alike.
- 18 U.S.C. 1033 bars anyone convicted of a felony involving dishonesty from the insurance business without written 1033 consent from the regulator.
- A MATERIAL misrepresentation or intentional concealment lets the insurer rescind the policy and deny the claim; immaterial misstatements do not.
Privacy: GLBA, the NAIC Models, and HIPAA Touchpoints
The national exam tests three privacy frameworks. The Gramm-Leach-Bliley Act (GLBA) requires financial institutions — including insurers and producers — to protect nonpublic personal information (NPI) and to give consumers a privacy notice at the time the relationship begins and annually thereafter. Consumers must be allowed to opt out before NPI is shared with nonaffiliated third parties (with exceptions for servicing and claims).
Most states adopted the NAIC privacy models. Two key distinctions tested:
- Financial information — opt-OUT standard (sharing allowed unless the consumer says no).
- Health information — opt-IN standard (affirmative authorization required before disclosure).
GLBA's safeguards have two halves the exam tests separately: the Financial Privacy Rule (the notice and opt-out machinery above) and the Safeguards Rule (administrative, technical, and physical controls to protect NPI from unauthorized access — encryption, access limits, vendor oversight). NPI includes any information a consumer provides to obtain a product, any information about a transaction, and any information obtained in connection with providing the product — but not publicly available data such as a deed on file at the county recorder.
Privacy Notices and Adverse Underwriting
| Trigger | Required action |
|---|---|
| New customer relationship | Deliver initial privacy notice |
| Each year the relationship continues | Annual privacy notice (some exemptions if policy unchanged) |
| Sharing NPI with nonaffiliated third party | Provide opt-out and honor it |
| Adverse underwriting decision (decline/rate-up) | Give specific reasons and source of information |
The Fair Credit Reporting Act (FCRA) also applies: if an insurer uses a consumer/credit report and takes adverse action (declination, higher premium), it must give an adverse action notice identifying the reporting agency. Insurance-support organizations (e.g., C.L.U.E. loss-history databases) fall under these disclosure rules.
Privacy Laws: GLBA, HIPAA, and FCRA
Several federal laws govern how insurers and producers handle personal information. The Gramm-Leach-Bliley Act (GLBA) requires financial institutions, including insurers, to give consumers a privacy notice and an opportunity to opt out of sharing nonpublic personal financial information with unaffiliated third parties. The Fair Credit Reporting Act (FCRA) governs the use of consumer/credit reports in underwriting and requires adverse-action notices when information in a report leads to a denial or higher rate. HIPAA protects medical information.
States layer their own privacy and data-breach-notification rules on top of these federal baselines.
Insurance Fraud and Penalties
Insurance fraud - knowingly submitting false information or claims to obtain money or coverage - is a crime committed by applicants, insureds, claimants, producers, or insurers. Examples include staged accidents, inflated or fictitious claims, premium theft, and misrepresentation on applications. C. 1033/1034)** make it a federal crime for anyone convicted of a felony involving dishonesty to work in the business of insurance without written consent of the regulator - a key point because it can permanently bar a producer.
State fraud bureaus investigate and prosecute, and penalties include fines, restitution, and license revocation.
Consumer Protection and Replacement/Disclosure Rules
Consumer-protection rules require producers to deal honestly and give consumers the information needed to make informed decisions. These include disclosure of material policy terms, prohibitions on misrepresentation and twisting/churning (inducing a replacement through misrepresentation), rules requiring delivery of policies and notices, and free-look and cancellation protections in some lines. The unfair claims settlement practices rules require prompt, fair handling of claims.
Together with the privacy and anti-fraud laws, these consumer-protection standards form the regulatory backbone the exam tests, and violations expose the producer to both administrative discipline and civil liability.
Under the NAIC privacy framework adopted by most states, sharing a consumer's protected HEALTH information generally requires:
Insurance Fraud and the Fraud Statutes
Fraud is an intentional misrepresentation of a material fact, relied upon, causing harm. The exam separates hard fraud (a deliberately staged or fabricated loss — e.g., arson-for-profit, a faked theft) from soft (opportunistic) fraud (padding an otherwise legitimate claim — e.g., inflating the value of stolen items).
Fraud is committed by all parties, not just insureds:
- Applicant/insured fraud — material misrepresentation on an application; staging losses.
- Producer fraud — issuing fake binders, pocketing premium, fictitious policies.
- Insurer/adjuster fraud — bad-faith claim denial, falsifying loss reports.
The federal Violent Crime Control Act (1994) / 18 U.S.C. 1033–1034 bars anyone convicted of a felony involving dishonesty or breach of trust from working in insurance affecting interstate commerce without 1033 written consent from the regulator. This is heavily tested. The companion section 1034 authorizes the federal government to bring civil actions and seek fines against violators, while state insurance departments enforce parallel licensing bars.
The NAIC Insurance Information and Privacy Protection model, the anti-money-laundering (AML) rules under the USA PATRIOT Act (which reach insurers issuing products with cash value), and state-specific fraud bureaus all overlay this federal floor. Producers must file Suspicious Activity Reports (SARs) for covered products and complete AML training — another commonly tested compliance duty.
Anti-Fraud Controls and Penalties
Most states require a fraud warning on applications and claim forms (e.g., "Any person who knowingly files a false claim... commits a fraudulent insurance act"). Insurers must report suspected fraud to a fraud bureau and are generally granted immunity for good-faith reports.
- Material misrepresentation on an application can let the insurer rescind the policy back to inception (during the contestability/voidability period).
- Concealment — silence about a material fact one has a duty to disclose — has the same effect when intentional.
- Penalties range from claim denial and policy rescission to fines, restitution, license revocation, and criminal prosecution.
Worked Example: Material Misrepresentation and Rescission
An applicant for a commercial property policy states the building has a central-station fire alarm and sprinklers; it has neither. The insurer charged $4,200 instead of the $9,000 the true (unprotected) class warrants. A fire occurs. Because the misrepresentation was material — it affected the decision to insure and the rate — the carrier may rescind the policy, deny the claim, and return premium. Had the misstatement been immaterial (e.g., the wrong paint color), rescission would not be available. The exam tests the materiality standard: would a prudent insurer have acted differently had it known the truth?
A producer was convicted of felony embezzlement (a crime of dishonesty). Under 18 U.S.C. 1033, the producer may continue working in insurance affecting interstate commerce only if: