Privacy (HIPAA/GLBA), Fraud, and Consumer Protection

Privacy (HIPAA/GLBA), Fraud, and Consumer Protection

Three federal privacy and fraud frameworks appear on the national exam. Distinguish them by the type of information they protect and the consent model they use.

GLBA - financial privacy (opt-out)

The Gramm-Leach-Bliley Act (GLBA) protects nonpublic personal financial information (account numbers, income, premium history). Insurers must:

• Provide an initial privacy notice at the start of the relationship and annually thereafter (with some exceptions).
• Give consumers the right to opt out before the insurer shares information with nonaffiliated third parties for marketing.
• Maintain administrative and technical safeguards for the data.

Key trap: GLBA uses an opt-out model for financial data sharing. The consumer is presumed to consent unless they object.

GLBA distinguishes a consumer (someone who obtains a financial product for personal use) from a customer (a consumer with an ongoing relationship, such as a policyholder). Customers receive the privacy notice initially and at least annually; a one-time consumer may receive it only at the time of the transaction. There are exceptions allowing sharing without opt-out - for example, to service the policy, process claims, comply with law, or work with the insurer's own affiliates. The opt-out specifically targets sharing with nonaffiliated third parties for their own marketing.

HIPAA - health information (authorization / opt-in)

The Health Insurance Portability and Accountability Act (HIPAA) protects individually identifiable health information (Protected Health Information, PHI). Unlike GLBA, most disclosures of PHI for non-routine purposes require the individual's written authorization (an opt-in model). HIPAA also created portability protections that limit how group health plans can apply preexisting-condition exclusions and prohibit using health status to deny eligibility within a group.

FCRA and consumer reports

Under the Fair Credit Reporting Act (FCRA), when an insurer orders a consumer report or an investigative consumer report (interviews with neighbors/associates), it must notify the applicant in advance. If the insurer takes an adverse underwriting decision (decline, rate up, reduce coverage) based on the report, it must tell the applicant and identify the reporting agency so the consumer can request the file and dispute errors.

A related source is the Medical Information Bureau (MIB), a member-owned database of coded medical impairments. Insurers may report and check MIB codes, but an application or claim may not be denied solely on the basis of an MIB code; the code is only a flag prompting further investigation. The applicant signs an authorization permitting the insurer to obtain and share MIB information, and may request and correct their own MIB file.

Insurance fraud and the 1033/1034 prohibition

Insurance fraud is an intentional act to obtain a benefit or money to which a person is not entitled. The exam splits it into:

• Hard fraud - fabricating a loss entirely (e.g., staging a fake death claim).
• Soft fraud - exaggerating an otherwise legitimate claim (padding amounts or symptoms).

Both are crimes; soft fraud is the more common but still prosecutable. Most states require insurers to maintain a fraud-warning statement on applications and claim forms putting the consumer on notice that filing false information is a crime, and to operate a Special Investigative Unit (SIU) or anti-fraud plan.

18 U.S.C. 1033 and 1034 (Fraud and False Statements)

This federal statute makes it a crime for anyone engaged in the business of insurance to make false statements, embezzle, or willfully misuse funds in a way affecting interstate commerce. Critically, a person convicted of a felony involving dishonesty or breach of trust is prohibited from working in the business of insurance unless they obtain written consent (1033 waiver) from the appropriate insurance regulator. Knowingly employing such a person without consent is itself a violation. Section 1034 adds civil enforcement, letting the Attorney General seek injunctions and civil penalties.

The exam favors three facts: the bar applies to felonies involving dishonesty or breach of trust, the cure is a written 1033 waiver from the regulator, and the prohibition does not expire merely because years have passed.

Consumer protections at point of sale

Several disclosure tools protect buyers and frequently appear in scenario questions:

• Free-look period - life and annuity policies must give the owner a window (commonly 10 days, longer for replacement or seniors) to examine the policy and return it for a full premium refund.
• Buyer's Guide and Policy Summary - generic education on policy types and product-specific cost figures, delivered at or before delivery so consumers can comparison shop.
• Outline of Coverage - required for health, Medicare supplement, and long-term care sales to summarize benefits, exclusions, and limitations before purchase.
• Do-Not-Call and CAN-SPAM rules - limit telemarketing and unsolicited commercial email.
• Replacement notice and free-look interaction - on a replacement, many states extend the free-look (often to 20 or 30 days) precisely because the consumer is giving up an in-force contract.

Worked example: A senior buys an annuity, then changes her mind on day 8 of a 30-day senior free-look. She returns the contract and is entitled to a full refund of premium paid (for a variable product, generally the account value plus any charges, per state rule), not merely the surrender value.