18.3 Privacy, Fraud, and Consumer Protection

Privacy of Consumer Financial and Health Information

Two federal frameworks dominate the privacy questions on the national exam. The Gramm-Leach-Bliley Act (GLBA) governs nonpublic personal financial information and requires financial institutions, including insurers and agencies, to provide a privacy notice at the start of the relationship and annually, and to give consumers the right to opt out of sharing with nonaffiliated third parties. The Health Insurance Portability and Accountability Act (HIPAA) governs protected health information (PHI), relevant when P&C lines such as workers compensation or medical-payments coverage touch medical records.

The Fair Credit Reporting Act (FCRA)

The FCRA controls how insurers use consumer reports (including credit-based insurance scores) and investigative consumer reports (which gather information through interviews with neighbors, employers, or associates). Tested obligations:

• Disclose to the applicant that a report may be obtained
• For an investigative report, give written notice within 3 days of ordering it and disclose the nature/scope on request
• If an adverse action (declination, higher rate, nonrenewal) is taken based on a report, give the applicant an adverse-action notice identifying the reporting agency and the right to a free copy and to dispute inaccuracies

Note that the FCRA agency does not decide insurability — it only supplies information; the adverse action notice is the consumer's gateway to correcting errors.

Gramm-Leach-Bliley Notices and HIPAA's Insurance Reach

The privacy framework the exam tests rests on two federal pillars plus state add-ons. The Gramm-Leach-Bliley Act (GLBA) requires insurers to give consumers an initial and annual privacy notice describing what nonpublic personal information is collected and shared, and to provide an opt-out before sharing certain information with nonaffiliated third parties — sharing with affiliates and for servicing the policy is generally permitted without opt-out.

The NAIC Insurance Information and Privacy Protection Model Act adds rights to access and correct recorded personal information and limits pretext interviews. HIPAA governs protected health information held by insurers conducting health-related business and requires safeguards and authorizations for disclosure. The Fair Credit Reporting Act (FCRA) requires an adverse-action notice when an insurer declines, cancels, or surcharges based on a consumer or credit report, telling the consumer the source so they can dispute errors.

Knowing opt-out vs. opt-in, affiliate vs. nonaffiliate sharing, and the adverse-action trigger resolves most privacy questions on the exam.

Insurance Fraud

Fraud is a knowing misrepresentation of a material fact intended to induce reliance that causes harm. The exam distinguishes:

• Hard fraud — a fabricated or staged loss (a faked theft, an arson-for-profit fire)
• Soft fraud — inflating an otherwise legitimate claim (padding a real burglary loss with items never owned)

Fraud can be committed by applicants/insureds, by producers, or by insurers (e.g., misrepresenting coverage or unfairly denying valid claims). The federal Violent Crime Control Act (18 U.S.C. 1033/1034) makes it a federal crime for anyone in the business of insurance affecting interstate commerce to engage in fraud, and bars individuals convicted of felonies involving dishonesty from the business absent a regulator's written waiver.

Anti-Fraud Tools the Exam Tests

• Fraud warning statements on applications and claim forms put the signer on notice that fraud is a crime
• State Insurance Fraud Bureaus investigate and refer cases for prosecution
• The NICB (National Insurance Crime Bureau) is an industry organization that supports fraud and theft investigations
• Immunity statutes protect insurers that report suspected fraud in good faith from defamation liability
• SIU (Special Investigations Units) within insurers handle suspicious claims

A producer who knowingly assists or conceals a fraudulent claim is exposed to license revocation and criminal liability — the producer's correct action upon suspecting fraud is to report it through the insurer's SIU and the state fraud bureau, not to negotiate or ignore it.

Telemarketing, CAN-SPAM, and Do-Not-Call

The national portion also touches solicitation rules. The federal Telephone Consumer Protection Act (TCPA) and the National Do-Not-Call Registry restrict unsolicited sales calls; producers must scrub call lists against the registry and honor opt-out requests, and many states impose their own do-not-call and recorded-call consent rules. The CAN-SPAM Act governs commercial email, requiring a valid sender identity, a truthful subject line, and a working unsubscribe mechanism. Violations carry per-call or per-email penalties, so the exam treats compliant list management and prompt opt-out handling as part of ethical producer conduct.

Consumer Protection Mechanisms

Beyond privacy and fraud rules, the national portion tests several consumer safeguards:

Guaranty-association coverage is funded by assessments on solvent insurers, not taxpayers, and the exam stresses that producers may not advertise guaranty-fund protection as a sales inducement — doing so is a prohibited practice.