18.3 Privacy, Fraud, and Consumer Protection

The Privacy Framework: GLBA, HIPAA, and FCRA

Insurers handle sensitive data, so three federal laws frame the privacy duties tested nationally.

Trap: GLBA's opt-out applies to sharing with nonaffiliated third parties; sharing among affiliates and sharing necessary to service the policy are treated differently.

Credit-Based Insurance Scores and Adverse Action

Many states allow credit-based insurance scores in personal lines rating because the data correlates with loss frequency. When a credit report leads to a less favorable outcome—higher premium, declination, or non-renewal—the FCRA requires an adverse-action notice that:

• States that the action was based in whole or part on a consumer report
• Identifies the consumer reporting agency that supplied it
• Tells the consumer of the right to a free copy of the report and to dispute inaccuracies

Trap: The notice must disclose the specific reasons/source, not merely "based on your record."

Insurance Fraud: Hard, Soft, and the Federal Bar

Fraud is intentional deception for unlawful gain. The exam distinguishes:

• Hard fraud: deliberately staging or fabricating a loss (a torched building, a faked theft).
• Soft fraud (opportunistic): padding an otherwise legitimate claim or shading an application—still a crime.

Under the federal Violent Crime Control and Law Enforcement Act, fraud by anyone engaged in the business of insurance whose activities affect interstate commerce is a federal felony.

Separately, 18 U.S.C. §1033/1034 makes it a federal crime for a person convicted of a felony involving dishonesty or breach of trust to work in insurance affecting interstate commerce without written consent (a 1033 waiver) from the state regulator. An insurer that knowingly hires such a person without consent also violates the statute.

Consumer Protection Mechanics

Beyond privacy and fraud, the national portion tests everyday consumer safeguards:

• Free-look period: a window (commonly 10 days, longer on replacements) to return a policy for a full premium refund.
• Plain-language and delivery: the insured is entitled to a copy of the contract and clear disclosure of material terms.
• Anti-rebating and disclosure of compensation: producers must not induce purchases with undisclosed value and, in many states, must disclose compensation on request.
• Replacement rules: comparison disclosures protect against twisting/churning when an existing policy is replaced.

Worked angle: If a consumer's homeowners renewal premium rises partly due to a credit-based score, the insurer must send an FCRA adverse-action notice naming the reporting agency—failure to do so is a compliance violation even if the rate itself is actuarially justified.

Fraud Detection and Reporting Duties

Producers are a front line against fraud and carry affirmative duties:

• Most states grant immunity for good-faith reports of suspected fraud to the insurance department or a fraud bureau, and many require reporting suspected fraud.
• Policies must carry a fraud warning statement on applications and claim forms (e.g., that knowingly filing a false claim is a crime).
• Special Investigation Units (SIUs) review red-flag claims—prior-loss patterns, post-binding losses, and inflated inventories.

Trap: Reporting in good faith is protected; the violation is failing to report a known fraud or, worse, helping a client pad a claim. A producer who "rounds up" a contents inventory to help a client is committing soft fraud, not customer service.

GLBA Notices and the Opt-Out in Practice

Gramm-Leach-Bliley imposes concrete mechanics the exam tests literally. A financial institution—including an insurer or agency—must:

• Deliver a clear initial privacy notice at the start of the relationship and an annual notice thereafter describing what nonpublic personal information (NPI) it collects and shares.
• Give consumers a reasonable opportunity to opt out before NPI is disclosed to a nonaffiliated third party (commonly a 30-day window).
• Maintain administrative, technical, and physical safeguards to protect customer data.

Key exceptions that do not require opt-out: sharing necessary to service or process the policy the consumer requested, sharing with the insurer's own affiliates, and disclosures required by law. The trap answer treats every data share as opt-out-eligible—only nonaffiliated, non-servicing disclosures trigger the opt-out right.

Identity Theft, Data Security, and Replacement Protections

Modern consumer-protection rules extend beyond the core statutes. The FCRA/FACTA Red Flags Rule requires programs to detect and respond to identity-theft warning signs in covered accounts. The NAIC Insurance Data Security Model Law, adopted in many states, requires a written information-security program and prompt breach notification to the commissioner—often within 72 hours of determining a breach occurred.

On replacement, comparison-disclosure rules require a side-by-side of the old and new policy—directly countering twisting and churning. Tie it together: privacy law protects the consumer's data, fraud law protects the risk pool, and disclosure law protects the consumer's decision.

Putting the Federal Layer Together

Remember the division of labor the exam tests. States license producers and enforce UTPA/UCSPA, free-look, and replacement rules. Federal law overlays privacy (GLBA, HIPAA), credit-report use (FCRA), and the criminal floor (Violent Crime Control Act fraud felony; the 1033/1034 employment bar).

When a question spans both levels, the stricter standard controls, and federal criminal provisions are never waived by a state license.