18.3 Privacy (HIPAA/GLBA), Fraud, and Consumer Protection

Insurers and producers handle highly sensitive financial and medical information, so federal and state law impose strict privacy, anti-fraud, and consumer-protection rules. The exam tests the major federal frameworks and how they interact with state insurance law. Know which type of information each law protects.

Gramm-Leach-Bliley Act (GLBA)

The GLBA governs how financial institutions, including insurers, protect consumers' nonpublic personal information (NPI) – financial data such as account balances and application details. Its three core rules:

• Privacy Rule – requires a clear privacy notice at the start of the relationship and annually thereafter, describing what information is collected and shared.
• Opt-Out Right – consumers may opt out of having their NPI shared with nonaffiliated third parties (with limited exceptions, such as servicing the account or processing transactions).
• Safeguards Rule – requires administrative, technical, and physical safeguards to protect customer data from unauthorized access.

HIPAA Privacy and Portability

The Health Insurance Portability and Accountability Act (HIPAA) has two relevant pieces. The Privacy Rule protects protected health information (PHI) and limits its use and disclosure; covered entities must obtain the individual's authorization for non-routine disclosures.

The portability provisions historically limited preexisting-condition exclusions and guaranteed certain renewability and group-to-individual conversion rights. Under the ACA, individual and small-group plans generally cannot impose preexisting-condition exclusions at all, and coverage cannot be rescinded except for fraud or intentional misrepresentation.

Fair Credit Reporting Act (FCRA)

The FCRA governs consumer reports and investigative consumer reports used in underwriting. Key points tested:

• The applicant must be notified that an investigative consumer report may be obtained.
• If a policy is declined or rated based on a report, the applicant must be told (adverse-action notice) and given the source so they can request the information and dispute errors.
• Insurers may use credit-based insurance scores subject to state law.

Insurance Fraud and the Fraud Acts

Insurance fraud is a knowing, willful act to obtain money or a benefit by deception – committed by applicants, insureds, producers, or insurers. Under the federal Violent Crime Control and Law Enforcement Act (18 U.S.C. §1033/1034), it is a federal crime for anyone convicted of a felony involving dishonesty or breach of trust to engage in the business of insurance affecting interstate commerce without written consent from the state insurance regulator. Penalties include substantial fines and imprisonment.

Consumer Protection: Replacement and Free Look

Replacement regulations require producers to give the applicant notice, document the transaction, and provide comparison information so the consumer can make an informed decision – reinforcing the anti-twisting rules from Section 18.1. The existing insurer is usually given a chance to conserve the policy.

Most life policies include a free-look period (commonly 10 days, sometimes 20 or 30 for replacement or senior buyers) during which the buyer may return the policy for a full premium refund, no questions asked. Buyer's guides and policy summaries must be delivered so the consumer understands the product before committing. These layered protections – disclosure, opt-out, documentation, and the free look – form the consumer-protection backbone tested on the national exam.

HIPAA, GLBA, and Privacy Notices

Two federal laws frame insurance privacy. HIPAA protects protected health information (PHI), restricting how insurers and producers use and disclose medical data and requiring authorization for most disclosures. Gramm-Leach-Bliley (GLBA) protects nonpublic personal financial information, requiring financial institutions (including insurers) to give consumers a privacy notice describing information-sharing practices and an opt-out right for certain third-party disclosures.

Producers must safeguard both PHI and financial data, limit collection to what is necessary, and never disclose client information without authorization or a permitted purpose. The exam distinguishes HIPAA (health data) from GLBA (financial data) and tests the consumer's right to receive a privacy notice and to opt out of certain sharing under GLBA.

Fraud, the FCRA, and Consumer Protections

Insurance fraud — false statements on applications or claims — is a crime under state and federal law; the federal Fraud and False Statements statute can impose fines and imprisonment for fraud affecting interstate insurance commerce. Producers must report suspected fraud and never participate in it.

The Fair Credit Reporting Act (FCRA) governs consumer/investigative reports used in underwriting: the applicant must be notified that a report may be obtained, may request the nature and scope of an investigative report, and must receive an adverse-action notice if coverage is denied or rated based on the report. The applicant may also dispute and correct inaccurate information. The exam ties FCRA to underwriting disclosures and stresses the notification and adverse-action requirements as the consumer's core protections.

Worked Adverse-Action Scenario

An applicant for life insurance authorizes an investigative consumer report. The insurer, relying partly on information in that report, declines coverage. Under the FCRA, the insurer must provide an adverse-action notice identifying the reporting agency and informing the applicant of the right to obtain a free copy of the report and to dispute inaccuracies.

The applicant could not have been charged or denied based on the report without this notice. If the same applicant had merely been rated (charged more) because of the report, the adverse-action notice would still be required. This scenario ties together FCRA notification, the right to dispute, and the privacy duties producers owe when handling the data collected.