18.3 Privacy, Fraud, and Consumer Protection
Key Takeaways
The Gramm-Leach-Bliley Act (GLBA) requires insurers to give a privacy notice and an OPT-OUT before sharing nonpublic personal information with nonaffiliated third parties
The Fair Credit Reporting Act (FCRA) governs use of consumer/credit reports for underwriting and requires ADVERSE ACTION notices when a report causes a declination or higher rate
Insurance fraud includes hard fraud (staged or fabricated losses) and soft fraud (padding a legitimate claim); the federal Fraud and False Statements provision makes interstate insurance fraud a crime
The USA PATRIOT Act / anti-money-laundering (AML) rules apply mainly to insurers issuing products with cash value, requiring suspicious-activity reporting
Replacement, free-look, and disclosure rules give consumers time and information to make and reverse decisions
Privacy: The Gramm-Leach-Bliley Act (GLBA)
The Gramm-Leach-Bliley Act (GLBA) of 1999, also called the Financial Services Modernization Act, sets the federal baseline for protecting nonpublic personal information (NPI)—data like a customer's financial details, claims history, and health information that is not publicly available. Insurers and producers are financial institutions under GLBA.
GLBA imposes three core duties:
- Privacy Notice: deliver a clear notice of the insurer's information-sharing practices at the start of the relationship and annually thereafter (with later exceptions for unchanged practices).
- Opt-Out Right: before sharing NPI with a nonaffiliated third party, the consumer must be given a reasonable opportunity to opt out.
- Safeguards: maintain administrative, technical, and physical security to protect the data.
Opt-Out vs. Sharing Exceptions
| Sharing scenario | Opt-out required? |
|---|---|
| Sharing NPI with a marketing firm (nonaffiliated) | Yes |
| Sharing to service the policy or process a claim | No (necessary to perform the transaction) |
| Sharing with an affiliate | Notice applies; GLBA opt-out is for nonaffiliated sharing |
| Sharing to comply with law or a subpoena | No |
Exam Key: The GLBA opt-out applies specifically to nonaffiliated third parties and not to disclosures necessary to perform the requested insurance transaction.
Credit Information: The Fair Credit Reporting Act (FCRA)
The Fair Credit Reporting Act (FCRA) governs how insurers obtain and use consumer reports and credit-based insurance scores for underwriting. Two duties are heavily tested:
- Permissible purpose & notice: the insurer must have a permissible purpose (underwriting) and notify the applicant that a report may be obtained.
- Adverse Action notice: if information in a consumer or credit report causes a declination, cancellation, or a less favorable rate/term, the insurer must send an adverse action notice telling the consumer which agency supplied the report and that the consumer may obtain a free copy and dispute inaccuracies.
Worked example: an auto applicant is quoted a standard rate but, after the insurer pulls a credit-based insurance score, is moved to a substandard tier costing $280 more per year. Because the credit report caused a less favorable rate, the insurer must issue an adverse action notice identifying the reporting agency.
Privacy of Health Information
For health-related NPI, insurers also follow medical-privacy rules and, where applicable, HIPAA. The producer's practical duty is the same throughout: collect only what is needed, share only as permitted, and secure the data.
An insurer obtains a credit-based insurance score on an auto applicant and, because of that report, places the applicant in a higher-priced rating tier. Under the Fair Credit Reporting Act, the insurer must:
Do nothing, because credit scores are public information
Send an adverse action notice identifying the reporting agency and the right to a free copy and dispute
Obtain the applicant's written opt-in before quoting any rate
Refund the difference in premium for the first year
Insurance Fraud
Insurance fraud is an intentional deception to obtain an unfair or unlawful benefit. The exam distinguishes:
- Hard fraud: deliberately staging or fabricating a loss that never happened (e.g., torching an insured warehouse, faking a theft).
- Soft fraud (opportunistic): padding or exaggerating an otherwise legitimate claim (e.g., adding nonexistent items to a real burglary claim, or inflating repair costs).
Fraud can be committed by insureds, producers, and even insurers. The federal Fraud and False Statements provision (18 U.S.C. 1033/1034) makes it a federal crime for anyone engaged in the business of insurance affecting interstate commerce to act dishonestly; a person convicted of a felony involving dishonesty is generally barred from the insurance business unless they obtain written consent (a 1033 waiver) from the regulator.
Anti-Fraud and AML Controls
- States operate Insurance Fraud Bureaus and require insurers to maintain anti-fraud plans and to print fraud-warning statements on applications and claim forms.
- The USA PATRIOT Act and federal anti-money-laundering (AML) rules apply chiefly to insurers issuing products with cash value or investment features; covered insurers must file Suspicious Activity Reports (SARs). Most pure P&C products are lower risk, but producers must still recognize and report red flags such as large cash payments and structured transactions.
Consumer-Protection Disclosures
Several rules give consumers time and information:
| Protection | What it does | Typical window |
|---|---|---|
| Free-look period | Lets a new policyholder return the policy for a full refund | Often 10-30 days (more common on life/health) |
| Replacement notice | Requires written comparison disclosure before replacing a policy | At or before application |
| Cancellation/Nonrenewal notice | Advance written warning so the insured can find new coverage | Commonly 10-60 days, varies by line/state |
| Buyer's guide / outline of coverage | Plain-language summary of what the policy does | At point of sale |
These disclosure duties dovetail with the UTPA: failing to deliver a required replacement notice, or misstating the terms in one, can simultaneously be twisting and a consumer-protection violation.
Exam Key: Privacy = GLBA opt-out for nonaffiliated sharing. Credit/underwriting reports = FCRA adverse action. Dishonesty in the business of insurance = 18 U.S.C. 1033 federal crime and a 1033 waiver to return.
Putting It Together
Consumer protection is the practical face of producer ethics: handle data lawfully (GLBA, FCRA), refuse to participate in or ignore fraud (state anti-fraud laws, 18 U.S.C. 1033, AML), and make the required disclosures honestly and on time. A producer who masters these federal and model-law standards avoids the most common—and most career-ending—violations on the exam and in practice.
An insured submits a genuine claim for a burglary but adds three televisions that were never stolen in order to increase the payout. This is an example of:
Hard fraud, because the entire loss was fabricated
Soft fraud, because a legitimate claim was padded with exaggerated or nonexistent losses
A GLBA privacy violation
A lawful claim subject only to the deductible
The Federal Privacy and Fraud Framework
Producers must follow several federal consumer-protection statutes layered on top of state law. Each governs a specific kind of information or conduct.
| Law | What it requires |
|---|---|
| Gramm-Leach-Bliley Act (GLBA) | Privacy notices; safeguard nonpublic personal financial information; opt-out before sharing |
| Fair Credit Reporting Act (FCRA) | Notice when an adverse action (declination/higher rate) is based on a consumer/credit report |
| HIPAA | Protects medical/health information used in underwriting |
| Fraud and False Statements (18 U.S.C. 1033/1034) | Bars persons convicted of a felony involving dishonesty from the insurance business without written consent |
Worked exam point: an insurer that declines an applicant or charges more because of information in a credit-based insurance score must send an FCRA adverse-action notice identifying the reporting agency and the applicant's right to a free report and to dispute errors.
Exam Trap: Under 18 U.S.C. 1033, a producer convicted of a felony involving breach of trust or dishonesty is prohibited from working in insurance unless granted written 1033 consent by the regulator - a violation carries federal criminal penalties on top of license revocation.
Sections you finish are checked off in the contents.