18.3 Privacy, Fraud, and Consumer Protection
Key Takeaways
- The Gramm-Leach-Bliley Act (GLBA) requires insurers to give a privacy notice and an OPT-OUT before sharing nonpublic personal information with nonaffiliated third parties
- The Fair Credit Reporting Act (FCRA) governs use of consumer/credit reports for underwriting and requires ADVERSE ACTION notices when a report causes a declination or higher rate
- Insurance fraud includes hard fraud (staged or fabricated losses) and soft fraud (padding a legitimate claim); the federal Fraud and False Statements provision makes interstate insurance fraud a crime
- The USA PATRIOT Act / anti-money-laundering (AML) rules apply mainly to insurers issuing products with cash value, requiring suspicious-activity reporting
- Replacement, free-look, and disclosure rules give consumers time and information to make and reverse decisions
Privacy: The Gramm-Leach-Bliley Act (GLBA)
The Gramm-Leach-Bliley Act (GLBA) of 1999, also called the Financial Services Modernization Act, sets the federal baseline for protecting nonpublic personal information (NPI)—data like a customer's financial details, claims history, and health information that is not publicly available. Insurers and producers are financial institutions under GLBA.
GLBA imposes three core duties:
- Privacy Notice: deliver a clear notice of the insurer's information-sharing practices at the start of the relationship and annually thereafter (with later exceptions for unchanged practices).
- Opt-Out Right: before sharing NPI with a nonaffiliated third party, the consumer must be given a reasonable opportunity to opt out.
- Safeguards: maintain administrative, technical, and physical security to protect the data.
Opt-Out vs. Sharing Exceptions
| Sharing scenario | Opt-out required? |
|---|---|
| Sharing NPI with a marketing firm (nonaffiliated) | Yes |
| Sharing to service the policy or process a claim | No (necessary to perform the transaction) |
| Sharing with an affiliate | Notice applies; GLBA opt-out is for nonaffiliated sharing |
| Sharing to comply with law or a subpoena | No |
Exam Key: The GLBA opt-out applies specifically to nonaffiliated third parties and not to disclosures necessary to perform the requested insurance transaction.
Credit Information: The Fair Credit Reporting Act (FCRA)
The Fair Credit Reporting Act (FCRA) governs how insurers obtain and use consumer reports and credit-based insurance scores for underwriting. Two duties are heavily tested:
- Permissible purpose & notice: the insurer must have a permissible purpose (underwriting) and notify the applicant that a report may be obtained.
- Adverse Action notice: if information in a consumer or credit report causes a declination, cancellation, or a less favorable rate/term, the insurer must send an adverse action notice telling the consumer which agency supplied the report and that the consumer may obtain a free copy and dispute inaccuracies.
Worked example: an auto applicant is quoted a standard rate but, after the insurer pulls a credit-based insurance score, is moved to a substandard tier costing $280 more per year. Because the credit report caused a less favorable rate, the insurer must issue an adverse action notice identifying the reporting agency.
Privacy of Health Information
For health-related NPI, insurers also follow medical-privacy rules and, where applicable, HIPAA. The producer's practical duty is the same throughout: collect only what is needed, share only as permitted, and secure the data.
An insurer obtains a credit-based insurance score on an auto applicant and, because of that report, places the applicant in a higher-priced rating tier. Under the Fair Credit Reporting Act, the insurer must:
Insurance Fraud
Insurance fraud is an intentional deception to obtain an unfair or unlawful benefit. The exam distinguishes:
- Hard fraud: deliberately staging or fabricating a loss that never happened (e.g., torching an insured warehouse, faking a theft).
- Soft fraud (opportunistic): padding or exaggerating an otherwise legitimate claim (e.g., adding nonexistent items to a real burglary claim, or inflating repair costs).
Fraud can be committed by insureds, producers, and even insurers. The federal Fraud and False Statements provision (18 U.S.C. 1033/1034) makes it a federal crime for anyone engaged in the business of insurance affecting interstate commerce to act dishonestly; a person convicted of a felony involving dishonesty is generally barred from the insurance business unless they obtain written consent (a 1033 waiver) from the regulator.
Anti-Fraud and AML Controls
- States operate Insurance Fraud Bureaus and require insurers to maintain anti-fraud plans and to print fraud-warning statements on applications and claim forms.
- The USA PATRIOT Act and federal anti-money-laundering (AML) rules apply chiefly to insurers issuing products with cash value or investment features; covered insurers must file Suspicious Activity Reports (SARs). Most pure P&C products are lower risk, but producers must still recognize and report red flags such as large cash payments and structured transactions.
Consumer-Protection Disclosures
Several rules give consumers time and information:
| Protection | What it does | Typical window |
|---|---|---|
| Free-look period | Lets a new policyholder return the policy for a full refund | Often 10-30 days (more common on life/health) |
| Replacement notice | Requires written comparison disclosure before replacing a policy | At or before application |
| Cancellation/Nonrenewal notice | Advance written warning so the insured can find new coverage | Commonly 10-60 days, varies by line/state |
| Buyer's guide / outline of coverage | Plain-language summary of what the policy does | At point of sale |
These disclosure duties dovetail with the UTPA: failing to deliver a required replacement notice, or misstating the terms in one, can simultaneously be twisting and a consumer-protection violation.
Exam Key: Privacy = GLBA opt-out for nonaffiliated sharing. Credit/underwriting reports = FCRA adverse action. Dishonesty in the business of insurance = 18 U.S.C. 1033 federal crime and a 1033 waiver to return.
Putting It Together
Consumer protection is the practical face of producer ethics: handle data lawfully (GLBA, FCRA), refuse to participate in or ignore fraud (state anti-fraud laws, 18 U.S.C. 1033, AML), and make the required disclosures honestly and on time. A producer who masters these federal and model-law standards avoids the most common—and most career-ending—violations on the exam and in practice.
An insured submits a genuine claim for a burglary but adds three televisions that were never stolen in order to increase the payout. This is an example of:
The Federal Privacy and Fraud Framework
Producers must follow several federal consumer-protection statutes layered on top of state law. Each governs a specific kind of information or conduct.
| Law | What it requires |
|---|---|
| Gramm-Leach-Bliley Act (GLBA) | Privacy notices; safeguard nonpublic personal financial information; opt-out before sharing |
| Fair Credit Reporting Act (FCRA) | Notice when an adverse action (declination/higher rate) is based on a consumer/credit report |
| HIPAA | Protects medical/health information used in underwriting |
| Fraud and False Statements (18 U.S.C. 1033/1034) | Bars persons convicted of a felony involving dishonesty from the insurance business without written consent |
Worked exam point: an insurer that declines an applicant or charges more because of information in a credit-based insurance score must send an FCRA adverse-action notice identifying the reporting agency and the applicant's right to a free report and to dispute errors.
Exam Trap: Under 18 U.S.C. 1033, a producer convicted of a felony involving breach of trust or dishonesty is prohibited from working in insurance unless granted written 1033 consent by the regulator - a violation carries federal criminal penalties on top of license revocation.