18.3 Privacy, Fraud, and Consumer Protection

Federal Privacy and Credit Law Over the Insurance Sale

While insurance is regulated mostly by the states, several federal laws sit on top of the transaction and appear regularly on the P&C exam. The two heavyweights are the Gramm-Leach-Bliley Act (GLBA) and the Fair Credit Reporting Act (FCRA).

• GLBA requires a financial institution, including an insurer, to give consumers a privacy notice describing its information-sharing practices and an opt-out before sharing nonpublic personal information with unaffiliated third parties.
• FCRA governs the use of consumer reports (including credit-based insurance scores). If an insurer takes an adverse action - declines, charges more, or cancels - based even in part on a report, it must send an adverse-action notice telling the consumer and identifying the reporting agency.

Classic trap: An adverse-action notice (FCRA) is not the same as a simple declination. The trigger for the FCRA notice is the use of a consumer report in the decision. If no report was used, no adverse-action notice is required, even though the applicant was still declined.

A third federal law, HIPAA, protects individually identifiable health information and is more central to health lines, but P&C producers handling medical-payments or injury data should recognize its existence.

The 1033 Felony Bar

18 U.S.C. 1033/1034 makes it a federal crime for anyone convicted of a felony involving dishonesty or breach of trust to engage in the business of insurance affecting interstate commerce without written consent - a 1033 waiver - from the appropriate state insurance regulator.

Exam point: The bar is not limited to insurance-related felonies. Any felony involving dishonesty or breach of trust (embezzlement, fraud, theft) triggers 1033. The person may apply for a written waiver, but until granted, working in insurance is a federal violation - and the employer who knowingly hires them is also liable. This is why background questions on license applications and the duty to report felony convictions are taken so seriously.

Insurance Fraud: Hard, Soft, and Policy-Level

Fraud is intentional deception for gain, and the exam distinguishes three flavors:

Soft fraud is by far the most common and the most tested because it hides inside a genuine claim. Policy-level fraud connects to the Concealment, Misrepresentation, or Fraud condition found in most P&C forms: a material lie - one that would change underwriting or claim handling - can void the policy. Note the contract uses a broad fraud condition, while criminal fraud requires proof of intent. The exam often asks whether a misstatement was material; immaterial errors generally do not void coverage.

Point-of-Sale and Post-Sale Consumer Protections

A cluster of consumer-protection rules protects the policyholder at and after purchase:

• Free-look period - a window (commonly 10 days) to review and return a new policy for a full refund.
• Replacement disclosure - when a new policy replaces an existing one, the producer must disclose the comparison so the client is not unknowingly disadvantaged (this is the honest counterpart to illegal twisting and churning).
• Suitability - the recommendation must match the client's needs.
• Cancellation and nonrenewal notices - the insurer must give advance written notice before cutting off coverage, with longer notice for nonrenewal and limited grounds for mid-term cancellation after the policy is established.

Defamation vs. privacy trap: Defamation (a UTPA marketing offense) is a false statement injuring a competitor. A privacy breach (GLBA) is the improper disclosure of a customer's nonpublic information, which may be entirely true. The exam pairs these to test whether you key on falsity (defamation) versus disclosure of private data (privacy).

Fraud Reporting, Immunity, and the Anti-Fraud System

Fighting fraud is not just the regulator's job; the system relies on insurers and producers to report suspected fraud. Most states have an insurance fraud statute and a fraud bureau within the Division or the state government that investigates referrals.

• Mandatory reporting - many states require an insurer that has reasonable belief a fraudulent claim is being made to report it to the fraud bureau.
• Immunity - statutes typically grant civil immunity to those who report suspected fraud in good faith, so the fear of a defamation suit does not chill reporting.
• Special Investigation Units (SIUs) - larger insurers maintain SIUs to investigate questionable claims and coordinate with regulators and law enforcement.
• Fraud warning statements - claim forms and applications often carry a printed warning that filing a false claim is a crime; this supports later prosecution.

Good-faith reporting trap: Because reporting suspected fraud in good faith is immunized, a producer who reports a genuinely suspicious claim is not committing defamation, even if the claimant is later cleared. The protection turns on good faith, not on being ultimately correct.

This closes the loop between ethics and fraud: the same producer who keeps premiums in trust, discloses fully, and avoids twisting also has a role in the anti-fraud system - recognizing red flags and routing suspicions through the proper channel rather than confronting the insured directly.