18.3 Privacy (HIPAA/GLBA), Fraud, and Consumer Protection

Insurance touches highly sensitive financial and medical data, so producers must master the federal privacy and anti-fraud framework. The exam tests the scope of each law (who it covers and what it protects) and the consumer rights each creates.

Gramm-Leach-Bliley Act (GLBA)

The GLBA governs how financial institutions, including insurers, handle consumers' nonpublic personal financial information (NPI). Its core requirements:

Exam trap: GLBA is opt-out for sharing with nonaffiliated third parties — the consumer must act to stop sharing. Certain disclosures (servicing the account, legal compliance) are exempt and need no opt-out.

HIPAA Privacy and Portability

The Health Insurance Portability and Accountability Act (HIPAA) has two exam-relevant pieces:

• Privacy Rule — protects protected health information (PHI); disclosures for treatment, payment, and health-care operations are generally permitted, while most marketing uses require authorization.
• Portability — limits how group health plans treat pre-existing conditions and guarantees access; the ACA later eliminated pre-existing-condition exclusions entirely for most plans.

HIPAA's minimum necessary principle limits PHI use to what is needed for the task. A producer who discloses an applicant's HIV status to a neighbor violates the Privacy Rule.

Insurance Fraud and the Fraud and False Statements Act

Insurance fraud is a knowing misrepresentation made to obtain an improper benefit. The federal Fraud and False Statements provision (18 U.S.C. 1033/1034) makes it a crime for anyone engaged in the business of insurance to make false statements or to embezzle funds.

A critical, frequently tested rule: a person convicted of a felony involving dishonesty or breach of trust may not work in insurance affecting interstate commerce without written consent (a 1033 waiver) from the state insurance commissioner. Violations carry fines and up to 10 years imprisonment (longer if the act jeopardizes an insurer's solvency).

USA PATRIOT Act / Anti-Money Laundering (AML)

Insurers issuing products with cash value (permanent life, annuities) must maintain an AML program and file reports on suspicious activity. Cash-value products can be vehicles for laundering, so large cash premium payments or early surrenders are monitored.

Telemarketing and Do-Not-Call

Producers must honor the National Do-Not-Call Registry and CAN-SPAM rules for email. Calling a registered number to solicit insurance, absent an established business relationship, risks federal penalties.

Exam Tip: Distinguish the laws by data type — GLBA = financial NPI, HIPAA = medical PHI, 1033 = fraud/felony bar, AML = money laundering on cash-value products.

The Fair Credit Reporting Act (FCRA) and Insurance Information

When an insurer uses a consumer report (including credit-based insurance scores or an MIB record) in underwriting, the Fair Credit Reporting Act (FCRA) applies. If the insurer takes an adverse action (declines, rates up, or cancels) based on the report, it must give the applicant notice of the adverse action and the name of the reporting agency so the consumer can request the report and dispute errors.

Investigative Consumer Reports

If the insurer orders an investigative consumer report (based on interviews with neighbors, associates, or employers about character and reputation), the applicant must be notified in writing within three days and has the right to request the nature and scope of the investigation.

Putting Consumer Protection Together

The producer's day-to-day duties flow from these laws: deliver privacy notices, obtain proper authorizations before disclosing PHI, give adverse-action and investigative-report notices, screen for 1033 issues before hiring, watch cash-value transactions for AML red flags, and honor Do-Not-Call requests.

• Before underwriting: secure HIPAA authorization and FCRA notices
• During the relationship: deliver GLBA privacy and opt-out notices
• At an adverse decision: provide the adverse-action notice and report source
• At every step: never misrepresent, never disclose more PHI than necessary

Key point: An exam item that mentions a declined application based on a credit or MIB report is testing FCRA adverse-action notice, not GLBA. Read for the data type and the triggering event to choose the right statute.

The Terrorism, Identity, and Senior-Protection Overlays

Two more federal touchpoints round out the consumer-protection map. Under the USA PATRIOT Act, insurers must verify customer identity and screen against government watch lists before issuing covered cash-value products. Separately, the NAIC senior-protection and best-interest rules treat sales to consumers age 65 and older with heightened scrutiny, because surrender charges and annuitization decisions are hard to reverse late in life. A producer who places an illiquid, long-surrender annuity with an elderly client who has stated near-term income needs commits a textbook suitability violation that also implicates these protections.