18.3 Privacy, Fraud, and Consumer Protection

Privacy laws governing insurance

Two federal frameworks plus the NAIC privacy model dominate the exam. Match each to the data it protects.

FCRA and adverse action

Under FCRA, when an insurer declines coverage or charges more because of a consumer report or insurance score, it must give the applicant an adverse action notice identifying the reporting agency and the applicant's right to a free copy of the report and to dispute errors. A tested trap: the insurer is not required to give the reason score itself, only to disclose the agency and the dispute rights.

Investigative consumer reports

When an insurer orders an investigative consumer report (personal interviews about character, reputation, lifestyle), FCRA requires the applicant be notified in writing within 3 days of the request and informed of the right to request the nature and scope of the investigation.

GLBA opt-out vs. HIPAA authorization

A frequently confused pair: GLBA uses an OPT-OUT model for sharing nonpublic financial information with nonaffiliated third parties — the information may be shared unless the consumer affirmatively says no after receiving the privacy notice. HIPAA uses an OPT-IN (authorization) model for protected health information — the data generally may not be shared until the consumer affirmatively authorizes it.

P&C producers handling medical-payments or workers' compensation claims touch PHI and must respect the authorization rule. The practical exam cue: "financial information / nonaffiliated third party / annual notice" points to GLBA; "medical records / treatment / authorization" points to HIPAA.

Sharing with affiliates vs. nonaffiliates

A subtle GLBA distinction: the opt-out right applies to NONAFFILIATED third parties. An insurer may generally share NPI freely with its own affiliates (companies under common control) and with service providers under a joint-marketing agreement; the consumer cannot opt out of those. The opt-out bites only when data goes to an unrelated company — for example, selling a customer list to an outside marketer. Exam stems test whether the recipient is affiliated.

Insurance fraud and consumer protection statutes

Insurance fraud is a knowing misrepresentation to obtain an improper benefit. It runs in both directions: claimant fraud (staged accidents, inflated claims) and insurer/producer fraud (premium theft, fictitious policies). Most states require a fraud warning on applications and claim forms and mandate referral of suspected fraud to a fraud bureau.

Two federal acts carry teeth for producers:

• Fraud and False Statements (18 U.S.C. 1033/1034) — bars anyone convicted of a felony involving dishonesty or breach of trust from working in insurance affecting interstate commerce without written consent (a 1033 waiver) from the state commissioner. Penalties reach fines and up to 10–15 years imprisonment.
• USA PATRIOT Act / Anti-Money-Laundering (AML) — requires AML programs and Suspicious Activity Reports (SARs) for covered products; cash-value products are higher risk than pure P&C, but producers must still recognize red flags.

Worked example — 1033 waiver

An applicant for a producer license disclosed a prior felony embezzlement conviction. Embezzlement is a crime of dishonesty/breach of trust, so under 18 U.S.C. 1033 the applicant cannot transact insurance affecting interstate commerce until obtaining a written 1033 consent waiver from the commissioner—even if the state license is otherwise granted. Hiring this person without the waiver also exposes the employing insurer to liability.

Consumer protection mechanisms

• Free-look period — typically 10 days (longer for replacements/seniors) to return a policy for a full refund.
• Buyer's guides and disclosure statements delivered with or before the policy.
• Guaranty associations protect policyholders if an admitted insurer becomes insolvent, paying covered claims up to statutory caps.
• Department of Insurance complaint process — consumers may file directly with the Commissioner, who investigates and can order restitution.
• Cancellation and nonrenewal notice — most states require advance written notice (commonly 10 days for nonpayment, 30 days otherwise) before an insurer may cancel or nonrenew, so the consumer can replace coverage.

Replacement, anti-money-laundering, and recordkeeping duties

When a transaction replaces existing coverage, most states require a signed replacement notice and a comparison so the consumer can judge whether the change is in their interest — this is the consumer-protection counterweight to twisting and churning.

On the AML side, while pure P&C products carry low money-laundering risk, producers who sell cash-value products must follow their company's AML program, complete training, and file Suspicious Activity Reports when transactions show red flags such as early surrender for cash or oversized cash premiums.

Producers must also retain records of applications, premium receipts, and disclosures for a stated retention period (often 3–5 years) so regulators can audit compliance. A consumer who suspects an improper sale can request these records through the department. Together these recordkeeping, disclosure, and reporting duties ensure the file itself can later demonstrate that the producer acted ethically, disclosed material terms, and remitted funds lawfully — turning documentation into the producer's primary defense.