18.3 Privacy, Fraud, and Consumer Protection

Privacy of Consumer Information

Two federal statutes anchor insurance privacy. The Gramm-Leach-Bliley Act (GLBA) protects nonpublic personal information (NPI) - financial data a consumer gives an insurer. Insurers must:

• Provide a privacy notice at the start of the relationship and annually.
• Give an opt-out before sharing NPI with nonaffiliated third parties.
• Maintain administrative and technical safeguards (the Safeguards Rule).

Many states adopt the NAIC Insurance Information and Privacy Protection Model Act, which adds protected-health-information handling on top of GLBA.

The Fair Credit Reporting Act (FCRA)

The Fair Credit Reporting Act (FCRA) governs consumer reports used in underwriting, including credit-based insurance scores and motor-vehicle records.

If an insurer takes adverse action - declines, cancels, or charges more - based even in part on a consumer report, it must give the applicant:

1. Notice of the adverse action.
2. The name and contact information of the reporting agency.
3. Notice of the right to a free copy of the report and to dispute errors.

Exam trap: the reporting agency does not make the decision - the insurer does - so the insurer owes the adverse-action notice.

Insurance Fraud

Fraud is intentional deception for unlawful gain and is generally a crime regardless of dollar amount. Two categories appear on the exam:

Most states require a fraud-warning statement on applications and claim forms, warning that knowingly false statements are crimes subject to fines and imprisonment.

Anti-Fraud Infrastructure

States support fraud detection through:

• Insurance fraud bureaus that investigate and refer cases for prosecution.
• Immunity statutes that shield insurers and producers from civil liability for good-faith fraud reports made without malice.
• Special Investigation Units (SIUs) that many insurers must maintain to flag suspicious claims.

Producers also face federal duties: anti-money-laundering (AML) programs for covered products, and do-not-call and CAN-SPAM rules limiting unsolicited marketing contact.

How Privacy Statutes Fit Together

The three layers of information rules overlap, so match each by its trigger:

Exam trap: GLBA opt-out applies to sharing with nonaffiliated third parties; sharing among affiliates and routine servicing (paying a claim, reinsurance) is generally exempt. Do not confuse the affiliate exemption with FCRA's separate adverse-action rules.

Penalties, Restitution, and Producer Duties

Fraud and privacy violations carry layered consequences:

• Criminal - fines and imprisonment for hard or soft fraud, scaled to the dollar amount in most states.
• Civil - restitution to the insurer and policy rescission under the concealment/fraud condition.
• Administrative - license suspension or revocation and per-act fines from the insurance department.

Producers have an affirmative role: deliver and explain the fraud-warning statement, refuse to participate in or facilitate inflated claims, report suspected fraud to the carrier's SIU or the state bureau, and protect client NPI under the agency's information-security program. Knowing participation in a client's fraud is itself a crime and an automatic license-revocation event.

Worked Scenario: Soft Fraud and Penalties

A homeowner suffers a genuine $6,000 water-damage loss but lists $3,500 of jewelry that was never damaged, claiming $9,500 total. The padding is soft fraud. Because the application and claim form carried a fraud-warning statement, the insurer can deny the fraudulent portion, may rescind under the concealment/fraud condition, and refers the file to the state fraud bureau. The homeowner risks restitution and criminal exposure - and the small padding voids what would have been a valid claim.

Telemarketing, Recording, and Information Security

Consumer-protection rules reach how producers contact and store data on prospects:

• The federal Do-Not-Call (DNC) Registry and Telephone Consumer Protection Act (TCPA) restrict unsolicited calls and texts; an established business relationship is a limited exception.
• CAN-SPAM requires honest subject lines and a working opt-out on marketing email.
• The NAIC Insurance Data Security Model Law, adopted in many states, requires a written information-security program, risk assessments, and breach notification to the commissioner, typically within 72 hours of determining a cybersecurity event occurred.

These duties sit alongside GLBA and FCRA rather than replacing them; the exam expects you to recognize each by its trigger.

Replacement, Free-Look, and Disclosure Protections

Several consumer safeguards protect buyers at the point of sale:

• Free-look (right to examine) periods let a policyholder return a new policy within a set window (often 10 days) for a full refund.
• Replacement regulations require producers to give comparison disclosures so a consumer understands the cost of switching - directly aimed at preventing twisting and churning.
• Outline of coverage and buyer's guide delivery ensures the consumer receives standardized comparison information before or at delivery.

These rules convert the abstract duty of good faith into concrete, testable paperwork requirements that a producer must complete and document.