Consumer Information and Privacy

Which Privacy and Reporting Laws Apply?

• The Fair Credit Reporting Act (FCRA) governs consumer reports and provides rights when an adverse action relies on a report.
  • A consumer report is information supplied by a consumer reporting agency for an eligibility decision, such as insurance underwriting. It can include medical, driving, or other information as well as credit history.
  • An adverse action is an unfavorable insurance decision, such as denial, cancellation, a higher charge, reduced coverage, or another unfavorable change in terms.
• The Gramm-Leach-Bliley Act (GLBA) addresses privacy notices and safeguards for certain financial information.
• The Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule protects health information within its covered organizations and service relationships. It does not apply to every business that holds medical information.

What Should a Producer Do When Information Is Requested?

An underwriter requests a consumer report and medical records. The producer explains the request, gives required notices, obtains authorization where required, and directs the applicant to the report process if information is disputed.

How Should Sensitive Information Be Handled?

• Use only approved channels for collecting and transmitting sensitive data, limit access to people with a business need, and follow the company's instructions for handling records and reporting suspected exposure.
• When the approved records-request process requires identity verification, complete its checks; a request email's display name alone does not establish identity.
• An encrypted file still needs an authorized recipient and purpose. Permission to underwrite an application does not automatically permit an unrelated marketing use.
• Report a suspected exposure promptly to the designated contact under the company's process and follow the instructions provided.
• Do not promise that an applicant’s information will never affect underwriting or be shared as permitted by law.

Exam Tip: Gotchas

• A producer should not promise that a report cannot affect underwriting or share sensitive information through an unsecured channel.

Information sources and privacy rules

What Rights and Processes Apply to Reports and Medical Records?

• Medical Information Bureau (MIB) information, medical records, and general consumer reports are not identical sources.
• Information supplied through MIB can itself be a consumer report. Medical content does not place a report outside consumer-reporting rules; identify the source and permitted use before choosing the required notices and permissions.
• An insurer may request information relevant to underwriting, but the producer should explain the request, obtain required authorization, and provide applicable notices.
• A permissible underwriting purpose can support a general consumer report. A report describing diagnoses or treatment requires affirmative permission from the consumer whose medical information is reported before the reporting agency furnishes it for insurance. Separate exceptions cover properly treated medical contact information and medical-debt-only information meeting the federal restrictions on identifying the provider or care. Other applicable rules and insurer procedures still apply.
• If the consumer disputes report data, follow the report provider’s formal process rather than trying to amend it informally.
• An acknowledgment that a dispute was received does not prove the record was corrected. Check the agency’s revised report or investigation result for the actual change. A handwritten edit to a local copy and a changed insurance offer do not establish that the source record changed.
• After the reporting source corrects an error, verify that the updated authorized information reaches the insurer for review. A correction does not guarantee approval.
• Distinguish a dispute about the report’s facts from a request to reconsider the insurer’s decision. The reporting agency supplies information; the insurer makes the underwriting decision.
• For a HIPAA-covered provider’s chart, use the provider’s amendment process. For a consumer report, use the reporting agency’s dispute process. Correcting one holder’s records does not prove that another holder’s copy was updated.
• When an adverse insurance action is based wholly or partly on information in a consumer report, the insurer must provide an adverse-action notice. The notice names the reporting agency and gives its address and telephone number, including a toll-free number when the agency maintains nationwide files.
• The notice states that the reporting agency did not make the insurer's decision and cannot give its specific reasons. The consumer may dispute the report's accuracy or completeness and request a free copy from the agency within 60 days after receiving the adverse-action notice.
• The Fair Credit Reporting Act (FCRA) governs consumer reporting and provides rights when a consumer report is used, including notices in certain adverse-action situations.

When Are Financial Privacy and Opt-Out Notices Required?

• Gramm-Leach-Bliley privacy and safeguards apply to covered financial information and institutions. Private income, account, and other application information can remain protected even if the applicant provided it voluntarily.
• A covered financial institution generally provides an initial privacy notice by the time it establishes a customer relationship. If that would substantially delay the transaction, it may provide the notice within a reasonable time afterward, but only if the customer agrees. Signing an application or acknowledging that notice is not a blanket waiver of privacy protections.
• The initial notice does not by itself satisfy every duty before sharing information with a nonaffiliate, a company outside the institution's corporate group. When no exception applies, the opt-out explanation may be part of the privacy notice, but the consumer must receive it and have a reasonable opportunity to opt out before disclosure.
• Check the proposed disclosure's purpose, recipient, applicable exception, sharing choices, and required permission.
• Under the general federal financial-privacy rule, sharing nonpublic information with an unrelated third party outside an exception requires appropriate notices and a reasonable chance to opt out. The business must respect an opt-out. Exceptions and stricter state requirements need separate review; this is not permission for every marketing disclosure.

How Does HIPAA Apply to Information Requests?

Covered entities are the organizations to which the HIPAA rules apply. Their categories include:

Federal definitions and exceptions determine whether an organization qualifies. A covered health plan and a life insurer do not automatically have the same HIPAA role.

• A business associate performs certain services for a covered entity using protected health information. For example, an outside claims administrator handling a health plan’s patient records can have that role. Merely receiving medical answers for a life application does not create that relationship.
• A life insurer’s possession of medical information does not by itself make it a HIPAA covered entity. The medical provider disclosing that information may still have HIPAA duties; other privacy rules may protect the insurer’s records.
• Check an authorization’s information, recipient, purpose, and expiration. Permission to disclose records applies to the stated information and use.
• Records disclosure and consent to medical care are separate. HIPAA governs uses and disclosures of health information. Consent requirements for a new test or treatment come from applicable law and the provider’s process. Apply the test-consent requirements stated in an exam question; do not assume that a records release permits a new procedure.
• Permission allows the specified information gathering; it does not guarantee coverage. The insurer still reviews the application under that product's eligibility and underwriting rules.
• Which rule governs depends on the record, party, and activity.

Exam Tip: Gotchas

• HIPAA, GLBA, and the FCRA have different subjects and scopes.

What Should You Check on Exam Day?

• Can you distinguish MIB data from a medical record and a consumer report?
• Which law governs consumer-report rights?
• Who is subject to HIPAA’s privacy rule?
• When are an initial privacy notice and an opt-out opportunity required?
• When does partial reliance on a consumer report require an adverse-action notice?