AZ Regulatory Bulletin 2001-11: Information Privacy Rules

STATE OF ARIZONA DEPARTMENT OF INSURANCE JANE DEE HULL 2910 NORTH 44th STREET, SUITE 210 CHARLES R. COHEN Governor PHOENIX, ARIZONA 85018-7256 Director of Insurance 602/912-8456 (phone) 602/912-8452 (fax) Regulatory Bulletin 2001-11 TO: Insurance Institutions, Producers, Insurance Support Organizations, Insurance Trade Associations and Other Interested Parties FROM: Charles R. Cohen Director of Insurance DATE: August 31, 2001 RE: Information Privacy Issues This bulletin is issued to: ! Remind insurance institutions, insurance producers, and insurance support organizations (collectively referred to as “insurance entities”) of their long-standing obligations under Arizona’s Information and Privacy Protection Act (A.R.S. Title 20, Chapter 11) (“the Privacy Act” or “the Act”); ! Discuss how SB 1288 (Laws 2001, Ch. 220) amended the Privacy Act; and ! Address questions that have arisen regarding the Department’s interpretation and enforcement of the Privacy Act, particularly in light of requirements mandated by the federal Gramm Leach Bliley Act (GLB). This bulletin does not address certain obligations imposed by the Privacy Act that lack GLB counterparts. Interested parties are advised to carefully review the Privacy Act to determine their obligations under these other sections.1 1 A.R.S. § 20-2107; Investigative consumer reports. (An individual has a right to be interviewed in connection with any consumer report commissioned about that individual.) A.R.S. § 20-2108; Access to recorded personal information; definition. (An individual has a right to review recorded personal information about the individual and to know the source of that information.) A.R.S 1 A.R.S. § 20-2107; Investigative consumer reports. (An individual has a right to be interviewed in connection with any consumer report commissioned about that individual.) A.R.S. § 20-2108; Access to recorded personal information; definition. (An individual has a right to review recorded personal information about the individual and to know the source of that information.) A.R.S. § 20-2109; Correction, amendment or deletion of recorded personal information; definition (An individual has a right to request correction of recorded personal information the individual believes is inaccurate, or to have a supplemental statement included with the recorded information if the insurance entity will not correct it.) A.R.S. § 20-2110; Reasons for adverse underwriting decision (An individual subject to an adverse underwriting decision (a broadly defined term) has a right to know the reason for the decision, the information supporting the decision, and the source of that information.) A.R.S. §§ 20-2111 and 20-2112; Adverse underwriting decisions. (Limits an insurer’s ability to rely on previous adverse underwriting decisions.) Regulatory Bulletin 2001-11 August 31, 2001 Page 2 Background Although passage of GLB has ignited interest in the issue of information privacy, it is important to remember that Arizona has had statutes protecting the privacy of insurance consumers’ personal and privileged information since the early 1980s. The enactment of GLB necessitated few changes in Arizona’s laws because Arizona’s Privacy Act already meets or exceeds most of the federal minimum standards. To satisfy the requirements of GLB, many states with no existing privacy laws chose to enact some form of a new model regulation adopted by the National Association of Insurance Commissioners (new NAIC model privacy regulations). Arizona’s law differs from the new NAIC model few changes in Arizona’s laws because Arizona’s Privacy Act already meets or exceeds most of the federal minimum standards. To satisfy the requirements of GLB, many states with no existing privacy laws chose to enact some form of a new model regulation adopted by the National Association of Insurance Commissioners (new NAIC model privacy regulations). Arizona’s law differs from the new NAIC model. Arizona insurance entities should be cautious about relying on general compliance advice because much of that general advice may be based on an analysis of requirements established by GLB or the new NAIC model, rather than Arizona-specific requirements. Arizona Information Privacy Act Scope The Act applies to life, health, disability, property, and casualty insurance. The Act’s protections generally extend to information gathered in an “insurance transaction,” a term defined to mean insurance purchased “primarily for personal, family or household needs rather than business or professional needs.” Historically, the Department has not applied the Act to commercial insurance or workers’ compensation insurance and does not intend to change its interpretation at this time. This interpretation appears consistent with GLB. GLB’s protections extend to “consumers,” a term defined to mean “an individual who obtains…financial products or services which are to be used primarily for personal, family, or household purposes.” Persons transacting insurance in other states should note, however, that some states are extending the privacy requirements to the area of workers’ compensation. Arizona’s statutory standard is that the insurance be purchased primarily (not solely) for personal, family, or household use. In determining whether a particular insurance transaction is subject to the requirements of the Privacy Act, a party should consider all pertinent circumstances, including the underlying purpose of the insurance, what needs the insured is addressing with the insurance, and how premium is allotted ard is that the insurance be purchased primarily (not solely) for personal, family, or household use. In determining whether a particular insurance transaction is subject to the requirements of the Privacy Act, a party should consider all pertinent circumstances, including the underlying purpose of the insurance, what needs the insured is addressing with the insurance, and how premium is allotted. For example, a business owner may purchase a commercial auto policy for a commercial vehicle, but also choose to insure personal vehicles under the policy. The business owner is entitled to the protections of the Privacy Act because the business owner has purchased insurance for personal use. Three business partners may purchase coverage for a jointly owned airplane that is used for pleasure flying. The partners are entitled to the protections of the Act. An individual may purchase professional liability coverage. This is not an insurance transaction subject to the act because the insurance was purchased for a business or commercial purpose. Regulatory Bulletin 2001-11 August 31, 2001 Page 3 Who Does the Act Protect? In most cases, the benefits of the Privacy Act extend to applicants for insurance and policyholders. Some sections of the Act, however, protect a broader class of individuals. For example, A.R.S. § 20-2104 proscribes who is entitled to receive a privacy notice, and refers to “applicants” and “policyholders.” However, A.R.S. § 20- 2113 prohibiting release of personal information, applies to “individuals” and thus encompasses information gathered about a claimant as well as a policyholder or applicant. This section also protects an employee of a group who has supplied personal health information for the purpose of a group health insurance application, even though the particular employee was not seeking coverage under the group policy. Insurance entities should look at the precise terms used in each specific section of the Act to determine who has rights under a particular section or applicant. This section also protects an employee of a group who has supplied personal health information for the purpose of a group health insurance application, even though the particular employee was not seeking coverage under the group policy. Insurance entities should look at the precise terms used in each specific section of the Act to determine who has rights under a particular section. GLB’s protections generally extend to “consumers” and “customers,” which are terms and concepts derived from the banking industry rather than the insurance industry. Under GLB, rights vary depending on whether the financial institution has established a “customer relationship” with the consumer. Who Is Subject to the Act? The Act applies to “insurance institutions” “agents and brokers” (referred to as “producers” as of October 1, 2001), managing general agents, and insurance support organizations. “Insurance institution” generally includes all types of insurers, including HMOs. Several entities have contacted the Department to inquire as to whether a particular entity is an insurance support organization. That term is defined in the statute (A.R.S. § 20-2102(12)). An interested party should consult the statute and apply it to the party’s conduct and business operations to determine if the definition applies.2 What information is subject to the Act and must be protected? The Act generally protects both personal and privileged information. Personal information is defined in the broadest terms, as follows: [A]ny individually identifiable information gathered in connection with an insurance transaction and from which judgments can be made about an individual’s character, habits, avocations, finances, occupation, general reputation, credit, health or any other personal characteristics. Personal information includes an individual’s name and address and medical record information but does not include privileged information entifiable information gathered in connection with an insurance transaction and from which judgments can be made about an individual’s character, habits, avocations, finances, occupation, general reputation, credit, health or any other personal characteristics. Personal information includes an individual’s name and address and medical record information but does not include privileged information. 2 Drafting notes to the 1982 NAIC Insurance Information and Privacy Protection Model Act, upon which Arizona’s Privacy Act is based, indicate that the term was used to describe two different types of entities. First, there are nonprofit entities that exist “solely as a repository of information for the insurance industry.” Insurers file information with these entities and retrieve it as needed; the notes referred to the Medical Information Bureau (MIB) as an example. Second, there are entities such as consumer credit reporting agencies, that gather information from multiple sources and serve numerous industries, including insurance. Regulatory Bulletin 2001-11 August 31, 2001 Page 4 Privileged information means: [A]ny individually identifiable information that relates to a claim for insurance benefits or a civil or criminal proceeding involving an individual and is collected in connection with or in reasonable anticipation of a claim for insurance benefits or a civil or criminal proceeding involving an individual, except that information otherwise meeting the requirements of this paragraph is considered personal information …if it is disclosed in violation of section 20-2113. GLB protects “nonpublic personal information” which is generally defined as “personally identifiable financial information” that is not otherwise publicly available. The new NAIC model regulation covers both financial information and medical information; however, not all states have adopted the NAIC provisions covering medical information when enacting insurance privacy laws n of section 20-2113. GLB protects “nonpublic personal information” which is generally defined as “personally identifiable financial information” that is not otherwise publicly available. The new NAIC model regulation covers both financial information and medical information; however, not all states have adopted the NAIC provisions covering medical information when enacting insurance privacy laws. Thus, Arizona’s law generally protects more information, including medical information3, than is protected under GLB or the laws of many other states. What conduct is required under Arizona’s Privacy Act? 1. Issuance of a Privacy Notice A.R.S. § 20-2104 generally requires insurers and producers to give applicants and policyholders a notice describing the insurer or producer’s information practices. The timing and content of the notice will vary depending on the nature and status of the insurance transaction, and whether the individual is an applicant for insurance or a policyholder. Who is entitled to notice? An insurer or producer must provide the notice to applicants and policyholders. Arizona law allows a short form notice to an applicant. A.R.S. § 20-2104(D). The short form notice may be given orally. All policyholders must receive the full written notice prescribed by A.R.S. § 20-2104(C). For group insurance, an insurer or producer is not required to give notice to the individual insured if the insurer gives notice to the plan sponsor or group policyholder and does not disclose personal information about the individual insured except as allowed under A.R.S. § 20-2113. See A.R.S. § 20-2104(F). When must notice be given? A.R.S. § 20-2104(B) requires an initial notice when the insurer or producer delivers the policy or certificate, or first collects information about the applicant from a source other than the applicant, whichever occurs first. An annual notice must be provided during the continuation of the relationship with the policyholder er A.R.S. § 20-2113. See A.R.S. § 20-2104(F). When must notice be given? A.R.S. § 20-2104(B) requires an initial notice when the insurer or producer delivers the policy or certificate, or first collects information about the applicant from a source other than the applicant, whichever occurs first. An annual notice must be provided during the continuation of the relationship with the policyholder. Notice is also required when a 3 A.R.S. § 20-2102(17) defines “medical record information” as “personal information which relates to an individual’s physical or mental condition, medical history or medical treatment and is obtained from a medical professional or medical care institution, the individual or the individual’s spouse, parent or legal guardian.” Regulatory Bulletin 2001-11 August 31, 2001 Page 5 policy is reinstated, unless the policyholder has received a notice within the 12 months immediately preceding reinstatement. When is notice excused? An insurer or producer is not required to give notice to an insured whose policy has lapsed, expired, or become inactive. A policy is “inactive” when the insurer or producer has not communicated with the policyholder for at least 12 consecutive months, other than to provide an annual privacy notice, material required by law, or promotional materials. The Department thinks it is unlikely that a health, automobile, homeowners or personal umbrella policy would ever become “inactive” because such policies tend to renew at least annually. It is possible that a paid up life insurance policy could become inactive where there is no ongoing need for communication until a claim for benefits is made. Notice is also not required for a policyholder with an invalid address. An address is invalid if mail has been returned as undeliverable and the insurer or producer has subsequently tried, without success, to obtain a valid address. What form is required for the notice? The notice to policyholders must be in writing re there is no ongoing need for communication until a claim for benefits is made. Notice is also not required for a policyholder with an invalid address. An address is invalid if mail has been returned as undeliverable and the insurer or producer has subsequently tried, without success, to obtain a valid address. What form is required for the notice? The notice to policyholders must be in writing. The short form notice to an applicant may be oral. Often, first contact with a prospective insured occurs telephonically when an applicant is seeking a phone quote. To provide the quote, a producer may simultaneously reference outside data sources such as Department of Motor Vehicle records. When giving a phone quote, there may be no practical method for delivering a written notice. In this case, Arizona law permits the producer to give oral notification of information practices. A notice may be in electronic form if the policyholder agrees to receipt in this form. Should a question arise, the burden is on the insurer or producer to show that the policyholder agreed to notice in electronic form. A notice may also be faxed. What information must be in the notice? For “short form” notice to applicants under A.R.S. § 20-2104(D), the insurer or producer must advise the applicant (either orally or in writing) of the following before seeking data from any source other than the applicant: (1) That the producer will collect information about the potential insured from outside sources (meaning sources other than the applicant); (2) The collected information may be disclosed to third parties without authorization.4 § 20-2104(D), the insurer or producer must advise the applicant (either orally or in writing) of the following before seeking data from any source other than the applicant: (1) That the producer will collect information about the potential insured from outside sources (meaning sources other than the applicant); (2) The collected information may be disclosed to third parties without authorization.4 (3) The individual has the right to access his own personal information and to submit corrected information if the individual believes the information is inaccurate. 4 This statement about the possibility of disclosure does not alter the substantive prohibition on disclosure set forth in A.R.S. § 20-2113. Any disclosures must still comply with that section and occur either with authorization or pursuant to a listed exception. Regulatory Bulletin 2001-11 August 31, 2001 Page 6 (4) A complete written notice describing the insurer’s or producer’s information privacy practices is available upon request. If requested to do so, the producer or insurer must provide the caller with a copy of the full written notice described below, regardless of whether the caller becomes a policyholder. If the applicant becomes a policyholder, the insurer or producer must provide the full written notice described below. Except as described above for the “short form” notice, the notice under A.R.S. § 20- 2104(C) must be in writing and include the following information: (1) Whether the insurer or producer collects information about the insured from persons other than the insured; (2) The types of information that may be collected about the insured, the likely sources of that information, and the methods used to collect the information; (3) The types of disclosures allowed under A.R.S. § 20-2113 and the typical circumstances when the insurer or producer will release information without prior authorization; s information about the insured from persons other than the insured; (2) The types of information that may be collected about the insured, the likely sources of that information, and the methods used to collect the information; (3) The types of disclosures allowed under A.R.S. § 20-2113 and the typical circumstances when the insurer or producer will release information without prior authorization; (4) A description of the insured’s rights under A.R.S. § 20-2108 (the right to access one’s own information that has been collected and to receive information on how the insurer or producer has used that information) and 20-2109 (the right to correct or supplement information the insured believes is inaccurate), and how the insured can exercise those rights. As amended by SB 1288, the Privacy Act does permit an insurer or producer to use, in lieu of the Arizona specific notice, a notice that complies with the requirements established under GLB § 503. GLB § 503 requires disclosure of the following information: (1) the insurance entity’s policies and practices for disclosure of information about current or former applicants and policyholders to affiliated and non- affiliated third parties, including the types of persons to whom information is disclosed other than persons to whom disclosures are made pursuant to an exception under GLB § 502(e) (GLB § 502(e) is comparable to A.R.S. § 20- 2113); (2) the types of information collected; (3) the insurance entity’s policies for protecting confidentiality and security of personal information; to affiliated and non- affiliated third parties, including the types of persons to whom information is disclosed other than persons to whom disclosures are made pursuant to an exception under GLB § 502(e) (GLB § 502(e) is comparable to A.R.S. § 20- 2113); (2) the types of information collected; (3) the insurance entity’s policies for protecting confidentiality and security of personal information; (4) any disclosures required under the Fair Credit Reporting Act.5 Similar information is required for a privacy notice under A.R.S. § 20-2104(C) and a notice under GLB § 503, except that Arizona law expressly requires disclosure of statutory rights under A.R.S. §§ 20-2108 and 20-2109 that are peculiar to Arizona’s Privacy Act. If an insurance entity elects to use the GLB notice it has developed for use in other states as its notice under A.R.S. § 20-2104, the insurance entity must include an addendum that apprises applicants and policyholders of their rights under A.R.S. §§ 20-2108 and 20-2109. GLB requires disclosure of information practices. Those 5 For disclosures required under the Fair Credit Reporting Act, see 15 U.S.C. §§ 1681d and 1681h. Regulatory Bulletin 2001-11 August 31, 2001 Page 7 information practices may vary from state to state or from insurer to insurer. In Arizona, information practices include the rights and procedures set forth in A.R.S. §§ 20-2108 and 20-2109. Consequently, those practices must be disclosed in, or as an addendum to, the privacy notice used in Arizona. Who must give the notice? A.R.S. § 20-2104(E) permits one insurer or producer to satisfy the notice obligation for another insurer or producer that is authorized to act on its behalf. The statute does not explain what constitutes “authorization.” Any authorization should be memorialized in some form of written understanding between the insurer and the producer or between affiliated entities ona. Who must give the notice? A.R.S. § 20-2104(E) permits one insurer or producer to satisfy the notice obligation for another insurer or producer that is authorized to act on its behalf. The statute does not explain what constitutes “authorization.” Any authorization should be memorialized in some form of written understanding between the insurer and the producer or between affiliated entities. Producers have inquired about whether they are obligated to give notice if the insurer is giving notice, either when issuing the initial policy, or at renewal. If the insurer and producer have a clear written understanding that the insurer will provide notice on behalf of the producer, the producer need not send a duplicative notice. However, the producer should take steps to ensure that the insurer’s notice satisfies the producer’s obligations under the statute. There may also be situations (e.g. phone quotes) when there is no opportunity for an insurer to satisfy the obligation on behalf of a producer. In these situations, the producer must take steps to ensure that the producer’s obligations are met. Should questions arise, the producer has the burden of proving that the consumer received a notice that complies with the statute. 2. Maintaining confidentiality of information The Privacy Act also requires insurance entities to maintain confidentiality of an individual’s personal and privileged information, as specified below. Arizona’s Privacy Act is more restrictive than GLB regarding disclosure of an individual’s personal or privileged information, as follows: GLB Arizona Financial institution may freely share information with affiliates. Insurers and producers must not disclose an individual’s personal or privileged information to anyone without the individual’s authorization, or unless disclosure is allowed under an exception listed in A.R.S. § 20-2113. A.R.S LB regarding disclosure of an individual’s personal or privileged information, as follows: GLB Arizona Financial institution may freely share information with affiliates. Insurers and producers must not disclose an individual’s personal or privileged information to anyone without the individual’s authorization, or unless disclosure is allowed under an exception listed in A.R.S. § 20-2113. A.R.S. § 20-2113(12) does permit disclosure of information (other than medical record information) to an affiliate if the affiliate will use the information solely for the purpose of marketing insurance or financial products and agrees not to further disclose the information. Regulatory Bulletin 2001-11 August 31, 2001 Page 8 Financial institution may freely share information with nonaffiliated third parties that have a joint agreement with the financial institution to perform services on behalf of the institution. The agreement must require the third party to maintain confidentiality. Insurers and producers may not share information with anyone without the affirmative permission of the individual, or unless sharing is allowed under an exception listed in A.R.S. § 20-2113. A.R.S. § 20-2113(2)(a) does allow disclosure to a third party if disclosure is necessary to enable the third party to perform a function for the insurance entity, and the third party agrees not to disclose the information further. Note that the Department expects insurance entities to manifest the required agreement in writing, consistent with GLB’s requirements for “joint agreements.” Financial institution may not share information with non-affiliated third parties unless the financial institution gives the customer a chance to “opt out”. If the consumer does not affirmatively opt out (i.e. instruct “no sharing or disclosure”), the institution may disclose information o manifest the required agreement in writing, consistent with GLB’s requirements for “joint agreements.” Financial institution may not share information with non-affiliated third parties unless the financial institution gives the customer a chance to “opt out”. If the consumer does not affirmatively opt out (i.e. instruct “no sharing or disclosure”), the institution may disclose information. Insurers and producers may not share information with anyone without the affirmative permission of the individual, or unless sharing is allowed under an exception listed in A.R.S. § 20-2113. A.R.S. § 20-2113(11) allows disclosure of very limited information6 to a person who wishes to use the information for marketing a product or service if the insurer or producer gives the individual an opportunity to opt out and the individual does not opt out. The person receiving the information must agree to no further disclosure. Producers have expressed concern about their ability to share an applicant’s information with potential insurers, with whom the producer is seeking to place coverage. A.R.S. § 20-2113 (3) permits disclosure to an insurer or producer “if the information disclosed is limited to that which is reasonably necessary…for either the disclosing or receiving [insurance entity] to perform its function in connection with an insurance transaction involving the individual.” When an individual approaches a producer seeking coverage, it is necessary for the producer to provide the insurer with information about the applicant in order to obtain coverage for the insured d is limited to that which is reasonably necessary…for either the disclosing or receiving [insurance entity] to perform its function in connection with an insurance transaction involving the individual.” When an individual approaches a producer seeking coverage, it is necessary for the producer to provide the insurer with information about the applicant in order to obtain coverage for the insured. The privacy act should not be read to impede the free flow of information between an insurer and a 6 Under this exception, the insurance entity may not share: (1) medical record information, (2) privileged information, (3) personal information relating to an individual’s character, personal habits, mode of living or general reputation, or (4) any classification derived from the individual’s information. Regulatory Bulletin 2001-11 August 31, 2001 Page 9 producer, if that flow of information is required to carry out the insurance transaction that the insured has authorized. GLB recognizes a similar exception. Disclosure is allowed, “as necessary to effect, administer, or enforce a transaction requested or authorized by the [applicant or insured]…” GLB § 502(e). In determining whether sharing is permitted under this exception, the insurance entity must consider the nature and scope of the work the insured has authorized For example, if an insured is seeking health insurance at the best rate, the producer may send the insured’s personal information to insurers the producer believes would be interested in covering the particular risk. However, the producer may not, under this exception, provide the individual’s personal information to a med-pay insurer to generate a quote in the hope of being able to sell this related form of insurance, or to another producer who might wish to sell the individual life insurance insured’s personal information to insurers the producer believes would be interested in covering the particular risk. However, the producer may not, under this exception, provide the individual’s personal information to a med-pay insurer to generate a quote in the hope of being able to sell this related form of insurance, or to another producer who might wish to sell the individual life insurance. Because these latter transactions are outside the scope of the transaction authorized by the insured, the insurance entity must either find another applicable exception, or obtain the individual’s further authorization. Producers have inquired about their ability to share information at the time of policy renewal. A producer who wishes to “shop” an insured to different insurers at policy renewal should look at the authority previously conferred, and any authorization the insured has previously signed. Has the insured asked the producer to renew the policy or to shop the policy? Does the producer have a current form authorizing disclosure to the insurance companies to whom the producer will shop the policy? Unless the producer is sharing information to carry out the insured’s request, or has a current authorization, the producer may not share information for the purpose of shopping the policy. A producer can easily satisfy this burden by contacting the policyholder and confirming that the policyholder wants the producer to share information as needed to shop and renew the policy. Such communications permit the insured to remain knowledgeable about and in control of his or her information. It is possible that an insured may have chosen a particular insurer specifically because of the insurer’s more restrictive privacy policies, and may not want the producer to shop the policy or share information with different insurers. An insured’s circumstances or health status may change during the course of a year resulting in greater concern about privacy n control of his or her information. It is possible that an insured may have chosen a particular insurer specifically because of the insurer’s more restrictive privacy policies, and may not want the producer to shop the policy or share information with different insurers. An insured’s circumstances or health status may change during the course of a year resulting in greater concern about privacy. Producers have also inquired about the need for authorization when the producer is doing a “book roll” of business to another insurer. The producer should look at whatever authorization the insured has previously signed to determine if it permits such information-sharing with a different insurer, and if it is still current. Without a current authorization, such transactions will generally require the producer to obtain a new authorization from the insured because they do not occur at the request of the insured. Authorization for disclosure An authorization for disclosure must be in writing, or (with an individual’s consent) in electronic form. Any form that authorizes disclosure of personal or privileged information must satisfy the requirements of A.R.S. § 20-2106. The form must: Regulatory Bulletin 2001-11 August 31, 2001 Page 10 1. Be written in plain language; 2. Be dated; 3. Specify who may disclose information about the individual; 4. Specify the information that may be disclosed; 5. Identify the insurance entity seeking authorization for disclosure and the persons (identified by generic reference) at the insurer authorized to receive the information; 6. Explain the reason for collecting the information; 7. Specify the length of time for which the authorization is valid (note that allowable time periods vary depending on the purpose for which information is collected); and 8. Explain that the individual or an authorized representative may have a copy of the authorization. In addition to the statutory elements listed above, the form should: 1. Be conspicuous; 2 ason for collecting the information; 7. Specify the length of time for which the authorization is valid (note that allowable time periods vary depending on the purpose for which information is collected); and 8. Explain that the individual or an authorized representative may have a copy of the authorization. In addition to the statutory elements listed above, the form should: 1. Be conspicuous; 2. Identify the individual who is the subject of the information. 3. Include the dated signature of the individual; and 4. Include a statement advising the individual that the individual may revoke the authorization at any time upon written notice to the person holding the authorization, subject to the rights of anyone who acted in reliance on the authorization prior to notice of its revocation. Opting out under A.R.S. § 20-2113(11) Under A.R.S. § 20-2113(11), an insurer or producer may disclose very limited information about an individual (e.g. the individual’s name) to someone who wishes to use the information for marketing a product or service. Before disclosing the information pursuant to this exception, the insurer or producer must give the individual the opportunity to “opt out” of such disclosure. Arizona’s statutes do not specify the requirements for an “opt out” form. A form that satisfies the requirements under GLB or the new NAIC model regulation is presumed adequate. At a minimum, the form must: 1. Be clear and conspicuous; 2. Advise the individual that the individual may opt out of disclosure; and 3. Provide a reasonable means for the individual to opt out. Enforcement The Arizona Department of Insurance regularly cites insurance entities for violations of the Arizona’s Privacy Act. (See Circular letter 2000-4). The media attention generated by GLB has caused consumers to be more aware of and sensitive to their privacy rights. The heightened consumer awareness may result in more inquiries and complaints about the information privacy practices of insurance entities Arizona Department of Insurance regularly cites insurance entities for violations of the Arizona’s Privacy Act. (See Circular letter 2000-4). The media attention generated by GLB has caused consumers to be more aware of and sensitive to their privacy rights. The heightened consumer awareness may result in more inquiries and complaints about the information privacy practices of insurance entities. All insurance entities are cautioned to review their policies and procedures to ensure full compliance with Arizona’s Privacy Act, as amended by SB 1366. Please direct any questions about this regulatory bulletin to Vista Thompson Brown, Executive Assistant for Policy Affairs, 602-912-8456, vbrown@id.state.az.us.