House Bill No. 2157

ALFRED W. GROSS COMMISSIONER OF INSURANCE STATE CORPORATION COMMISSION BUREAU OF INSURANCE P.O. BOX 1157 RICHMOND, VIRGINIA 23218 TELEPHONE: (804) 371-9741 TDD/VOICE: (804) 371-9206 http://www.scc.virginia.gov May 14, 2001 Administrative Letter 2001-05 TO: All Insurers and Other Entities Regulated Under Title 38.2 of the Code of Virginia RE: House Bill No. 2157 Attached is a summary of House Bill No. 2157, which becomes effective July 1, 2001. Also attached is a compilation of questions and answers that companies and agents may have regarding this legislation. House Bill No. 2157 was enacted in response to the federal Gramm-Leach-Bliley Act. The first part of the bill amends Chapter 5 of Title 38.2 of the Virginia Insurance Code and pertains to depository institutions and other lending institutions selling or soliciting insurance. The second part of the bill amends Chapter 6 of Title 38.2 of the Virginia Insurance Code and pertains to privacy protection. This is a summary by Bureau staff and is not a legal review. Each licensed entity should review the new laws with its own attorneys. If you have any questions, please feel free to contact the Bureau at InnovativeSolutions_Strategies@scc.virginia.gov. Sincerely, Alfred W. Gross Commissioner of Insurance Attachments le 38.2 of the Virginia Insurance Code and pertains to privacy protection. This is a summary by Bureau staff and is not a legal review. Each licensed entity should review the new laws with its own attorneys. If you have any questions, please feel free to contact the Bureau at InnovativeSolutions_Strategies@scc.virginia.gov. Sincerely, Alfred W. Gross Commissioner of Insurance Attachments House Bill No. 2157 House Bill No. 2157 was adopted in recognition of the federal requirements imposed under GLBA (the Gramm-Leach-Bliley Financial Services Modernization Act, Public Law 106-102). Depository Institutions Selling or Soliciting Insurance Section 38.2-513 and subsection B of § 38.2-514 of the Code of Virginia have been replaced with a new section numbered § 38.2-513.1 in the Unfair Trade Practices Act (Title 38.2, Chapter 5). The new section sets forth the obligations of depository institutions that are selling or soliciting insurance. Depository institutions must: 1. be licensed as agents in accordance with Chapter 18 (Insurance Agents) of Title 38.2; 2. inform their customers that the customer’s choice of an insurance company will not affect the credit decision or credit terms in any way; 3. maintain separate books and records relating to their insurance transactions for three years; 4. keep their insurance sales activities (to the extent practicable) physically segregated from areas where retail deposits are routinely accepted; 5. keep the insurance transaction separate from the credit transaction (except for credit insurance and flood insurance); and 6 it terms in any way; 3. maintain separate books and records relating to their insurance transactions for three years; 4. keep their insurance sales activities (to the extent practicable) physically segregated from areas where retail deposits are routinely accepted; 5. keep the insurance transaction separate from the credit transaction (except for credit insurance and flood insurance); and 6. give their customers a notice stating that the insurance policy is not a deposit, is not FDIC insured, is not guaranteed by the depository institution, and involves investment risk, where appropriate. Depository institutions may not: 1. reject an insurance policy just because it is issued by a person not associated with the depository institution or its affiliate; 2. pay or receive commissions except in accordance with Chapter 18 (an exception is made for payment of compensation for the referral of a customer, with certain stipulations set forth in the Code); 3. make loans conditional on the purchase of insurance from the depository institution or its affiliate; 4. require a separate charge for the handling of insurance unless the charge would be required if the depository institution or its affiliate were the agent; 5. use advertisements that would lead a person to believe that the federal or state government is guaranteeing the insurance products sold by the depository institution or its affiliate; 6. include the expense of premiums (except for credit, flood, and title insurance premiums) in the credit transaction without the customer’s written consent; or 1 nstitution or its affiliate were the agent; 5. use advertisements that would lead a person to believe that the federal or state government is guaranteeing the insurance products sold by the depository institution or its affiliate; 6. include the expense of premiums (except for credit, flood, and title insurance premiums) in the credit transaction without the customer’s written consent; or 1 7. release insurance or health information about a customer without the customer’s written consent except as permitted in the law. With certain exceptions, these provisions also apply to any person who lends money or extends credit and who sells or solicits insurance. Privacy Protection Chapter 6 of Title 38.2 (Insurance Information and Privacy Protection Act) currently requires an information practices notice to be given when the policy is issued or delivered or at the time information is collected from a source other than from the applicant or from public records. This notice is also required to be given at least every two years if information is collected from a source other than from the policyholder or from public records. This will remain in the law, but the bill now contains an additional provision requiring an information practices notice to be given every year describing the types of financial information that may be disclosed to affiliates and nonaffiliated third parties. Financial information is personal information that is not medical record information or health care payment records. Insurers and agents will either be able to send a combined information practices notice or two separate notices information practices notice to be given every year describing the types of financial information that may be disclosed to affiliates and nonaffiliated third parties. Financial information is personal information that is not medical record information or health care payment records. Insurers and agents will either be able to send a combined information practices notice or two separate notices. If financial information is disclosed about an applicant to a nonaffiliated third party before the policy is issued, an information practices notice must be given to the applicant prior to the time the information is disclosed. However, this notice does not have to be given to the applicant if financial information is disclosed as permitted under one of the exceptions in § 38.2-613. For example, if financial information is given to a nonaffiliated third party to enable that party to perform an insurance function for the insurer, an information practices notice does not have to be given prior to the issuance of a policy. An example of this would be an insurer giving a social security number to a vendor to collect motor vehicle records (MVR) or giving a name and address to a vendor to conduct a property inspection. But if financial information is disclosed to a nonaffiliated third party for marketing purposes, an information practices notice must be given before the information is disclosed. This does not negate the requirement under § 38.2-604 that insurers or agents must give an information practices notice to an applicant if information is collected about that applicant from an outside source such as an MVR or a credit report. The information practices notice given for financial information must also inform the insured of his right to opt out or say “no” to the disclosure of his financial information to nonaffiliated third parties (unless information is disclosed pursuant to § 38.2-613) notice to an applicant if information is collected about that applicant from an outside source such as an MVR or a credit report. The information practices notice given for financial information must also inform the insured of his right to opt out or say “no” to the disclosure of his financial information to nonaffiliated third parties (unless information is disclosed pursuant to § 38.2-613). Under the new law, insurers and agents that do not wish to disclose information to affiliates or non-affiliated third parties may give a notice to consumers simply stating this fact, as long as the insurer or agent also explains what information it collects about the consumer and how the insurer or agent plans to keep that information confidential and secure and also explains that the insurer or agent makes other disclosures as permitted by law. 2 Current law allows insurers and agents to give an abbreviated information practices notice instead of the long version provided the insured is told he may get the long version if he wants it. This is still the case for medical record information. However, under the new law, an abbreviated or “short form” financial information practices notice may only be given to an applicant, not to a policyholder. This is different from the current law in that an abbreviated information practices notice in the past could be given to applicants and policyholders. Also, a new provision in the new law states that an agent does not have to give an information practices notice if the insurer gives it and if the agent does not disclose any personal information to someone other than the insurer or its affiliates. An exception is also made if the agent discloses information that is allowed to be disclosed under § 38.2-613 ven to applicants and policyholders. Also, a new provision in the new law states that an agent does not have to give an information practices notice if the insurer gives it and if the agent does not disclose any personal information to someone other than the insurer or its affiliates. An exception is also made if the agent discloses information that is allowed to be disclosed under § 38.2-613. However, if the agent collects information from an outside source, such as getting an MVR or a credit report, either the agent or the insurer will have to give the information practices notice at the time the information is collected. Under current law, insurers and agents may only share information with their affiliates for certain reasons (such as marketing an insurance product) without getting written authorization from the insured. Under the new law, however, financial information may be shared with affiliates for any reason (such as marketing the affiliate’s products) without getting the insured’s permission or without giving the insured the right to opt out of the disclosure. Under current law, insurers and agents may share financial information (not medical record or privileged claim information) with nonaffiliated third parties in connection with marketing products if an opt-out is given. The new law will be basically the same, except that financial information may be shared with nonaffiliated third parties without an opt- out if this is being done pursuant to a joint marketing agreement or if the third party is using the information to market the insurer’s own products. Current law pertaining to medical record information and privileged claim information will remain the same in that the individual’s authorization must be obtained before this type of information may be shared (with certain exceptions allowed in § 38.2-613). 3 eing done pursuant to a joint marketing agreement or if the third party is using the information to market the insurer’s own products. Current law pertaining to medical record information and privileged claim information will remain the same in that the individual’s authorization must be obtained before this type of information may be shared (with certain exceptions allowed in § 38.2-613). 3 Questions and Answers for House Bill No. 2157 1. Which terms do I need to know to understand this new law? Personal information and financial information. “Personal information” is defined in the law to mean individually identifiable information gathered in connection with an insurance transaction, such as your name, address, and social security number. Personal information also includes medical information, but it does not include privileged claim information or any information that is publicly available. “Financial information” is defined as personal information except it does not include medical record information or payment records for health care to an individual. Some examples of personal and financial information would be MVRs, credit reports, and Equifax reports. 2. Do the privacy protection laws apply to commercial policies? No, just personal lines policies. The existing privacy laws in Chapter 6 have always applied to personal lines, and we have not changed this. 3. Does the agent have to give any of the notices required under § 38.2-604 and § 38.2- 604.1 to an applicant? It depends on the information the agent is collecting and/or disclosing rts. 2. Do the privacy protection laws apply to commercial policies? No, just personal lines policies. The existing privacy laws in Chapter 6 have always applied to personal lines, and we have not changed this. 3. Does the agent have to give any of the notices required under § 38.2-604 and § 38.2- 604.1 to an applicant? It depends on the information the agent is collecting and/or disclosing. If the agent collects personal information from a source other than public records or the applicant, such as an MVR or a credit report, then the notice that has always been required under § 38.2-604 must be given. If financial information is disclosed to anyone other than the insurer or its affiliates except as permitted by the exceptions in § 38.2-613, then the notice required by § 38.2-604.1 must be given. If the agent is not disclosing information to anyone other than the insurer or its affiliates, then the agent does not have to give an information practices notice as long as the insurer gives it. In this case, the insurer must give this notice on the application if information is being collected from an outside source at the time of application. If, however, information is not being collected from an outside source at the time of application, the insurer has to give the notice at the time the information is collected unless the notice was on the application. Finally, if no information is collected from an outside source, the insurer must give the notice when the policy is issued. 1 from an outside source at the time of application. If, however, information is not being collected from an outside source at the time of application, the insurer has to give the notice at the time the information is collected unless the notice was on the application. Finally, if no information is collected from an outside source, the insurer must give the notice when the policy is issued. 1 4. Are the information practices notices under § 38.2-604 and § 38.2-604.1 required to be given to a policyholder even if the notice has already been given to the applicant? If so, when? If the insurer or agent has given the notice required by § 38.2-604 at the time of application, the insurer would not have to provide another notice for 24 months. However, the notice required by § 38.2-604.1 pertaining to financial information must be given no later than the issuance of the policy even if the notice has already been given to the applicant. It must also be given annually. 5. If the insurer is not planning on disclosing any information to affiliates or nonaffiliated third parties except as permitted by § 38.2-613, does a financial information practices notice have to be given at all? The only notice that has to be given in this case is one which (i) states that the insurer does not plan to disclose information to affiliates or nonaffiliated third parties; (ii) tells what information is being collected and how that information is going to be kept secure and confidential; and (iii) explains that the insurer makes other disclosures as permitted by law. This provision is found in § 38.2-604.1 that has to be given in this case is one which (i) states that the insurer does not plan to disclose information to affiliates or nonaffiliated third parties; (ii) tells what information is being collected and how that information is going to be kept secure and confidential; and (iii) explains that the insurer makes other disclosures as permitted by law. This provision is found in § 38.2-604.1. The insurer must still give the notice required by § 38.2-604 every 24 months unless the insurer has combined the notices required to be given under both § 38.2-604 and § 38.2- 604.1 in which case, the one combined notice must be given annually. 6. What if the agent only gives a quote to someone over the phone…does the agent have to give that person an information practices notice? No. An information practices notice does not have to be given in this case since that person has not yet become an applicant. 7. Does an insured have a choice of opting out before financial information is shared with affiliates? No, financial information may be shared with affiliates without providing the insured with an opportunity to opt out. This is consistent with GLBA and the NAIC model. However, if financial information is shared with nonaffiliated third parties and this sharing is not one of the exceptions allowed in § 38.2-613, then an insured must be given an opportunity to opt out of this type of disclosure. 8. The law says that an insured does not have to be given an opportunity to opt out when financial information is shared with a nonaffiliated third party pursuant to a joint marketing agreement or when financial information is disclosed for the purpose of marketing the insurer’s own products. What is a joint marketing agreement? 2 iven an opportunity to opt out of this type of disclosure. 8. The law says that an insured does not have to be given an opportunity to opt out when financial information is shared with a nonaffiliated third party pursuant to a joint marketing agreement or when financial information is disclosed for the purpose of marketing the insurer’s own products. What is a joint marketing agreement? 2 A joint marketing agreement is defined in the law as a formal written contract between an insurer and another financial institution which allows the insurer to endorse or sponsor a financial product. 9. How much time does the applicant or policyholder have to direct that he does not want his financial information disclosed to a nonaffiliated third party? He has 30 days to opt out of this disclosure. 10. How long does the opt out remain in effect? It remains in effect until revoked by the individual. 11. Does an explanation of the right to opt out have to be given when the information practices notice is given? Yes, the explanation of the right to opt out must be given when the financial information practices notice is given. 12. May an insurer take any adverse action against an insured if the insured chooses to opt out (in other words, if the insured refuses to allow the insurer to disclose his financial information to a nonaffiliated third party)? No, it is a violation of Chapter 6 if the insurer unfairly discriminates against an insured for opting out. This would include non-renewing the policy or charging higher rates for the policy just because the insured chooses to opt out. 13 ured chooses to opt out (in other words, if the insured refuses to allow the insurer to disclose his financial information to a nonaffiliated third party)? No, it is a violation of Chapter 6 if the insurer unfairly discriminates against an insured for opting out. This would include non-renewing the policy or charging higher rates for the policy just because the insured chooses to opt out. 13. Do group certificate holders have to be given the financial information practices notice and the opt out notice? No, as long as the group insurance contract holder is given the notice, and no financial information is disclosed about the certificate holder to nonaffiliated third parties (other than as permitted under § 38.2-613). If information is disclosed on individual certificate holders, the notice and opt out must be given. 14. Does an insurer have to give the opt out notice required by § 38.2-612.1 if the insurer discloses financial information to a nonaffiliated third party about one of its third-party claimants or one of its life beneficiaries? Yes, if the insurer wishes to disclose financial information about one of its third-party claimants or one of its life beneficiaries outside of the exceptions in § 38.2-613, it must give that person an opportunity to opt out. 15. We have mentioned that insurers may share information without an opt out and without written authorization in certain situations permitted by law. What are some of these exceptions mentioned in § 38.2-613? 3 ial information about one of its third-party claimants or one of its life beneficiaries outside of the exceptions in § 38.2-613, it must give that person an opportunity to opt out. 15. We have mentioned that insurers may share information without an opt out and without written authorization in certain situations permitted by law. What are some of these exceptions mentioned in § 38.2-613? 3 Insurers may share medical record, financial or privileged claim information with insurance support organizations, such as Equifax and ChoicePoint, to process claims, underwrite, investigate fraud, or to comply with a legal order. 16. May medical record information be shared with affiliates? Not without the written authorization of the insured, except as permitted under the exceptions in § 38.2-613. 17. What are the responsibilities of the parties involved if financial information is given to a nonaffiliated third party? In addition to providing the notice required by § 38.2-604.1, there has to be a contract whereby the person receiving the information agrees to keep the information confidential and not to use it except as agreed upon in the contract (such as for marketing). 18. What are an insurer’s responsibilities if it receives financial information from one of its affiliates? It may only disclose that information to the extent permitted to be disclosed by the affiliate. 19. When may the insurer send an abbreviated or short form information practices notice as opposed to sending the long form? If the insurer wants to use a short form or abbreviated notice to explain the insurer's information practices applicable to financial information, it may only be given to applicants, not to policyholders mation to the extent permitted to be disclosed by the affiliate. 19. When may the insurer send an abbreviated or short form information practices notice as opposed to sending the long form? If the insurer wants to use a short form or abbreviated notice to explain the insurer's information practices applicable to financial information, it may only be given to applicants, not to policyholders. If an abbreviated notice is being given to explain the company’s insurance information practices applicable to any other personal information such as medical record information, it may be given to policyholders as well as to applicants. Some companies may find it easier to comply with the law by giving the abbreviated notice only to applicants and not to policyholders. 20. May agents give a short form or abbreviated notice to the applicant? Yes 21. What does the short form or abbreviated notice need to say? Since there are now two information practices notice provisions, a company may give an abbreviated notice under § 38.2-604 and a short form notice under § 38.2-604.1. 4 Or, if the company wants to combine the requirements into one abbreviated form, this one notice may only go to the applicant and will have to tell the applicant that the long form is available upon request and explain how the applicant may obtain the long form. It will also have to be given with the opt out notice required by § 38.2- 612.1 Or, if the company wants to combine the requirements into one abbreviated form, this one notice may only go to the applicant and will have to tell the applicant that the long form is available upon request and explain how the applicant may obtain the long form. It will also have to be given with the opt out notice required by § 38.2- 612.1. It will have to inform the applicant that personal information may be collected and that such information may be disclosed in certain circumstances to nonaffiliated third parties without authorization, and that the right of access and correction exists with respect to all personal information collected. 22. If an insurer elects to combine the long form notices required by § 38.2-604 and § 38.2-604.1, may one notice be sent to policyholders? Yes, however, to do this, the insurer will have to make sure that the one combined notice meets all of the requirements contained in § 38.2-604 and § 38.2-604.1. This also means that the one combined notice will have to be mailed every year. 23. Are the privacy protection laws applicable to surplus lines? Yes, surplus lines brokers have always had to comply with the provisions of Chapter 6 of Title 38.2. Our regulatory authority extends to surplus lines brokers rather than surplus lines carriers. 24. How is the Virginia law different from the NAIC model and GLBA? Conceptually, the changes to Virginia law have been made to be as consistent as possible with both the latest NAIC model regulation and GLBA. The format is different from GLBA and the latest NAIC model in that we kept the same format as the old NAIC model law. And we did not use the terms “consumer” and “customer” which are used in the NAIC model and GLBA. Instead, we kept the current terms “applicant” and “policyholder.” 25 nia law have been made to be as consistent as possible with both the latest NAIC model regulation and GLBA. The format is different from GLBA and the latest NAIC model in that we kept the same format as the old NAIC model law. And we did not use the terms “consumer” and “customer” which are used in the NAIC model and GLBA. Instead, we kept the current terms “applicant” and “policyholder.” 25. Regarding the provisions in § 38.2-513.1, may a bank pay or receive a referral fee? Yes, if the compensation is not based on the purchase of insurance by the customer, is a one-time nominal fee of a fixed dollar amount for each referral, and the referral does not include a discussion of specific insurance policy terms and conditions. 26. Is this a new provision in the law? Yes, and it is consistent with the Bureau’s long standing position concerning referral fees. 27. May the disclosures required in § 38.2-513.1 be given electronically? 5 Yes, if the customer agrees. 28. May the Bureau investigate a bank selling insurance? Yes, a bank selling insurance would be a licensed agent, and the Bureau has authority to investigate the affairs of any person to whom § 38.2-513.1 applies. 6