Arizona's Insurance Information and Privacy Protection Chapter, A.R.S. 20-2101 to 20-2122

A Privacy Chapter, Not a Data Security Act

The primary sources show no Arizona enactment of the NAIC's Insurance Data Security Model Law. The Arizona Revised Statutes Title 20 table of contents lists no chapter or article on insurance data security or cybersecurity events, and the NAIC's Summer 2026 state page for Model #668 shows Arizona with nothing in its Model Adoption column. It lists only Related Activity: the general breach statute, A.R.S. 18-551 to 18-552, and rules at Ariz. Admin. Code R20-6-2101 to R20-6-2104. Those rules could not be opened for this article, since the Secretary of State's site returned a 403 response, so nothing is said here about their content.

What Title 20 does contain is Chapter 11, "Insurance Information and Privacy Protection," sections 20-2101 through 20-2122. Section 20-2104 is its notice section, not a security rule. The NAIC's Fall 2021 state page for its Insurance Information and Privacy Protection Model Act, Model #670, lists these sections in the Model Adoption column with the date range 1981/2010. The chapter imposes no information security program, no incident response plan and no duty to notify the director of a cyber event. Breach notice in Arizona runs through the title 18 statute.

Who Chapter 11 Reaches

Section 20-2101 applies the chapter to insurance institutions, insurance producers and insurance support organizations, and the test depends on the line of insurance. For life, health or disability insurance it reaches those that collect, receive or maintain information in connection with insurance transactions pertaining to Arizona residents, or that engage in insurance transactions with resident applicants, individuals or policyholders. For property or casualty insurance it reaches transactions involving policies, contracts or certificates "delivered, issued for delivery or renewed in this state," so residency is not the measure.

An insurance support organization, under section 20-2102, is a person who regularly assembles or collects information about natural persons for the primary purpose of providing it to insurers and producers, including consumer reports and fraud-detection information. Insurance transactions are limited to those primarily for personal, family or household needs, so commercial coverage falls outside the definition. Personal information means individually identifiable information gathered in connection with an insurance transaction from which judgments can be made about character, habits, finances, occupation, credit, health or other personal characteristics, and it expressly includes name and address and medical record information. "Privileged information," a separate term, covers information collected for a claim or a civil or criminal proceeding.

The Notice Requirement in Section 20-2104

Section 20-2104 provides that an insurance institution or producer "shall provide a notice of information practices to applicants and policyholders in connection with insurance transactions." On a new application the notice is due no later than delivery of the policy, if information is collected only from the applicant or public records, or when information is first collected from another source. On renewal it is due at least annually, with an exception where the institution discloses only in accordance with section 20-2113 and its disclosure practices have not changed. The notice may be in writing or, if the person agrees, electronic.

Subsection C offers two forms of content. The notice may "contain the information required for compliance with the notice requirements established under section 503 of the Gramm-Leach-Bliley act," or it may state whether information may be collected from others, the types of information and sources, the disclosures that may be made without authorization, the access and correction rights, and that a report from an insurance support organization may be retained and disclosed by that organization. Subsection D permits an abbreviated notice, with the full notice available on request. Subsection G excuses notice to a policyholder on an inactive policy where there has been no contact for twelve consecutive months, apart from annual privacy notices, required materials and promotional materials.

Section 20-2103 bars pretext interviews except in claims investigations where there is a reasonable basis for suspecting fraud. Section 20-2106 regulates authorization forms: plain language, a date, specified purposes, and a length of validity no longer than thirty months for life, health or disability applications and one year for property or casualty.

Access, Correction and Adverse Underwriting Decisions

Under section 20-2108, an individual who submits a written request after proper identification is to receive, within thirty business days, the nature and substance of recorded personal information, the chance to see and copy it, the identity of persons to whom it was disclosed within the prior two years, and the procedure for seeking correction. Medical record information may be routed through a medical professional the individual designates. Section 20-2109 sets the same thirty-business-day period for a response to a correction request. On a refusal, the individual may file a concise statement, which then travels with the disputed information. If the individual asks, the institution reconsiders its underwriting decision in light of the correction or statement.

Section 20-2110 addresses adverse underwriting decisions, a defined term covering declinations, terminations and rating outcomes. The institution or producer gives the specific reason or advises the person how to obtain it, and a written request within ninety business days triggers a response within twenty-one business days. Subsections E and F are additions with no counterpart in Model #670. Subsection E requires an explanation of credit-based decisions, including up to four factors that primarily caused the adverse action. Subsection F prohibits use of six kinds of credit history in calculating a property or casualty insurance score, among them collection accounts identified with a medical industry code and a bankruptcy or lien satisfaction more than seven years old.

Section 20-2111 restricts inquiries about prior adverse decisions unless the reasons are also requested, and section 20-2112 bars basing a new decision on the fact of an earlier one.

Limits on Disclosure Under Section 20-2113

Section 20-2113 opens with a prohibition: an institution, producer or support organization "shall not disclose any personal or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure is" within one of seventeen listed paths. They include written authorization, disclosure to a service provider reasonably necessary for a business function with a limit on further disclosure, disclosure to detect fraud, to an insurance regulator, to law enforcement in specified circumstances, and in response to a valid order.

Marketing receives narrower paths. Paragraph 11 permits disclosure to a person whose only use is marketing if no medical record, privileged or character information is disclosed, the individual had an opportunity to object and did not, and the recipient agrees to the use limit. Paragraph 12 allows disclosure to an affiliate for audit or marketing of insurance or financial products, with no medical record information for marketing absent written consent. Section 20-2113.01 separately bars a consumer reporting agency from providing or selling lists built from information submitted with an insurance inquiry, including policy expiration dates.

Director Enforcement, Federal Links and Private Remedies

Section 20-2114 gives the director power to examine and investigate compliance, and section 20-2116 calls for findings and a cease and desist order after a hearing. Under section 20-2117, a hearing finding a knowing violation can bring a civil penalty of up to $500 per violation, capped at $10,000 in the aggregate; violating a cease and desist order can bring up to $10,000 per violation, up to $50,000 for violations frequent enough to be a general business practice, or license suspension or revocation. Those amounts match the bracketed figures in Model #670's penalty section.

Section 20-2118 supplies the private remedies. A person whose rights under sections 20-2108 through 20-2110 are violated may apply to the superior court for equitable relief. A disclosure in violation of section 20-2113 creates liability for damages, but "no individual is entitled to a monetary award which exceeds the actual damages sustained." The court may award costs and attorney fees to the prevailing party, and suit must be brought within two years of when the violation is or should have been discovered. Subsection E closes the set: "Except as specifically provided in this section, there is no remedy or recovery available to individuals, in law or in equity, for a violation of this chapter."

Two provisions connect the chapter to federal law and have no counterpart in Model #670. Section 20-2121 states that "[t]he department may enforce title V, subtitle A of the Gramm Leach Bliley act" and authorizes rules. Section 20-2122 deems an institution subject to and in compliance with 45 C.F.R. part 164, subparts A and E, to comply with the article, while keeping that institution subject to a listed set of sections, including those on adverse decisions, director powers and remedies. The NAIC model's criminal section on obtaining information under false pretenses has no equivalent in Chapter 11.

No enforcement record is reported here. The Department of Insurance and Financial Institutions website, difi.az.gov, returned a 403 response to an ordinary request, so its orders could not be reviewed, and no court decision applying Chapter 11 was reviewed for this article. The penalty provisions above describe what the chapter authorizes, not what the Department has done.

Frequently Asked Questions