Privacy for insurers: NAIC model law adoption, underwriting data and external consumer data sources, claims data handling and cyber coverage disputes.
Insurers face privacy scrutiny from an unusual angle, since the external data feeding underwriting models is regulated as much as the policyholder data itself. This hub covers both, plus coverage disputes over privacy claims.
The FTC alleged that General Motors enrolled drivers in OnStar Smart Driver through a bundled consent screen and then sold their driving events to Verisk and LexisNexis, which built consumer reports that insurers used. The order, proposed in January 2025 and issued as final in January 2026, runs 20 years and contains no payment.
Read more →An event data recorder keeps a few seconds of vehicle data around a crash. Federal law makes that data the property of the vehicle's owner or lessee and lists five situations in which someone else may access it, while NHTSA's Part 563 sets what an installed recorder must capture. Eight state statutes read for this post add their own consent rules, insurer limits and penalties.
Read more →Section 105 of GINA told HHS to treat genetic information as health information and to stop group health plans, health insurers and Medigap issuers from using it for underwriting. HHS's 2013 Omnibus Rule went further, applying the ban to every HIPAA health plan except long-term care insurers, and required plans that underwrite to say so in their privacy notices.
Read more →The NAIC adopted its Insurance Data Security Model Law in late 2017 as a template for state legislatures. It asks insurance licensees to run a written information security program, oversee vendors, investigate cybersecurity events and notify the insurance commissioner within 72 hours. This walks through the model's text and compares it with eight enacted state versions.
Read more →The Fair Credit Reporting Act does not have one adverse action notice. It has a notice owed before a decision that only employers owe, and a notice owed after any adverse action taken on a consumer report by anyone. The two sit in different sections, carry different contents, and answer to different silences in the statute.
Read more →HIPAA is three interlocking rules rather than one, and they apply to a defined set of organizations rather than to health information generally. This guide covers who is covered, what the Privacy Rule permits without authorization, what the Security Rule requires, how business associate liability works, and the mechanics of breach notification.
Read more →