Is an insurer, in California

Cal. Ins. Code sections 791 to 791.28 · Read the law's page

• Apply the article if you are an insurance institution, an agent licensed under Insurance Code chapters 5, 5A, 6, 7 or 8, or an insurance-support organization (a business that regularly assembles or collects information about people mainly to give it to insurers or agents, such as consumer reports or fraud-detection data) and you handle insurance bought primarily for personal, family or household needs. For life or disability insurance it reaches information about California residents; for property or casualty insurance it reaches policies delivered, issued for delivery or renewed in California. Title insurers and home protection companies that hold no personal information of their policyholders and applicants are outside the article, and a health care service plan regulated under the Knox-Keene Act is not an insurance institution.
• Do not use or authorize a pretext interview (pretending to be someone else or to represent someone you do not, misrepresenting the purpose of the interview, or refusing to identify yourself on request) to obtain information in connection with an insurance transaction. The one exception is a claim investigation with a reasonable basis for suspecting criminal activity, fraud, material misrepresentation or material nondisclosure, and only when the person or institution interviewed has no generally or statutorily recognized privileged relationship with the person the information concerns.
• Give each applicant and policyholder a written notice of information practices, or an abbreviated notice that says the full notice will be furnished on request. For a written application, give it at delivery of the policy when personal information is collected only from the applicant, an insured or public records, and otherwise when collection from another source begins. At renewal, reinstatement or a change in benefits, give it unless information is collected only from the policyholder, an insured or public records or a conforming notice went out in the previous 24 months. The notice states whether information may be collected from other persons, the types of information, sources and investigative techniques, the disclosures that may be made without authorization, the access and correction rights and how to use them, and that an insurance-support organization may retain and disclose information from its report.
• Clearly mark any question asked of an individual in connection with an insurance transaction that is designed to obtain information solely for marketing or research purposes.
• Use a disclosure authorization form, to obtain personal or privileged information about an individual, that is written in plain language, dated, names the insurance institution or agent, specifies the types of persons authorized to disclose, the nature of the information and the purposes for which it is collected, states how long the authorization stays valid (no longer than 30 months for a life, health or disability application, reinstatement or change request, or one year for property or casualty; for a claim, the term of coverage for a health insurance claim or the duration of the claim for other claims), and tells the individual they are entitled to a copy.
• Before preparing or requesting an investigative consumer report for an application, renewal, reinstatement or change in benefits, tell the individual that they may request an interview and may receive a copy of the report. Institute reasonable procedures to conduct a requested interview, and, if an insurance-support organization prepares the report, tell it whether the individual requested an interview.
• On a written request, after proper identification, for reasonably described and locatable recorded personal information, respond within 30 business days: describe its nature and substance, let the individual see and copy it or send a copy by mail, translate coded information into plain language, disclose to whom it was disclosed in the previous two years (or the types of recipients normally given it), identify any institutional source, and summarize how to request correction, amendment or deletion. Send medical record information from a medical professional or institution directly to the individual or to a medical professional the individual designates, and mental health record information directly to the individual only with the approval of the treating professional. A reasonable copying fee may be charged except for information provided under section 791.10.
• On a written request to correct, amend or delete recorded personal information, respond within 30 business days: either make the change, notify the individual in writing and furnish it to anyone the individual designates who received the information in the previous two years and to the insurance-support organizations the section names, or notify the individual of the refusal, the reasons and the right to file a concise statement of disagreement. File any statement with the disputed information, and include it in every later disclosure of that information.
• After an adverse underwriting decision, give the applicant, policyholder or individual proposed for coverage the specific reasons in writing, or tell them they may request the reasons in writing, together with a summary of their rights under section 791.10(b) and sections 791.08 and 791.09. For a declination, cancellation or nonrenewal of a property policy covered by Insurance Code section 675, an automobile policy covered by section 660 or an individual life, health or disability policy, give the specific reasons in writing at the time of the decision. On a written request within 90 business days of the notice, furnish within 21 business days the specific reasons, the specific items of personal and privileged information that support them, and the names and addresses of the institutional sources; privileged items need not be furnished where there is a reasonable suspicion, based on specific information available for review by the Commissioner, of criminal activity, fraud, material misrepresentation or material nondisclosure.
• Do not seek information about a previous adverse underwriting decision, or about previous coverage obtained through a residual market mechanism, unless the inquiry also requests the reasons.
• Do not base an adverse underwriting decision, in whole or in part, on the fact of a previous adverse underwriting decision or of earlier residual-market coverage, on personal information received from an insurance-support organization whose primary source of information is insurance institutions, on the fact that the individual inquired about the scope or nature of residential fire or property coverage without filing a claim when that fact comes from such an organization, or on a reported accident involving a peace officer, California Highway Patrol member or firefighter for which the insurer retains no liability. You may rely on further information obtained from the insurer responsible for an earlier decision, or as the result of an insurance-support organization's information.
• Do not disclose personal or privileged information about an individual collected or received in connection with an insurance transaction unless a ground listed in section 791.13 applies: for example the individual's dated, signed written authorization obtained one year or less before the disclosure is sought (or one that meets section 791.06 when another insurance institution, agent or insurance-support organization submits it), a disclosure reasonably necessary for a recipient to perform a business, professional or insurance function for you under an agreement not to disclose further, fraud detection or prevention, a disclosure to an insurance regulatory authority, or a disclosure to a law enforcement or other governmental authority pursuant to law.
• Disclose information to a person whose only use will be marketing a product or service only if no medical record information, privileged information, or information about character, personal habits, mode of living or general reputation, and no classification derived from it, is disclosed, or the individual has been given an opportunity to say they do not want personal information disclosed for marketing and has not said so, and the recipient agrees to use it only for marketing. Disclose to an affiliate only for an audit of the insurance institution or agent or for marketing an insurance product or service, and only if the affiliate agrees not to disclose the information for any other purpose or to unaffiliated persons.
• As a disability insurer providing hospital, medical or surgical coverage, do not release information to an employer that would directly or indirectly indicate that an employee is receiving or has received services from a covered health care provider unless the employee authorizes it.
• As an insurer under a personal lines residential property insurance policy that reports claims history or loss experience to an insurance-support organization, give the insured the additional claims-database disclosure that section 791.28 prescribes, at the time you provide the disclosure required by Insurance Code section 790.034(b)(1).

Cal. Fin. Code sections 4050 to 4060 · Read the law's page

• Check whether you are a financial institution: an institution whose business is engaging in the financial activities described in section 1843(k) of Title 12 of the United States Code and that does business in California. An institution that is not significantly engaged in financial activities is not one, and neither is an institution primarily engaged in providing hardware, software or interactive services unless it acts as a debt collector or engages in activities for which it must hold a charter, license or registration from a state or federal banking, insurance or securities agency. The definition lists further exclusions, among them providers of professional services barred by professional ethics from disclosing client confidences.
• Do not sell, share, transfer or otherwise disclose a consumer's nonpublic personal information (personally identifiable financial information, which includes information collected through an Internet cookie or an information collecting device from a Web server) to or with a nonaffiliated third party without the consumer's explicit prior consent, unless section 4053(b)(2), section 4054.6 or section 4056 permits the release. A consumer is an individual resident of California who obtains a financial product or service primarily for personal, family or household purposes.
• Obtain that consent on a separate document, not attached to any other, that is dated and signed by the consumer. It must clearly and conspicuously disclose that signing consents to disclosure to nonaffiliated third parties, that the consent stays in effect until revoked or modified, that the consumer may revoke it at any time and how, that you will keep the document or a true copy, that the consumer is entitled to a copy on request, and that the consumer may want to make a copy.
• Do not discriminate against or deny an otherwise qualified consumer a financial product or service because the consumer has not consented to disclosure to a nonaffiliated third party or has directed that information not be shared with an affiliate. You may decline to provide a product or service you could not provide without the disclosure, and may offer incentives or discounts to elicit a response.
• Before sharing nonpublic personal information with an affiliate, notify the consumer clearly and conspicuously and in writing, annually, using the form set out in section 4053(d) or one that meets its requirements, and honor the consumer's direction not to disclose within 45 days of receipt. A consumer may give the direction at any time, and where you have not given the annual notice you must allow 45 days after giving the form before disclosing. The affiliate opt-out does not regulate consumer report information as defined by the federal Fair Credit Reporting Act. No written notice is required if you disclose nothing to a nonaffiliated third party or an affiliate except as the division allows.
• Send the form with a self-addressed first class business reply return envelope if your assets exceed $25,000,000, or with a self-addressed return envelope if your assets are $25,000,000 or less; in place of the first class business reply envelope you may offer a self-addressed return envelope and at least two alternative cost-free means for consumers to communicate their choices, such as a toll-free number, a facsimile to a toll-free number or electronic means, and you must state those means in the form.
• Disclose to an affinity partner (a business that is not a financial institution with which you issue an affinity card or other financial product in its name) only the information section 4054.6 allows, and only if you have given the consumer the section 4053(d) notice and the consumer has not directed otherwise, a written agreement requires the partner to keep the information confidential and use it only to verify membership, verify contact information or offer its own products or services, the list does not reveal or permit extrapolation of other information, and any email sent to a listed address identifies the sender and gives a cost-free way to opt out of further messages. This does not apply to credit cards issued in the name of an entity primarily engaged in retail sales.
• Release information to an affiliate or nonaffiliated third party to perform services for you (such as printing, mailing, data processing or analysis, or customer surveys) only if the services could lawfully be performed by you, a written contract prohibits the recipient from disclosing or using the information other than to carry out the purpose of the disclosure, the information is limited to what the services need, and you receive no payment from or through the recipient.
• As a recipient of nonpublic personal information from a financial institution, do not disclose it to any other entity unless the disclosure would be lawful if the financial institution made it directly. If you received it under a section 4056 exception, use or disclose it only in the ordinary course of business to carry out the activity the exception covers.

Cal. Ins. Code section 791.29 · Read the law's page

• Do not require a protected individual (an adult insured, or a minor who can consent to care without a parent's or guardian's consent) to obtain the policyholder's authorization to receive sensitive services or to submit a claim for them, if that person has the right to consent to care. Recognize their right to exercise these rights exclusively as to medical information about sensitive services they received.
• Direct every communication about a protected individual's receipt of sensitive services directly to that individual: bills and collection attempts, notices of adverse benefit determinations, explanations of benefits, requests for more claim information, notices of a contested claim, the name and address of a provider with the description of services and other visit information, and any communication containing protected health information. Send them to the alternative mailing address, email address or telephone number the individual designated, or otherwise in the individual's name at the address or telephone number on file.
• Do not disclose medical information about sensitive health care services provided to a protected individual to the policyholder or any insured other than that individual without the individual's express written authorization.
• Permit an insured to request, and accommodate, confidential communication in the form and format requested if readily producible, or at alternative locations. You may require the request in writing or by electronic transmission. It covers all communications that disclose medical information or provider name and address about the requester's care until revoked or replaced. Implement it within 7 calendar days of an electronic transmission, telephone request or website request, or 14 calendar days of a first-class mail request, and acknowledge receipt and report on status if the insured contacts you.
• Notify insureds with individual or group coverage that they may request confidential communication and how, on initial enrollment and annually at renewal, in a conspicuously visible location in the evidence of coverage and on your website through a hyperlink on the home page.
• Do not condition coverage on the waiver of these rights.

Cal. Health and Safety Code Section 1367.01(k); Cal. Ins. Code Section 10123.135(j) (SB 1120, Ch. 879, Stats. 2024) · Read the law's page

• If you are a health care service plan (including a specialized plan) or a disability insurer (including a specialized health insurer) that uses an artificial intelligence, algorithm, or other software tool for utilization review or utilization management functions based in whole or in part on medical necessity, or that contracts with or otherwise works through an entity that does, ensure the tool bases its determination on the enrollee's or insured's medical or other clinical history, the individual clinical circumstances presented by the requesting provider, and other relevant clinical information in their record, and not solely on a group dataset
• Ensure the tool does not supplant health care provider decisionmaking, does not discriminate directly or indirectly against enrollees or insureds in violation of state or federal law, does not directly or indirectly cause them harm, and is fairly and equitably applied, including in accordance with applicable federal Department of Health and Human Services regulations and guidance
• Do not let the tool deny, delay, or modify health care services based, in whole or in part, on medical necessity; leave that determination to a licensed physician or a licensed health care professional competent to evaluate the specific clinical issues involved
• Keep the tool open to inspection for audit or compliance reviews, review and revise its performance, use, and outcomes periodically to maximize accuracy and reliability, and describe its use and oversight in your written utilization review policies and procedures
• Use patient data only for the tool's intended and stated purpose, consistent with the Confidentiality of Medical Information Act and the federal Health Insurance Portability and Accountability Act, as applicable
• Comply with applicable federal rules and guidance issued by the federal Department of Health and Human Services on the use of artificial intelligence, algorithm, or other software tools