Is an insurer, in Oregon

OAR 836-081-0101 to 836-081-0126 · Read the law's page

• Applies to a licensee as defined in ORS 746.600, which you declare by stating that you are an insurer; it does not include a purchasing group or an unauthorized insurer in regard to surplus lines business.
• Establish and implement an information security program, including appropriate policies and systems, to protect the security, confidentiality and integrity of customer information, which is personal information about a customer, in paper, electronic or other form, that is maintained by or on behalf of the licensee.
• Design the program to ensure the security and confidentiality of customer information, to protect against any anticipated threats or hazards to its security or integrity, and to protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer.

ORS 746.135 · Read the law's page

• If you ask an applicant for insurance to take a genetic test in connection with an application, reveal the use of the test to the applicant and obtain the applicant's specific authorization on the form the Director of the Department of Consumer and Business Services adopts by rule (ORS 746.135(1)).
• Do not use favorable genetic information to induce the purchase of insurance (ORS 746.135(2)).
• Do not use genetic information to reject, deny, limit, cancel, refuse to renew, increase the rates of, affect the terms and conditions of or otherwise affect any policy for hospital or medical expenses (ORS 746.135(3)).
• Do not use genetic information about a blood relative to reject, deny, limit, cancel, refuse to renew, increase the rates of, affect the terms and conditions of or otherwise affect any policy of insurance (ORS 746.135(4)).

ORS 746.600 to 746.690 · Read the law's page

• If you are an insurer, insurance producer or other licensee, give a consumer who becomes a customer a clear and conspicuous written notice of your personal information practices no later than the date you establish a continuing relationship, and give each customer such a notice at least once in any 12 consecutive months, covering the items ORS 746.620(3) lists, unless an exception in ORS 746.620 applies (ORS 746.620(1), (2), (3)).
• Do not use a disclosure authorization form that lacks the individual's identity, the categories of personal information, the parties and purposes, the individual's signature and date, and notice of how long it is valid and how to revoke it; an authorization is not valid for more than 24 months, and you must keep it in the individual's record (ORS 746.630(1), (2), (4)).
• Do not use or authorize pretext interviews to obtain personal information in connection with an insurance transaction, except to investigate a claim on a reasonable basis to suspect criminal activity, fraud, material misrepresentation or material nondisclosure (ORS 746.615).
• Within 30 business days of an individual's written request, inform the individual of the nature and substance of the recorded personal information, let the individual see and copy it, disclose to whom it was disclosed within two years, and summarize the correction procedures (ORS 746.640(1)).
• Within 30 business days of an individual's written request to correct, amend or delete recorded personal information, do so or notify the individual of your refusal, the reasons and the right to file a statement, and furnish a correction to the persons ORS 746.645(2) names (ORS 746.645(1), (2)).
• After an adverse underwriting decision, give the consumer the specific reasons in writing or advise that they are available on written request, give a summary of the consumer's rights, and on a written request within 90 business days furnish the reasons and supporting information within 21 business days (ORS 746.650(1), (2)).
• Do not disclose personal or privileged information about an individual collected or received in connection with an insurance transaction unless a condition in ORS 746.665(1) is met, such as the individual's written authorization (ORS 746.665(1)).
• If you are a health insurer, give adequate notice of your uses and disclosures of personal information and of the individual's rights, and let an individual or personal representative request access to, and correction, amendment or deletion of, personal information (ORS 746.607(6), (7)).
• Do not obtain information about an individual from an insurer, insurance producer or insurance-support organization under false pretenses (ORS 746.690).

ORS 746.665(1)(i) · Read the law's page

• If you are an insurance licensee or insurance-support organization, disclose personal or privileged information about an individual for an actuarial or research study only if no individual may be identified in any resulting actuarial or research report (ORS 746.665(1)(i)(A)).
• Make sure materials that allow the individual to be identified are returned or destroyed as soon as they are no longer needed (ORS 746.665(1)(i)(B)).
• Have the actuarial or research organization agree not to disclose the information unless the disclosure would otherwise be permitted by ORS 746.665 if made by a licensee or insurance-support organization (ORS 746.665(1)(i)(C)).
• This condition does not apply to a health insurer (ORS 746.609).