Law / United States / 
California
Insurance Information and Privacy Protection Act
Officially Insurance Information and Privacy Protection Act: notice, access and correction, adverse underwriting decisions and disclosure limits
Cal. Ins. Code sections 791 to 791.28
In force since .
A comprehensive regime rule binding private bodies.
- Obligation class
- Disclosure, Data subject rights, Consent, Prohibition
- Audit expectation
- none
As of .
What it requires
- Apply the article if you are an insurance institution, an agent licensed under Insurance Code chapters 5, 5A, 6, 7 or 8, or an insurance-support organization (a business that regularly assembles or collects information about people mainly to give it to insurers or agents, such as consumer reports or fraud-detection data) and you handle insurance bought primarily for personal, family or household needs. For life or disability insurance it reaches information about California residents; for property or casualty insurance it reaches policies delivered, issued for delivery or renewed in California. Title insurers and home protection companies that hold no personal information of their policyholders and applicants are outside the article, and a health care service plan regulated under the Knox-Keene Act is not an insurance institution.
- Do not use or authorize a pretext interview (pretending to be someone else or to represent someone you do not, misrepresenting the purpose of the interview, or refusing to identify yourself on request) to obtain information in connection with an insurance transaction. The one exception is a claim investigation with a reasonable basis for suspecting criminal activity, fraud, material misrepresentation or material nondisclosure, and only when the person or institution interviewed has no generally or statutorily recognized privileged relationship with the person the information concerns.
- Give each applicant and policyholder a written notice of information practices, or an abbreviated notice that says the full notice will be furnished on request. For a written application, give it at delivery of the policy when personal information is collected only from the applicant, an insured or public records, and otherwise when collection from another source begins. At renewal, reinstatement or a change in benefits, give it unless information is collected only from the policyholder, an insured or public records or a conforming notice went out in the previous 24 months. The notice states whether information may be collected from other persons, the types of information, sources and investigative techniques, the disclosures that may be made without authorization, the access and correction rights and how to use them, and that an insurance-support organization may retain and disclose information from its report.
- Clearly mark any question asked of an individual in connection with an insurance transaction that is designed to obtain information solely for marketing or research purposes.
- Use a disclosure authorization form, to obtain personal or privileged information about an individual, that is written in plain language, dated, names the insurance institution or agent, specifies the types of persons authorized to disclose, the nature of the information and the purposes for which it is collected, states how long the authorization stays valid (no longer than 30 months for a life, health or disability application, reinstatement or change request, or one year for property or casualty; for a claim, the term of coverage for a health insurance claim or the duration of the claim for other claims), and tells the individual they are entitled to a copy.
- Before preparing or requesting an investigative consumer report for an application, renewal, reinstatement or change in benefits, tell the individual that they may request an interview and may receive a copy of the report. Institute reasonable procedures to conduct a requested interview, and, if an insurance-support organization prepares the report, tell it whether the individual requested an interview.
- On a written request, after proper identification, for reasonably described and locatable recorded personal information, respond within 30 business days: describe its nature and substance, let the individual see and copy it or send a copy by mail, translate coded information into plain language, disclose to whom it was disclosed in the previous two years (or the types of recipients normally given it), identify any institutional source, and summarize how to request correction, amendment or deletion. Send medical record information from a medical professional or institution directly to the individual or to a medical professional the individual designates, and mental health record information directly to the individual only with the approval of the treating professional. A reasonable copying fee may be charged except for information provided under section 791.10.
- On a written request to correct, amend or delete recorded personal information, respond within 30 business days: either make the change, notify the individual in writing and furnish it to anyone the individual designates who received the information in the previous two years and to the insurance-support organizations the section names, or notify the individual of the refusal, the reasons and the right to file a concise statement of disagreement. File any statement with the disputed information, and include it in every later disclosure of that information.
- After an adverse underwriting decision, give the applicant, policyholder or individual proposed for coverage the specific reasons in writing, or tell them they may request the reasons in writing, together with a summary of their rights under section 791.10(b) and sections 791.08 and 791.09. For a declination, cancellation or nonrenewal of a property policy covered by Insurance Code section 675, an automobile policy covered by section 660 or an individual life, health or disability policy, give the specific reasons in writing at the time of the decision. On a written request within 90 business days of the notice, furnish within 21 business days the specific reasons, the specific items of personal and privileged information that support them, and the names and addresses of the institutional sources; privileged items need not be furnished where there is a reasonable suspicion, based on specific information available for review by the Commissioner, of criminal activity, fraud, material misrepresentation or material nondisclosure.
- Do not seek information about a previous adverse underwriting decision, or about previous coverage obtained through a residual market mechanism, unless the inquiry also requests the reasons.
- Do not base an adverse underwriting decision, in whole or in part, on the fact of a previous adverse underwriting decision or of earlier residual-market coverage, on personal information received from an insurance-support organization whose primary source of information is insurance institutions, on the fact that the individual inquired about the scope or nature of residential fire or property coverage without filing a claim when that fact comes from such an organization, or on a reported accident involving a peace officer, California Highway Patrol member or firefighter for which the insurer retains no liability. You may rely on further information obtained from the insurer responsible for an earlier decision, or as the result of an insurance-support organization's information.
- Do not disclose personal or privileged information about an individual collected or received in connection with an insurance transaction unless a ground listed in section 791.13 applies: for example the individual's dated, signed written authorization obtained one year or less before the disclosure is sought (or one that meets section 791.06 when another insurance institution, agent or insurance-support organization submits it), a disclosure reasonably necessary for a recipient to perform a business, professional or insurance function for you under an agreement not to disclose further, fraud detection or prevention, a disclosure to an insurance regulatory authority, or a disclosure to a law enforcement or other governmental authority pursuant to law.
- Disclose information to a person whose only use will be marketing a product or service only if no medical record information, privileged information, or information about character, personal habits, mode of living or general reputation, and no classification derived from it, is disclosed, or the individual has been given an opportunity to say they do not want personal information disclosed for marketing and has not said so, and the recipient agrees to use it only for marketing. Disclose to an affiliate only for an audit of the insurance institution or agent or for marketing an insurance product or service, and only if the affiliate agrees not to disclose the information for any other purpose or to unaffiliated persons.
- As a disability insurer providing hospital, medical or surgical coverage, do not release information to an employer that would directly or indirectly indicate that an employee is receiving or has received services from a covered health care provider unless the employee authorizes it.
- As an insurer under a personal lines residential property insurance policy that reports claims history or loss experience to an insurance-support organization, give the insured the additional claims-database disclosure that section 791.28 prescribes, at the time you provide the disclosure required by Insurance Code section 790.034(b)(1).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 791.22: a person who knowingly and willfully obtains information about an individual from an insurance institution, agent or insurance-support organization under false pretenses is subject to a fine of not more than $10,000 or imprisonment for not more than one year, or both.
Penalty structure
Section 791.19: a person who violates a cease and desist order of the Commissioner may, after notice and hearing and on the Commissioner's order, be fined not more than $10,000 for each violation, or not more than $50,000 if the Commissioner finds that violations have occurred with such frequency as to constitute a general business practice, or have an insurance institution's or agent's license suspended or revoked if it knew or reasonably should have known it was in violation. The fine attaches to a violation of a cease and desist order of the Commissioner under section 791.17. Subdivision (b)'s $50,000 is an alternative fine for violations frequent enough to be a general business practice, not a cap on the per-violation fines.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
California Insurance Commissioner (Department of Insurance). The Commissioner examines and investigates, serves a statement of charges and holds a hearing, issues a cease and desist order on a finding of violation, and may fine a person who violates that order or suspend or revoke an insurance institution's or agent's license. An individual may also apply to a court for equitable relief on the access, correction and adverse-decision duties and recover actual damages for a disclosure that violates the disclosure limits, and these are the only individual remedies the article allows (section 791.20). Obtaining information under false pretenses is a criminal offense under section 791.22.
Settledness
- As of
- Open questions
- Does the definition of insurance transaction, which covers only insurance bought primarily for personal, family or household needs rather than business or professional needs, keep an application for small-business or commercial insurance outside the notice, access and disclosure duties even when the same insurer also handles personal lines?
What this law does
The Insurance Information and Privacy Protection Act sets standards for the collection, use and disclosure of information gathered in connection with insurance transactions by insurance institutions, agents or insurance-support organizations.
For life or disability insurance, the article applies to those that collect, receive or maintain information in connection with insurance transactions that pertains to natural persons who are California residents, or that engage in insurance transactions with applicants, individuals or policyholders who are California residents.
For property or casualty insurance, the article applies to those that collect, receive or maintain information in connection with insurance transactions involving policies, contracts or certificates of insurance delivered, issued for delivery or renewed in California, or that engage in such transactions.
An insurance transaction is one involving insurance primarily for personal, family or household needs rather than business or professional needs that entails determining an individual's eligibility for coverage, a benefit or a payment, or servicing an insurance application, policy, contract or certificate. A health care service plan regulated under the Knox-Keene Health Care Service Plan Act is not an insurance institution.
The article does not apply to a title insurer, or to a home protection company that does not obtain or maintain personal information of its policyholders and applicants. Persons subject to the article are exempt from Part 2.6 of Division 1 of the Civil Code, which begins at section 56, and from Civil Code sections 1785.20 and 1786.40.
No insurance institution, agent or insurance-support organization may use or authorize a pretext interview to obtain information in connection with an insurance transaction, except to investigate a claim where there is a reasonable basis for suspecting criminal activity, fraud, material misrepresentation or material nondisclosure, and then only to interview a person or institution with no generally or statutorily recognized privileged relationship with the person the information concerns.
An insurance institution or agent must give every applicant and policyholder a written notice of information practices, and may instead give an abbreviated notice that says the full notice will be furnished on request. For a written application, the notice is due at delivery of the policy when personal information is collected only from the applicant, an insured or public records, and otherwise when collection of personal information from another source begins.
An insurance institution or agent must clearly specify the questions designed to obtain information from an individual solely for marketing or research purposes. A disclosure authorization form used to obtain personal or privileged information about an individual must be written in plain language, be dated, and specify how long it remains valid.
An insurance institution, agent or insurance-support organization may not prepare or request an investigative consumer report about an individual for an application, renewal, reinstatement or change in benefits unless the individual is told that they may request an interview and may receive a copy of the report.
On a written request after proper identification, an insurance institution, agent or insurance-support organization must within 30 business days tell the individual the nature and substance of recorded personal information about them, let them see and copy it, and disclose, if recorded, to whom it was disclosed in the previous two years.
Within 30 business days of a written request to correct, amend or delete recorded personal information, the holder must either do so or notify the individual of its refusal, the reasons for it and the individual's right to file a statement of disagreement.
The access right extends to all natural persons about whom an insurance institution, agent or insurance-support organization collects and maintains information in connection with an insurance transaction, but not to information about them collected in connection with or in reasonable anticipation of a claim or a civil or criminal proceeding involving them.
An adverse underwriting decision is a declination or termination of individually underwritten coverage, an agent's failure to apply for requested coverage with an insurer it represents, a placement of a property or casualty risk at other than a preferred or standard rate with a residual market mechanism, an unauthorized insurer or an insurer of other than preferred or standard risks (a placement with an insurer of other than preferred or standard risks is not one if the applicant or insured did not specify or apply for placement as a preferred or standard risk or with a particular company insuring preferred or standard risks), a higher rate charged on information that differs from what the applicant or policyholder furnished, or, for life, health or disability coverage, an offer to insure at higher than standard rates.
After an adverse underwriting decision, the insurance institution or agent responsible must give the applicant, policyholder or individual proposed for coverage the specific reasons in writing or, except as subdivision (e) provides, advise that they may be requested in writing, and a summary of the rights to reasons and supporting items and to access and correction.
Except as subdivision (d) provides for a decision resulting solely from an oral request or inquiry, for a declination, cancellation or nonrenewal of a property insurance policy covered by section 675 of the Insurance Code, an automobile insurance policy covered by section 660 or an individual life, health or disability insurance policy, the specific reasons must be given in writing at the time of the decision.
On a written request made within 90 business days of the notice, the insurance institution or agent must furnish within 21 business days the specific reasons in writing, the specific items of personal and privileged information that support them, and the names and addresses of the institutional sources, except that it need not furnish privileged items where it has a reasonable suspicion, based on specific information available for review by the Commissioner, of criminal activity, fraud, material misrepresentation or material nondisclosure.
An insurance institution, agent or insurance-support organization may not seek information about an individual's previous adverse underwriting decision, or previous coverage through a residual market mechanism, unless the inquiry also requests the reasons.
An insurance institution or agent may not base an adverse underwriting decision, in whole or in part, on the fact of a previous adverse underwriting decision or of earlier coverage through a residual market mechanism, though it may rely on further information obtained from the insurance institution or agent responsible for the earlier decision.
An insurance institution or agent also may not base an adverse underwriting decision on personal information received from an insurance-support organization whose primary source of information is insurance institutions, though it may rely on further personal information obtained as a result of that information.
An insurance institution, agent or insurance-support organization may not disclose personal or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure falls within a ground the section lists, the first of which is the individual's written authorization.
Disclosure to a person whose only use of the information is marketing a product or service is permitted only if no medical record information, privileged information, information about character, personal habits, mode of living or general reputation, or classification derived from the information is disclosed or the individual has been given an opportunity to object and has not, and the recipient agrees to use it only for marketing.
The Insurance Commissioner may examine and investigate every insurance institution or agent doing business in California for violations of the article. After a hearing at which the Commissioner determines that an insurance institution, agent or insurance-support organization violated the article, the Commissioner must issue an order requiring it to cease and desist.
A person who violates a cease and desist order may, after notice and hearing, be fined not more than $10,000 for each violation, or not more than $50,000 if the violations occurred with such frequency as to constitute a general business practice, or have an insurance institution's or agent's license suspended or revoked if it knew or reasonably should have known it was in violation.
A person whose rights under the access, correction or adverse-decision sections are violated may apply to a court for appropriate equitable relief, and a disclosure in violation of the disclosure limits makes the discloser liable for the individual's actual damages. The court may award costs and reasonable attorney's fees to the prevailing party, and an action must be brought within two years from the date the violation is or should have been discovered.
Except as section 791.20 specifically provides, no remedy or recovery is available to individuals for a violation of any provision of the act.
No cause of action for defamation, invasion of privacy or negligence arises against a person for disclosing personal or privileged information in accordance with the article, or for furnishing it to an insurance institution, agent or insurance-support organization, except for false information disclosed or furnished with malice or willful intent to injure.
A person who knowingly and willfully obtains information about an individual from an insurance institution, agent or insurance-support organization under false pretenses is subject to a fine of not more than $10,000 or imprisonment for not more than one year, or both.
A disability insurer providing hospital, medical or surgical coverage may not release information to an employer that would directly or indirectly indicate that an employee is receiving or has received services from a covered health care provider unless the employee authorizes it.
An insurer under a personal lines residential property insurance policy that reports claims history or loss experience of insureds to an insurance-support organization must give the insured an additional disclosure naming each claims information database to which it reports.
When LexLint raises it
When your app profile says your app is an insurer.