Law / United States / 
Connecticut
Connecticut Insurance Information and Privacy Protection Act
Officially Connecticut Insurance Information and Privacy Protection Act: notice, access and correction, adverse underwriting decisions and disclosure limits
Conn. Gen. Stat. §§ 38a-975 to 38a-998
In force since .
A data subject rights rule binding private bodies.
- Obligation class
- Disclosure, Data subject rights, Consent, Prohibition
As of .
What it requires
- If you are an insurance institution, agent or insurance-support organization, do not use or authorize a pretext interview to obtain information in connection with an insurance transaction, except to investigate a claim where specific information available for review by the commissioner gives a reasonable basis for suspecting criminal activity, fraud, material misrepresentation or material nondisclosure, and then only to interview a person or institution with no recognized privileged relationship with the person the information concerns (section 38a-978).
- If you are an insurance institution or agent, give all applicants and policyholders a written notice of information practices at the times section 38a-979 sets, stating whether personal information may be collected from persons other than the individual, the types of information and investigative techniques and sources, the disclosures made without prior authorization, the access and correction rights and how to use them, and that an insurance-support organization may retain and disclose its report. An abbreviated notice may replace the full notice (section 38a-979).
- Do not prepare or request an investigative consumer report for an application, renewal, reinstatement or change in benefits unless you inform the individual that the individual may ask to be interviewed and is entitled to receive a copy of the report on request (section 38a-982).
- Within thirty business days of a written request, after proper identification, tell the individual the nature and substance of recorded personal information, let the individual see and copy it or obtain a copy by mail, disclose to whom it was disclosed within the previous two years, and summarize the procedures for requesting correction, amendment or deletion. Supply medical-record information directly or through a medical professional the individual designates (section 38a-983).
- Not later than thirty business days after a written request to correct, amend or delete recorded personal information, either do so and notify the individual and the recipients the section names, or notify the individual of the refusal, the reasons and the right to file a statement of disagreement, then file that statement with the disputed information and pass it on with later disclosures (section 38a-984).
- After an adverse underwriting decision, give the applicant, policyholder or individual proposed for coverage the specific reason in writing, or advise that it may be had on written request, with a summary of the rights in sections 38a-983 to 38a-985. On a written request within ninety business days, furnish within twenty-one business days the specific reason, the specific items of personal and privileged information that support it, and the names and addresses of the institutional sources (section 38a-985).
- Do not disclose personal or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure is made with the individual's written authorization or falls within one of the other grounds section 38a-988 lists (section 38a-988).
- Do not knowingly and wilfully obtain information about an individual from an insurance institution, agent or insurance-support organization under false pretenses (section 38a-997).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 38a-997: a person who knowingly and wilfully obtains information about an individual from an insurance institution, agent or insurance-support organization under false pretenses is fined not more than $20,000.
Penalty structure
Section 38a-993: after a hearing the commissioner may order a penalty of not more than $2,000 for each negligent violation, up to $20,000 in the aggregate, or not more than $5,000 for each intentional violation, up to $50,000 in the aggregate. The intentional-violation ceiling is recorded as per_violation_amount and its aggregate as fixed_cap. A person who violates a cease and desist order may be penalized up to $20,000 for each violation (section 38a-993(c)).
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 50,000
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
Connecticut Insurance Commissioner, who may examine and investigate any insurance institution or agent doing business in the state, hold a hearing, issue a cease and desist order and order a penalty (sections 38a-989 to 38a-993). A person whose access, correction or adverse-decision rights are violated may also sue for equitable relief, and an individual harmed by a disclosure in violation of section 38a-988 may recover actual damages (section 38a-995).
Settledness
- As of
What this law does
The obligations of the Connecticut Insurance Information and Privacy Protection Act apply to insurance institutions, agents and insurance-support organizations that, on or after , for life, health or disability insurance collect, receive or maintain information about Connecticut residents or engage in transactions with Connecticut residents.
Under the Connecticut Insurance Information and Privacy Protection Act, no insurance institution, agent or insurance-support organization may use or authorize a pretext interview to obtain information in connection with an insurance transaction, except to investigate a claim on the terms section 38a-978 sets.
Under the Connecticut Insurance Information and Privacy Protection Act, an insurance institution or agent must give all applicants or policyholders a written notice of information practices at the times section 38a-979 sets.
Under the Connecticut Insurance Information and Privacy Protection Act, within thirty business days of a written request after proper identification, the holder must tell the individual the nature and substance of recorded personal information, let the individual see and copy it, disclose to whom it was disclosed within two years, and summarize the correction procedures.
Under the Connecticut Insurance Information and Privacy Protection Act, not later than thirty business days after a written request to correct, amend or delete recorded personal information, the holder must either do so or notify the individual of its refusal, the reasons and the right to file a statement.
Under the Connecticut Insurance Information and Privacy Protection Act, after an adverse underwriting decision, the insurance institution or agent responsible must provide the specific reason in writing or advise that it may be had in writing on request, together with a summary of the individual's rights.
Under the Connecticut Insurance Information and Privacy Protection Act, an insurance institution, agent or insurance-support organization may not disclose personal or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure falls within one of the grounds section 38a-988 lists, the first being the individual's written authorization.
Under the Connecticut Insurance Information and Privacy Protection Act, after a hearing the commissioner may order a penalty of not more than $5,000 for each intentional violation of the act, up to $50,000 in the aggregate, and not more than $2,000 for each negligent violation, up to $20,000 in the aggregate.
Under the Connecticut Insurance Information and Privacy Protection Act, a person whose rights under sections 38a-983, 38a-984 or 38a-985 are violated may bring an action for equitable relief. Under the Connecticut Insurance Information and Privacy Protection Act, an insurance institution, agent or insurance-support organization that discloses information in violation of section 38a-988 is liable for the damages the individual sustains, which may not exceed actual damages.
Section 38a-988a, which lies within the range of sections 38a-975 to 38a-998, binds any person, including health care professionals, medical care centers and pharmacies, and not only insurance institutions, agents and insurance-support organizations.
Under the Connecticut Insurance Information and Privacy Protection Act, a person who knowingly and wilfully obtains information about an individual from an insurance institution, agent or insurance-support organization under false pretenses is fined not more than $20,000.
When LexLint raises it
When your app profile says your app is an insurer.