Law / United States / 
Florida
Privacy of Consumer Financial and Health Information: Office of Insurance Regulation rule
Fla. Admin. Code R. 69O-128.001 to 69O-128.023
In force since .
A data subject rights rule binding public and private bodies.
- Obligation class
- Disclosure, Consent, Data subject rights
- Audit expectation
- none
As of .
What it requires
- If you are a licensee under the Florida Insurance Code, give each customer a clear and conspicuous privacy notice that accurately reflects your privacy policies and practices when the customer relationship is established, and at least once in any period of 12 consecutive months while it continues.
- Before you disclose a consumer's nonpublic personal financial information to a nonaffiliated third party, give the consumer the initial notice and an opt out notice with a reasonable means to opt out, allow a reasonable opportunity to opt out (at least 30 days where the notices are mailed), and do not disclose if the consumer opts out.
- Do not disclose nonpublic personal health information about a consumer or customer without that person's authorization, except for the insurance functions the rule lists.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The office (Office of Insurance Regulation), by fine in lieu of revocation or suspension of an insurer's certificate of authority (section 624.4211)
What this law does
Rule 69O-128.001 governs the treatment of nonpublic personal health information and nonpublic personal financial information about individuals by all licensees regulated pursuant to the Florida Insurance Code. Under rule 69O-128.005, a licensee must provide a clear and conspicuous notice that accurately reflects its privacy policies and practices to the persons the rule lists.
Under rule 69O-128.006, a licensee must give each customer a privacy notice not less than annually during the continuation of the customer relationship. Under rule 69O-128.011, a licensee may not disclose nonpublic personal financial information about a consumer to a nonaffiliated third party unless it has given the consumer an initial notice, an opt out notice and a reasonable opportunity to opt out, and the consumer does not opt out.
Under rule 69O-128.017, a licensee may not disclose nonpublic personal health information about a consumer or customer unless it has obtained an authorization from that person, subject to the insurance functions the rule lists. The Office of Insurance Regulation treats a health insurer or health maintenance organization it finds in compliance, or actively undertaking compliance, with the federal Health Insurance Portability and Accountability Act (HIPAA) privacy rules as in compliance with section 626.9651.
Under section 624.4211, the office may impose a fine on an insurer in lieu of revocation or suspension of its certificate of authority, including a fine of up to $100,000 for each knowing and willful violation of a lawful order or rule of the office or commission or a provision of the Insurance Code, up to $500,000 for all such violations arising out of the same action.
When LexLint raises it
When your app profile says your app is an insurer.