Law / United States / 
Iowa
Insurance privacy rules, definitions of personally identifiable financial information and nonpublic personal health information
In force since .
A de-identification rule binding private bodies.
- Audit expectation
- none
What it requires
- As an insurance licensee, treat information as outside personally identifiable financial information only if it does not identify a consumer, such as aggregate information or blind data that contains no personal identifiers like account numbers, names and addresses (Iowa Admin. Code 191-90.2).
- As an insurance licensee, treat health information that identifies an individual, or that you have a reasonable basis to believe could be used to identify an individual, as nonpublic personal health information (Iowa Admin. Code 191-90.2).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Rule 191-90.2 defines personally identifiable financial information and nonpublic personal health information. A definition names no log or record, so the row takes no logging duty.
- Kind
- None
- As of
What this law does
Rule 191-90.2 defines personally identifiable financial information as any information a consumer provides to a licensee to obtain an insurance product or service from the licensee, information about a consumer resulting from a transaction involving an insurance product or service between a licensee and a consumer, or information the licensee otherwise obtains about a consumer in connection with providing an insurance product or service to that consumer.
The definition does not include health information, a list of names and addresses of customers of an entity that is not a financial institution, or information that does not identify a consumer, such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names, and addresses.
Rule 191-90.2 defines nonpublic personal health information as health information that identifies an individual who is the subject of the information or with respect to which there is a reasonable basis to believe that the information could be used to identify an individual.
When LexLint raises it
When your app profile says your app is an insurer, processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .