Law / United States / 
Massachusetts
Insurance Information and Privacy Protection: notice, access, correction, adverse underwriting decisions and disclosure limits
Mass. Gen. Laws ch. 175I, §§ 1 to 22
In force.
A data subject rights rule binding private bodies.
- Obligation class
- Disclosure, Data subject rights, Consent
- Audit expectation
- none
As of .
What it requires
- If you are an insurance institution or insurance representative, give every applicant or policyholder a written notice of information practices no later than the time of application, and at renewal, reinstatement or change in benefits unless the section excuses it. The notice states whether information may be collected from others, the types of information, sources and investigative techniques, the permitted disclosures, the rights in sections 8, 9 and 10, and that an insurance-support organization may retain and disclose its report. An abbreviated notice may replace it.
- Within thirty business days of an identified individual's written request, give the individual a copy of, or the nature and substance of, recorded personal information, with the source and the persons to whom it was disclosed in the previous two years, and a summary of the correction procedure.
- Within thirty business days of a written request, correct, amend or delete disputed recorded personal information, or reinvestigate it and either do so or tell the individual of the refusal, the reason, the right to file a statement and the right to ask the commissioner to review.
- After an adverse underwriting decision, give the applicant or policyholder the specific reason in writing or tell them they can receive it on written request, with a summary of their rights. On a written request within ninety business days, furnish the specific reason and the specific items of personal and privileged information that support it within twenty-one business days.
- Do not disclose personal or privileged information collected in connection with an insurance transaction unless the individual authorizes it in writing or the disclosure falls within an exception in section 13.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 22: knowingly and willfully obtaining information about an individual from an insurance institution, insurance representative or insurance-support organization under false pretenses is punishable by a fine of not more than $10,000 or imprisonment for not more than one year, or both.
Penalty structure
Section 18(a): after a hearing that finds a knowing violation, the commissioner may order a penalty of not more than $1,000 for each violation; the penalty against an insurance representative may not exceed $10,000 in the aggregate and the penalty against an insurance institution or insurance-support organization may not exceed $50,000 in the aggregate. Section 18(b): a person who violates a cease and desist order may be fined not more than $10,000 for each violation, or not more than $50,000 if the violations amount to a general business practice, or have a license suspended or revoked.
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 50,000
- Per violation unit
- Violation
- Per violation amount
- 1,000
Who enforces it
Enforcement body
Massachusetts Commissioner of Insurance, who issues a statement of charges and notice of hearing, issues cease and desist orders and may order the section 18 penalties; a person whose rights under sections 8, 9 or 10 are violated may seek equitable relief in superior court, and a person harmed by a section 13 disclosure may recover special and compensatory damages under section 20.
What this law does
Chapter 175I applies to an insurance institution, insurance representative or insurance-support organization that, in the case of life, health and disability insurance, collects, receives or maintains information in connection with an insurance transaction about a natural person who is a resident of the commonwealth, or engages in an insurance transaction with an applicant, individual or policyholder who is a resident.
Section 2 of chapter 175I defines an insurance institution as any corporation, association, partnership, reciprocal exchange, inter-insurer, Lloyd's insurer, fraternal benefit society or other person engaged in the business of insurance. Section 4 of chapter 175I requires an insurance institution or insurance representative to give applicants or policyholders a notice of information practices in connection with insurance transactions.
Section 8 of chapter 175I requires an insurance institution, insurance representative or insurance-support organization to respond to a written request for access to recorded personal information within thirty business days. Section 9 of chapter 175I requires an insurance institution, insurance representative or insurance-support organization to correct, amend or delete, or reinvestigate, disputed recorded personal information within thirty business days of a written request.
Section 10 of chapter 175I requires the insurance institution or insurance representative responsible for an adverse underwriting decision to give the specific reason in writing or to advise that the person may receive it on written request.
Section 13 of chapter 175I bars an insurance institution, insurance representative or insurance-support organization from disclosing personal or privileged information collected in connection with an insurance transaction unless the disclosure falls within the exceptions the section lists, the first being the individual's written authorization.
Section 18(a) of chapter 175I lets the commissioner order a penalty of not more than one thousand dollars for each knowing violation, with aggregate limits of ten thousand dollars for an insurance representative and fifty thousand dollars for an insurance institution or insurance-support organization.
Section 18(b) of chapter 175I sets fines of up to ten thousand dollars for each violation of a cease and desist order, and up to fifty thousand dollars where the violations amount to a general business practice. Section 20(a) of chapter 175I lets a person whose rights under sections 8, 9 or 10 are violated apply to the superior court for equitable relief.
Section 20(b) of chapter 175I makes an insurance institution, insurance representative or insurance-support organization that discloses information in violation of section 13 liable for special and compensatory damages. Section 20(e) of chapter 175I leaves an individual no other remedy or recovery in law or in equity for a violation of the chapter.
Section 22 of chapter 175I punishes knowingly and willfully obtaining information about an individual from an insurance institution, insurance representative or insurance-support organization under false pretenses by a fine of not more than ten thousand dollars or imprisonment for not more than one year, or both.
When LexLint raises it
When your app profile says your app is an insurer.