Law / United States / 
Maryland
Insurance privacy regulation: privacy notices, opt out of disclosure of nonpublic personal financial information and authorization for disclosure of nonpublic personal health information
In force since .
A data subject rights rule binding private bodies.
- Obligation class
- Disclosure, Data subject rights, Consent
- Audit expectation
- none
As of .
What it requires
- As a licensee of the Maryland Insurance Administration, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices for nonpublic financial information not later than when you establish the customer relationship, and give each consumer such a notice before you disclose any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as the chapter's exceptions authorize (COMAR 31.16.08.05A).
- Give each customer such a notice at least once in each annual notice period during the continuation of the customer relationship, unless you provide nonpublic personal information to nonaffiliated third parties only within the chapter's exceptions and have not changed your disclosure policies and practices since the most recent notice (COMAR 31.16.08.06A and B).
- Give each consumer an opt out notice that states you disclose or reserve the right to disclose nonpublic personal financial information about the consumer to a nonaffiliated third party, that the consumer has the right to opt out of that disclosure, and a reasonable means to exercise the right (COMAR 31.16.08.08A).
- Comply with a consumer's opt out direction as soon as reasonably practicable after you receive it (COMAR 31.16.08.08E).
- Do not, directly or through an affiliate, disclose a consumer's nonpublic personal financial information to a nonaffiliated third party unless you gave the initial notice and the opt out notice, gave the consumer a reasonable opportunity to opt out before the disclosure (for example, 30 days from mailing), and the consumer did not opt out (COMAR 31.16.08.11A and B).
- Do not, directly or through an affiliate, disclose a policy number or similar access number or code for a consumer's policy or transaction account to a nonaffiliated third party for use in telemarketing, direct mail marketing or marketing through electronic mail, other than to a consumer reporting agency (COMAR 31.16.08.13C).
- Do not disclose nonpublic personal health information about a consumer or customer unless you obtain an authorization from that person, except for the insurance functions the chapter lists (COMAR 31.16.08.17A and B).
- Make each authorization written or electronic, include the identity of the person, a general description of the information, the parties, the purpose and use, the signature and date, and notice of how long it is valid and that it may be revoked at any time, make it valid for no more than 24 months, and keep it or a copy in the individual's record (COMAR 31.16.08.18A, B and D).
- Do not unfairly discriminate against a consumer or customer because the person opted out of the disclosure of nonpublic personal financial information or did not grant authorization for the disclosure of nonpublic personal health information (COMAR 31.16.08.23).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Settledness
- As of
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
A licensee must keep the authorization for disclosure of nonpublic personal health information, or a copy, in the record of the individual who is its subject. The chapter names no retention period and no regulator access to the record, and states no territorial clause, so no hook is taken.
- Kind
- Explicit
- As of
- Provision
- COMAR 31.16.08.18D
- Trigger
- consent_or_optout
What this law does
COMAR 31.16.08 applies to all licensees of the Maryland Insurance Administration who possess nonpublic personal financial information or nonpublic personal health information about consumers. The chapter does not apply to information about persons who obtain products or services for business, commercial, or agricultural purposes.
A licensee is a person licensed or required to be licensed, registered or required to be registered, or otherwise authorized or required to be authorized by the Commissioner.
A licensee must give an individual who becomes its customer a clear and conspicuous notice that accurately reflects its privacy policies and practices for nonpublic financial information not later than when it establishes the customer relationship, and must give a consumer such a notice before it discloses any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as the chapter's exceptions authorize.
A licensee must give its customers such a notice at least once in each annual notice period during the continuation of the customer relationship. A licensee need not give a current customer an annual notice if it has not changed its policies and practices on disclosing nonpublic personal information from those disclosed in the most recent disclosure sent to consumers.
An opt out notice must state that the licensee discloses or reserves the right to disclose nonpublic personal financial information about its consumer to a nonaffiliated third party, that the consumer has the right to opt out of that disclosure, and a reasonable means by which the consumer may exercise the opt out right.
A licensee must comply with a consumer's opt out direction as soon as reasonably practicable after it receives the direction, and a consumer may exercise the right to opt out at any time.
A licensee may not, directly or through an affiliate, disclose nonpublic personal financial information about a consumer to a nonaffiliated third party unless it has provided the initial notice and the opt out notice, has given the consumer a reasonable opportunity to opt out before the disclosure, and the consumer does not opt out. A licensee that mails the notices gives a reasonable opportunity to opt out if the consumer may opt out within 30 days from the date the licensee mailed the notices.
A licensee may not, directly or through an affiliate, disclose a policy number or similar form of access number or access code for a consumer's policy or transaction account, other than to a consumer reporting agency, to a nonaffiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer.
A licensee may not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer whose nonpublic personal health information is sought to be disclosed.
The authorization requirement does not prohibit, restrict, or require an authorization for disclosure of nonpublic personal health information for listed insurance functions performed by or on behalf of the licensee, such as claims administration, fraud detection and underwriting.
A valid authorization must be in written or electronic form and must contain the identity of the consumer or customer, a general description of the types of information to be disclosed, general descriptions of the parties to whom it is disclosed, the purpose and how the information will be used, the signature and date, and notice of how long the authorization is valid and that it may be revoked at any time.
An authorization must specify a length of time for which it remains valid, which may not be for more than 24 months. A licensee must retain the authorization or a copy of it in the record of the individual who is the subject of the nonpublic personal health information.
A licensee may not unfairly discriminate against a consumer or customer because the person has opted out of the disclosure of nonpublic personal financial information or has not granted authorization for the disclosure of nonpublic personal health information. The chapter does not preempt or supersede existing State law related to medical records, health information privacy, or insurance information privacy. The chapter took effect on , and Regulation .06 was amended effective .
When LexLint raises it
When your app profile says your app is an insurer.