Law / United States / 
Montana
Insurance Information and Privacy Protection Act
Officially Insurance Information and Privacy Protection Act: notice, access and correction, adverse underwriting decisions and disclosure limits
Mont. Code Ann. §§ 33-19-101 to 33-19-409
In force since .
A data subject rights rule binding private bodies.
- Obligation class
- Disclosure, Data subject rights, Consent
As of .
What it requires
- If you are an insurance institution, insurance producer or insurance-support organization, do not use or authorize pretext interviews to obtain information in connection with an insurance transaction, except to investigate a claim where specific information available to the commissioner gives a reasonable basis for suspecting criminal activity, fraud, material misrepresentation or material nondisclosure.
- Give individuals about whom you collect and disclose personal information a clear and conspicuous written notice of your information practices, delivered to a policyholder or certificate holder no later than delivery of the policy or certificate and within 60 days after a material change in your privacy practices, and to an applicant when the application is submitted.
- Clearly specify any questions designed to obtain information solely for marketing or research purposes.
- Do not prepare or request an investigative consumer report for an application, renewal, reinstatement or change in benefits unless you tell the individual that they may request an interview and may receive a copy of the report on request.
- On a written request after proper identification, within 30 business days inform the individual of the nature and substance of the recorded personal information, let them see and copy it or obtain a copy by mail, disclose the identity of those to whom you disclosed it within the previous 2 years, and give a summary of the correction procedures.
- Within 30 business days of a written request to correct, amend or delete recorded personal information, either do so or tell the individual of your refusal, the reasons and the right to file a statement of disagreement.
- After an adverse underwriting decision, give the applicant, policyholder or individual proposed for coverage the specific reasons in writing, or advise that they may be requested in writing, with a summary of their rights, and on a written request made within 90 business days furnish the reasons, the supporting items of personal and privileged information and the institutional sources within 21 business days.
- Do not seek information about a previous adverse underwriting decision, or previous residual market coverage, unless the inquiry also asks for the reasons and the individual is advised of the source, and do not base an adverse underwriting decision on the fact of an earlier one.
- If you are a licensee, do not disclose personal or privileged information about an individual collected or received in connection with an insurance transaction except as section 33-19-306 allows, including with the individual's written authorization on a form that meets section 33-19-206, and do not use or disclose personal information for a marketing purpose except as section 33-19-307 permits.
- Use a disclosure authorization that is in writing or electronic form, identifies the individual, describes the information, recipient and purpose, is signed and dated, states how long it is valid (no more than 24 contiguous months) and how to revoke it, and do not condition enrollment, coverage, benefits or rates on signing one unless the disclosure is necessary to perform an insurance function.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 33-19-409 makes knowingly and willfully obtaining information about an individual from an insurance institution, insurance producer or insurance-support organization under false pretenses punishable by a fine of not more than $10,000 or imprisonment for not more than 1 year, or both.
Penalty structure
Section 33-19-405 makes a person who violates the chapter subject to the civil penalty in section 33-1-317, a fine not to exceed $25,000 imposed by the commissioner after a hearing, except that the fine on insurance producers or adjusters may not exceed $5,000 per violation.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 25,000
Who enforces it
Enforcement body
The commissioner of insurance, who has the power to examine and investigate the affairs of every insurance institution or insurance producer doing business in Montana.
What this law does
Chapter 19 of Title 33 may be cited as the Insurance Information and Privacy Protection Act. For life, health or disability insurance, the Act binds insurance institutions, insurance producers and insurance-support organizations that, on or after , collect, receive or maintain information in connection with insurance transactions that pertains to Montana residents, or engage in insurance transactions with Montana residents.
For property or casualty insurance, the Act binds insurance institutions, insurance producers and insurance-support organizations that, on or after , collect, receive or maintain information in connection with insurance transactions involving policies delivered, issued for delivery or renewed in Montana, or engage in such transactions.
A licensee that is a Health Insurance Portability and Accountability Act (HIPAA) covered entity is exempt from the chapter as to uses and disclosures covered by the HIPAA privacy and security regulations, except for the notice, authorization, adverse underwriting decision and underwriting disclosure provisions the section lists.
An insurance institution, insurance producer or insurance-support organization may not use or authorize the use of pretext interviews to obtain information in connection with an insurance transaction, except as the section provides. A licensee must provide a clear and conspicuous notice of information practices that accurately reflects its privacy policies and practices to individuals about whom personal information is collected and disclosed in connection with insurance transactions.
An insurance institution or insurance producer shall clearly specify the questions that are designed to obtain information from an individual in connection with an insurance transaction solely for marketing or research purposes.
On a written request after proper identification, an insurance institution, insurance producer or insurance-support organization must within 30 business days inform the individual of the nature and substance of the recorded personal information and let the individual see and copy it or obtain a copy by mail.
Within 30 business days of a written request to correct, amend or delete recorded personal information, the holder must correct, amend or delete the disputed portion or notify the individual of its refusal and the reasons. If an adverse underwriting decision is made, the insurance institution or insurance producer responsible must provide the specific reasons in writing or advise that they may be requested in writing, and provide a summary of the individual's rights.
Except as the section provides, a licensee may not disclose personal or privileged information about an individual collected or received in connection with an insurance transaction. Except as the section permits, a licensee may not use or disclose personal information for a marketing purpose. Section 33-19-307 was enacted by section 8 of chapter 341, Laws of 2001, and amended by section 6 of chapter 385, Laws of 2003.
Part 3 of the chapter lists section 33-19-321, titled Computer security breach. Section 33-19-321 (computer security breach) falls within this range and is described separately. A person who violates the chapter is subject to the civil penalty provided in section 33-1-317.
Section 33-1-317 lets the commissioner, after a hearing, impose a fine not to exceed $25,000 on a person found to have violated a provision of the insurance code, except that the fine on insurance producers or adjusters may not exceed $5,000 per violation.
An insurance institution, insurance producer or insurance-support organization that discloses information in violation of section 33-19-306 or 33-19-307 is liable for damages sustained by the individual to whom the information relates, up to the actual damages sustained.
Any person who knowingly and willfully obtains information about an individual from an insurance institution, insurance producer or insurance-support organization under false pretenses shall be fined not more than $10,000 or imprisoned for not more than 1 year, or both.
When LexLint raises it
When your app profile says your app is an insurer.