Law / United States / 
Oregon
Oregon insurance information practices: notice, access and correction, adverse underwriting decisions and disclosure limits
In force.
A data subject rights rule binding private bodies.
- Obligation class
- Disclosure, Data subject rights, Consent, Prohibition
- Audit expectation
- none
As of .
What it requires
- If you are an insurer, insurance producer or other licensee, give a consumer who becomes a customer a clear and conspicuous written notice of your personal information practices no later than the date you establish a continuing relationship, and give each customer such a notice at least once in any 12 consecutive months, covering the items ORS 746.620(3) lists, unless an exception in ORS 746.620 applies (ORS 746.620(1), (2), (3)).
- Do not use a disclosure authorization form that lacks the individual's identity, the categories of personal information, the parties and purposes, the individual's signature and date, and notice of how long it is valid and how to revoke it; an authorization is not valid for more than 24 months, and you must keep it in the individual's record (ORS 746.630(1), (2), (4)).
- Do not use or authorize pretext interviews to obtain personal information in connection with an insurance transaction, except to investigate a claim on a reasonable basis to suspect criminal activity, fraud, material misrepresentation or material nondisclosure (ORS 746.615).
- Within 30 business days of an individual's written request, inform the individual of the nature and substance of the recorded personal information, let the individual see and copy it, disclose to whom it was disclosed within two years, and summarize the correction procedures (ORS 746.640(1)).
- Within 30 business days of an individual's written request to correct, amend or delete recorded personal information, do so or notify the individual of your refusal, the reasons and the right to file a statement, and furnish a correction to the persons ORS 746.645(2) names (ORS 746.645(1), (2)).
- After an adverse underwriting decision, give the consumer the specific reasons in writing or advise that they are available on written request, give a summary of the consumer's rights, and on a written request within 90 business days furnish the reasons and supporting information within 21 business days (ORS 746.650(1), (2)).
- Do not disclose personal or privileged information about an individual collected or received in connection with an insurance transaction unless a condition in ORS 746.665(1) is met, such as the individual's written authorization (ORS 746.665(1)).
- If you are a health insurer, give adequate notice of your uses and disclosures of personal information and of the individual's rights, and let an individual or personal representative request access to, and correction, amendment or deletion of, personal information (ORS 746.607(6), (7)).
- Do not obtain information about an individual from an insurer, insurance producer or insurance-support organization under false pretenses (ORS 746.690).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
ORS 731.992(4): a violation of any provision of the Insurance Code for which the Insurance Code or other applicable laws of this state do not provide a greater penalty is a Class A misdemeanor.
Penalty structure
ORS 731.988(1): a person that violates any provision of the Insurance Code is subject to a civil penalty the Director of the Department of Consumer and Business Services determines that does not exceed $10,000 for each offense, and the civil penalty for individual insurance producers, adjusters or insurance consultants may not exceed $1,000 for each offense. Each violation is a separate offense.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Director of the Department of Consumer and Business Services, who may examine and investigate insurers, insurance producers and insurance-support organizations to determine whether they have engaged in conduct in violation of ORS 746.600 to 746.690 (ORS 746.670).
What this law does
The purpose of ORS 746.600 to 746.690 is to establish standards for the collection, use and disclosure of personal information gathered in connection with insurance transactions by insurers, insurance producers or insurance-support organizations.
The obligations of ORS 746.600 to 746.690 apply to insurers, insurance producers and insurance-support organizations that, for life or health insurance, collect, receive or maintain personal information about Oregon residents or engage in insurance transactions with Oregon residents, and, for other kinds of insurance, collect, receive or maintain personal information in connection with, or engage in, insurance transactions involving policies or certificates delivered, issued for delivery or renewed in Oregon, except as ORS 746.606 to 746.609 provide.
An insurance transaction is a transaction that involves insurance primarily for personal, family or household needs rather than business or professional needs and that entails the determination of an individual's eligibility for coverage, benefit or payment or the servicing of an insurance application, policy or certificate.
A licensee must provide a clear and conspicuous notice of personal information practices to a consumer who becomes a customer, not later than the date the licensee establishes a continuing relationship under which it provides insurance products or services used primarily for personal, family or household purposes. A licensee must give a customer a clear and conspicuous notice that accurately reflects its privacy policies and practices not less than annually during the relationship.
The privacy notice must be in writing and clear and conspicuous, and it must include the categories of personal information the licensee collects. An insurer, insurance producer or insurance-support organization may not use or authorize the use of pretext interviews to obtain personal information in connection with an insurance transaction.
A licensee or insurance-support organization may not use a disclosure authorization form unless it is clear and conspicuous and states the identity of the individual, the categories of information, the parties to whom it is disclosed and why, the individual's signature and date, how long it is valid, that the individual may revoke it and how.
An insurer, insurance producer or insurance-support organization must, within 30 business days of a written request for access to reasonably locatable recorded personal information, inform the individual of its nature and substance, let the individual see and copy it, disclose to whom it has been disclosed, and summarize the correction procedures.
Within 30 business days of a written request to correct, amend or delete recorded personal information, an insurer, insurance producer or insurance-support organization must either do so or notify the individual of its refusal, the reasons and the right to file a statement.
After an adverse underwriting decision, the insurer or insurance producer responsible must either give the consumer the specific reasons in writing or advise that the reasons are available on written request, and give a summary of the consumer's rights under ORS 746.650, 746.640 and 746.645.
A licensee or insurance-support organization may not disclose personal or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure meets one of the conditions ORS 746.665(1) lists. ORS 746.607 and 746.608 establish standards for health insurers that are subject to the information privacy provisions of both the federal Health Insurance Portability and Accountability Act and the federal Gramm-Leach-Bliley Act.
ORS 746.620, 746.630, 746.640, 746.645 and 746.665 do not apply to health insurers. A health insurer may use or disclose personal information of an individual in a manner consistent with an authorization from the individual or a personal representative.
The Director of the Department of Consumer and Business Services may examine and investigate the affairs of any insurer or insurance producer transacting insurance in Oregon, and of an insurance-support organization acting on behalf of one, to determine whether it has engaged in conduct in violation of ORS 746.600 to 746.690. A person whose rights under ORS 746.607(7), 746.640, 746.645 or 746.650 are violated may apply to a court for appropriate equitable relief.
A licensee or insurance-support organization that discloses information in violation of ORS 746.665, or a health insurer that uses or discloses information in violation of ORS 746.607(1) or (2), is liable for the actual damages the individual sustains. Except as ORS 746.680 provides, no remedy or recovery is available to individuals, in law or in equity, for a violation of any provision of ORS 746.600 to 746.690.
No person may knowingly and willfully obtain information about an individual from an insurer, insurance producer or insurance-support organization under false pretenses. The history note of ORS 746.610 lists section 3 of chapter 649, Oregon Laws 1981, and later amendments through chapter 364, Oregon Laws 2003. ORS chapters 731, 732, 733, 734, 735, 737, 742, 743, 743A, 743B, 744, 746, 748 and 750 may be cited as the Insurance Code.
A person that violates any provision of the Insurance Code is subject to a civil penalty the Director of the Department of Consumer and Business Services determines that does not exceed $10,000 for each offense. A violation of any provision of the Insurance Code for which no greater penalty is provided is a Class A misdemeanor.
When LexLint raises it
When your app profile says your app is an insurer.