Law / United States / 
Utah
Privacy of Consumer Financial and Health Information Rule: insurance licensees' notice, opt-out and authorization duties
In force.
A data subject rights rule binding private bodies.
- Obligation class
- Disclosure, Consent, Data subject rights
As of .
What it requires
- If you are an insurance licensee, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices no later than when you establish the customer relationship, and not less than once in a 12 consecutive month period during the relationship (R590-206-5 and R590-206-6).
- Give a consumer who is not a customer the same notice before you disclose any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as R590-206-16 and R590-206-17 authorize (R590-206-5(1)(b)).
- Before you disclose nonpublic personal financial information about a consumer to a nonaffiliated third party, give an opt out notice that states you disclose or reserve the right to disclose it, that the consumer has the right to opt out and how, and allow a reasonable opportunity to opt out; do not disclose the information if the consumer opts out (R590-206-8 and R590-206-12).
- Do not disclose nonpublic personal health information about a consumer or customer without an authorization obtained before the disclosure, except for the insurance functions R590-206-18(2) lists; an authorization is written or electronic, states how long it is valid (not more than 24 months) and may be revoked at any time (R590-206-18 and R590-206-19).
- Do not discriminate against a consumer or customer because the person opted out from the disclosure of nonpublic personal financial information or did not authorize the disclosure of nonpublic personal health information (R590-206-24).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Utah Code 31A-2-308(1): a person who violates any insurance statute or rule shall forfeit to the state up to twice the amount of any profit gained from the violation, and the commissioner may order any person other than an individual producer, surplus line producer, limited line producer, managing general agent, reinsurance intermediary, adjuster, third party administrator, navigator, or insurance consultant to forfeit not more than $5,000 for each violation (not more than $2,500 for each of those listed). The $5,000 ceiling is recorded as per_violation_amount.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
Utah Commissioner of Insurance (Insurance Department), who may order a person that violates an insurance statute or rule to forfeit to the state up to $5,000 for each violation (Utah Code 31A-2-308(1)).
What this law does
The rule governs a licensee's treatment of an individual's nonpublic personal health information and nonpublic personal financial information, and applies to a licensee who obtains nonpublic personal financial information or nonpublic personal health information regarding a customer or consumer of a product or service primarily for a personal, family, or household purpose.
A licensee must provide a clear and conspicuous notice that accurately reflects its privacy policies and practices to a customer no later than when the licensee establishes a customer relationship, and to a consumer before it discloses any nonpublic personal financial information about the consumer to any nonaffiliated third party other than as the rule authorizes.
A licensee must provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices not less than once in a 12 consecutive month period during the continuation of the customer relationship.
A licensee may not, directly or through any affiliate, disclose nonpublic personal financial information about a consumer to a nonaffiliated third party unless it provides the consumer an initial notice, an opt out notice and a reasonable opportunity to opt out before the disclosure, and the consumer does not opt out.
A licensee may not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer before the disclosure, except for the insurance functions the rule lists. A licensee may not discriminate against a consumer or customer because the consumer or customer opted out from the disclosure of their nonpublic personal financial information or did not authorize the disclosure of their nonpublic personal health information.
The rule does not apply to a licensee with information about a person who obtains a product or service for a business, commercial, or agricultural purpose, to a financial institution, to a securities broker or dealer, or to a credit union that engages in an activity that does not require a license from the commissioner.
If a licensee complies with all requirements of the Health Insurance Portability and Accountability Act other than its effective date provision, the licensee is not subject to Sections R590-206-18 through R590-206-22. The rule's current text is effective .
When LexLint raises it
When your app profile says your app is an insurer.