Law / United States / 
Virginia
Insurance Information and Privacy Protection
Officially Insurance Information and Privacy Protection: notice, access and correction, adverse underwriting decisions and disclosure limits
Va. Code Ann. §§ 38.2-600 to 38.2-619
In force.
A data subject rights rule binding private bodies.
- Obligation class
- Disclosure, Data subject rights, Consent, Prohibition
As of .
What it requires
- If you are an insurance institution, agent or insurance-support organization subject to the article, do not use or authorize a pretext interview to obtain information in connection with an insurance transaction, except to investigate a claim where there is a reasonable basis, shown by specific information available for review by the Commission, for suspecting criminal activity, fraud, material misrepresentation or material nondisclosure, and then only to interview a person or institution with no privileged relationship with the person the information concerns (section 38.2-603).
- If you are an insurance institution or agent, give each applicant or policyholder a written (or, if the person agrees, electronic) notice of insurance information practices at the times section 38.2-604 sets, stating whether personal information may be collected from persons other than the individual, the types of information, sources and investigative techniques, the disclosures made without authorization, the access and correction rights, and that an insurance-support organization may retain and disclose its report; an abbreviated notice may be given instead, with the full notice furnished on request (section 38.2-604).
- Clearly specify the questions designed to obtain information solely for marketing or research purposes, and use a disclosure authorization form only if it is in plain language, dated, and states the types of persons authorized to disclose, the nature of the information, the recipients, the purposes, how long it is valid, and the right to a copy (sections 38.2-605 and 38.2-606).
- Do not prepare or request an investigative consumer report for an application, renewal, reinstatement or change in benefits unless you inform the individual that the individual may request an interview and may receive a copy of the report (section 38.2-607).
- On an individual's written request after proper identification, within 30 business days tell the individual the nature and substance of recorded personal information, let the individual see and copy it, disclose to whom it was disclosed in the previous two years, and provide a summary of the correction procedures; supply medical-record information directly or through a medical professional the individual designates (section 38.2-608).
- Within 30 business days of a written request to correct, amend or delete recorded personal information, either do so and notify the individual and the designated recipients the section names, or notify the individual of the refusal, the reasons and the right to file a statement of disagreement, then file and pass on that statement with any later disclosure (section 38.2-609).
- After an adverse underwriting decision, give written notice with the specific reasons (or advise that they may be requested in writing) and a summary of the individual's rights, and on a written request within 90 business days furnish within 21 business days the specific reasons, the specific items of personal and privileged information that support them, and the names and addresses of the institutional sources (section 38.2-610).
- Do not seek information about a previous adverse underwriting decision or earlier residual market coverage unless the inquiry also asks for the reasons, and do not base an adverse underwriting decision on the fact of a previous adverse decision, earlier residual market coverage, personal information received from an insurance-support organization whose primary source is insurance institutions, or the fact of earlier coverage from a particular insurer or agent (sections 38.2-611 and 38.2-612).
- Do not disclose medical-record information or privileged information about an individual collected or received in connection with an insurance transaction without the individual's written authorization, and disclose other personal information only within the grounds section 38.2-613(B) and (C) list (section 38.2-613).
- If you issue accident and sickness insurance of the kind section 38.2-613(D) names, do not disclose genetic information about an individual or a family member collected or received in connection with an insurance transaction unless the individual authorizes it in writing (section 38.2-613(D)).
- Do not knowingly and willfully obtain information about an individual from an insurance institution, agent or insurance-support organization under false pretenses (section 38.2-619).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Section 38.2-619: a person who knowingly and willfully obtains information about an individual from an insurance institution, agent or insurance-support organization under false pretenses is fined not more than $10,000, jailed for not more than 12 months, or both.
Penalty structure
Section 38.2-218: a person who knowingly or willfully violates any provision of Title 38.2 is punished for each violation by a penalty of not more than $5,000, and a person who violates a provision without knowledge or intent may be punished for each violation by a penalty of not more than $1,000, with a series of similar violations from the same act limited to $10,000 in the aggregate. The knowing or willful ceiling is recorded as per_violation_amount.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
State Corporation Commission, which may examine and investigate any insurance institution or agent doing business in the Commonwealth, and any insurance-support organization that acts on behalf of an insurance institution or agent, to determine whether it has engaged in conduct that violates the article (section 38.2-614).
Settledness
- As of
- Open questions
- Does the article's limit to insurance purchased "primarily for personal, family or household purposes" leave a sole proprietor's policy for business use outside every right and duty in the article?
What this law does
The article binds insurance institutions, agents and insurance-support organizations that, for life or accident and sickness insurance, collect, receive or maintain information about Virginia residents or engage in transactions with Virginia residents, and, for property or casualty insurance, handle information about or engage in transactions on policies delivered, issued for delivery or renewed in the Commonwealth.
The article applies only to insurance purchased primarily for personal, family or household purposes. No insurance institution, agent or insurance-support organization may use or authorize the use of pretext interviews to obtain information in connection with an insurance transaction, subject to an exception for investigating a claim. An insurance institution or agent must give every applicant or policyholder a notice of insurance information practices, at the times section 38.2-604 sets.
On a written request after proper identification, the holder must within 30 business days tell the individual the nature and substance of recorded personal information, let the individual see and copy it, disclose to whom it was disclosed within two years, and summarize the correction procedures.
Within 30 business days of a written request to correct, amend or delete recorded personal information, the holder must either do so or notify the individual of its refusal, the reasons and the right to file a statement. After an adverse underwriting decision, the insurance institution or agent responsible must give a written notice that provides the specific reasons or advises that they may be requested in writing, together with a summary of the individual's rights.
On a written request within 90 business days of the notice, the insurance institution or agent must furnish within 21 business days the specific reasons, the specific items of personal and privileged information that support them, and the names and addresses of the institutional sources.
An insurance institution, agent or insurance-support organization may not disclose medical-record information or privileged information about an individual collected or received in connection with an insurance transaction without the individual's written authorization.
A person proposing to issue accident and sickness insurance of the kind section 38.2-613(D) names may not disclose genetic information about an individual or a family member collected or received in connection with an insurance transaction unless the disclosure is made with the individual's written authorization. A person whose rights under sections 38.2-608, 38.2-609 or 38.2-610 are violated may apply to a court of competent jurisdiction for appropriate equitable relief.
An entity that discloses information in violation of section 38.2-613 is liable for the damages sustained by the individual, which may not exceed the actual damages. Except as section 38.2-617 specifically provides, there is no remedy or recovery for individuals, in law or in equity, for a violation of any provision of the article.
The State Corporation Commission may examine and investigate any insurance institution or agent doing business in the Commonwealth to determine whether it has engaged in conduct that violates the article. Section 38.2-218 of the Code of Virginia punishes a knowing or willful violation of any provision of Title 38.2 by a penalty of not more than $5,000 for each violation.
A person who knowingly and willfully obtains information about an individual from an insurance institution, agent or insurance-support organization under false pretenses is fined not more than $10,000 or jailed for not more than 12 months, or both. Chapter 264 of the 2020 Acts of Assembly amended and reenacted sections 38.2-600, 38.2-601, 38.2-602, 38.2-612.1, 38.2-612.2, 38.2-613 and 38.2-614 through 38.2-618.
When LexLint raises it
When your app profile says your app is an insurer.