Understand underwriting and privacy

What you will learn

• Distinguish medical evidence, consumer reports and the insurer's underwriting decision.
• Recognize when consumer-report permission, investigative-report disclosures and adverse-action notices matter.
• Separate financial privacy notices, medical-record authorization and HIV-test consent.
• Explain a producer's role in the insurer's anti-money-laundering program and interpret common risk classes.

Before you start

You should be able to distinguish the applicant, insured, producer and insurer, and explain why an application needs accurate answers. Keep L16's distinction in mind: collecting an application or premium is not the same as accepting the risk.

Underwriting asks whether an insurer will offer coverage and on what terms. Privacy rules ask a different question: how may information be obtained, used and shared? A sound insurance decision still needs a lawful information process.

Follow Maya's application

Maya applies for life insurance. Her producer helps her complete the form. The insurer's underwriter evaluates the information and decides what coverage and premium it can offer. An underwriter is a risk evaluator, not simply another name for the salesperson.

Medical evidence can include the applicant's health answers, an attending physician's statement about medical history, examination findings and laboratory results. Other evidence can include driving or financial information. These sources answer different questions; a driving record is not a medical examination.

Suppose Maya's insurer uses an accelerated process that does not initially require an examination. It still evaluates her application using other information. If those data are insufficient, it may require traditional underwriting. Change only the process, not the need to assess risk: no examination does not mean no underwriting or automatic acceptance.

Treat an information alert as a starting point

A consumer report is information supplied by a consumer reporting agency for purposes such as an insurance eligibility decision. It need not be a credit report. The FCRA, or Fair Credit Reporting Act, governs consumer-report use, including insurance underwriting.

MIB's Underwriting Services provide a useful example. Member insurers exchange coded information that can alert an underwriter to a difference between an application and previously reported information. The coded record is not the applicant's complete medical file. Under MIB's described process, the applicant receives notice and gives written authorization before the member searches or reports information.

Suppose Maya's application and an MIB alert do not agree. The insurer must investigate rather than decide adversely solely from that MIB record. If the investigation resolves the difference, the original alert is not an automatic denial. If additional evidence supports a different risk assessment, the insurer evaluates that evidence. Neither the producer nor the applicant should treat a code as a diagnosis or final decision.

Case: An application without an examination

Jon's insurer obtains authorized prescription information and evaluates his application without asking for a physical exam. His producer says, "No exam means they did not underwrite you." Is that explanation sound?

Know what triggers a consumer-report duty

Start by identifying the action being taken. Obtaining a report, ordering an investigative report and taking an adverse action are separate events.

• Before obtaining a consumer report, there must be a permissible purpose. Insurance underwriting involving the consumer is one such purpose; curiosity about a neighbor is not.
• A consumer report containing medical information requires the consumer's affirmative consent for the insurance transaction, subject to the statute's specific provisions. A permissible underwriting purpose alone does not replace this consent.
• An investigative consumer report involves personal interviews about matters such as character, reputation or manner of living. It has additional disclosure requirements, not merely the ordinary report-use rules.
• If a consumer report contributes to an adverse insurance decision, the adverse-action notice duty applies even when the report is only part of the reason.

For investigative reports, the requester must provide the required written disclosure no later than three days after first requesting the report. It must include the right to request more information and the required summary of rights. If the consumer makes a timely written request for the investigation's nature and scope, the response is due within five days after receiving that request or first requesting the report, whichever is later. The requester also certifies compliance to the reporting agency. These are the investigative-report rules, not a deadline for every insurance application.

An adverse action can include denial or a higher insurance charge. The notice identifies the reporting agency and its contact details, explains that the agency did not make the insurance decision, and describes the consumer's dispute and free-report rights. A report requested within 60 days of the notice is free under this provision. When a numerical credit score is used, additional score disclosures apply; this introductory description is not an exhaustive notice template.

Return to Maya. The insurer's decision to charge more rests mainly on verified medical evidence, but a consumer report also contributes. "Mainly" does not remove the notice duty. Change the fact: if no consumer report contributed, this particular FCRA trigger is absent. That does not establish that every other notice duty disappears.

Separate the three privacy questions

A privacy notice tells the customer how information is handled. An authorization permits a specified use or disclosure. Consent to a test concerns performing that test. One document should not be assumed to do all three jobs.

The Gramm-Leach-Bliley Act, or GLBA, addresses financial institutions' information practices and protection of sensitive customer information. It includes notice requirements and an opportunity to opt out of certain sharing with nonaffiliated third parties: organizations outside the institution's affiliated group. There are exceptions, including certain sharing needed to administer a requested transaction. Opt out therefore does not mean "stop every use of my information." Insurance regulation has its own applicable implementation; do not assume every FTC rule directly governs every insurer.

HIPAA is the Health Insurance Portability and Accountability Act. Its Privacy Rule applies to covered entities such as covered health-care providers and health plans, with obligations also applying to business associates. HHS identifies life insurers as outside those covered entities merely by being life insurers. That does not make an applicant's information unprotected.

Maya's covered medical provider may need a valid authorization before disclosing records to a life insurer when no other permission or requirement under the rule applies. The authorization identifies the information, the permitted parties and purpose, and an expiration date or event, among other required elements. The insurer's privacy notice is not a substitute for that authorization. Conversely, authorization to obtain specified records is not permission to circulate them without limits.

HIV testing adds a separate consent question. For example, Pacific Life's cited 2008 specimen application lists an HIV consent form among additional forms that may be necessary; the specimen does not make the ordinary application signature an all-purpose test authorization. Identify and follow the applicable testing consent, confidentiality and result-disclosure requirements before arranging a test. This example illustrates the document distinction, not a claim that the old specimen establishes a current Nevada consent rule.

Recognize your part in preventing money laundering

Money laundering seeks to make illicit funds appear legitimate. The USA PATRIOT Act and Bank Secrecy Act framework includes insurer anti-money-laundering, or AML, requirements. The insurance-company rule focuses on covered products, including nongroup permanent life insurance, nongroup annuities and other insurance products with cash-value or investment features. Ordinary term coverage without those features is outside that covered-product definition; this is not an exemption from all financial-crime laws.

The insurer maintains a written risk-based program with internal controls, a compliance officer, ongoing training and independent testing. Agents and brokers are integrated into that program. They do not need a separate insurer AML program solely because of this rule, but they must carry out their responsibilities within the insurer's program. Other roles, such as being a securities broker-dealer, may carry separate obligations.

Suppose a customer wants a cash-value policy, immediately asks about surrendering it at a loss, and wants the refund sent to an apparently unrelated person. Those facts warrant attention under the insurer's procedures; they do not prove a crime. The producer obtains and relays required information through the designated compliance process rather than ignoring the facts or inventing an accusation. Change the fact to an ordinary, documented transaction consistent with the customer's needs: the original suspicious pattern is no longer established. Apply the program to the facts, not a stereotype about the customer.

Read the offer, not just the class name

Risk classification groups applicants for underwriting purposes. Names and criteria vary by insurer, but these distinctions help you interpret an offer:

• Preferred indicates a more favorable assessed risk than the insurer's standard category.
• Standard means the insurer's ordinary risk category, not necessarily its lowest price.
• Substandard or rated means additional assessed risk; an offer may carry an extra premium or other permitted modification.
• Declined means the requested coverage is not offered. It is not simply another premium class.

Imagine Maya receives a rated offer at a higher premium. She has not received the standard offer she requested, but she has not necessarily been declined either. The producer should explain the actual terms rather than promise to change her classification. If the insurer instead declines, there is no offer to accept in that decision. Neither outcome tells us what every other insurer would decide.

Try the distinctions on new cases

Case: A small contribution

An insurer denies Lina's application. A consumer report contributes only a small part of the information used. Does the small contribution eliminate the FCRA adverse-action notice requirement?

Case: Three documents

Amir receives a financial privacy notice, signs an authorization allowing his covered physician to disclose specified records, and is asked for a separate testing-consent form. He says the privacy notice alone already authorized everything. What distinction is he missing?

Case: A producer's response

An agent selling an individual cash-value policy learns facts that her insurer's AML training identifies for referral. She says, "Only insurers need programs, so I can ignore this." What should change in her reasoning?

Case: Two underwriting outcomes

One applicant is offered the requested amount at an extra premium. A second is declined. Are these the same outcome?

Use a four-question check

• What information source is involved, and what permission is needed?
• What action triggers a notice or additional disclosure?
• Which responsibility belongs to the provider, insurer, reporting agency or producer?
• What does the insurer's actual offer say?

Keep these questions separate. A useful piece of evidence is not automatic permission to obtain it, and a lawful information process is not a promise of coverage.

Sources

FTC, Consumer Reports: What Insurers Need to Know: https://www.ftc.gov/business-guidance/resources/consumer-reports-what-insurers-need-know
FTC, Fair Credit Reporting Act, sections 603–606 and 615: https://www.ftc.gov/system/files/ftc_gov/pdf/fcra-may2023-508.pdf
HHS, Your Rights Under HIPAA: https://www.hhs.gov/hipaa/for-individuals/guidance-materials-for-consumers/index.html
45 CFR 164.508, authorization requirements: https://www.law.cornell.edu/cfr/text/45/164.508
FTC, Gramm-Leach-Bliley Act: https://www.ftc.gov/business-guidance/privacy-security/gramm-leach-bliley-act
15 USC 6802, disclosure and exceptions: https://www.law.cornell.edu/uscode/text/15/6802
FinCEN, Insurance AML FAQ, program and covered-product discussion: https://www.fincen.gov/resources/statutes-regulations/guidance/anti-money-laundering-program-and-suspicious-activity
31 CFR 1025.100 and 1025.210: https://www.law.cornell.edu/cfr/text/31/1025.210
NAIC, Accelerated Underwriting: https://content.naic.org/insurance-topics/accelerated-underwriting
Guardian, Life Insurance Underwriting: https://www.guardianlife.com/life-insurance/underwriting
MIB, A Consumer's Guide to Underwriting Services: https://mib.com/FR/webcontent/consumer_guide_english.pdf
Pacific Life, 2008 specimen application, additional submission forms: https://www.sec.gov/Archives/edgar/data/832908/000089256908000513/a38637exv99wx5y.htm