Understand underwriting and privacy

Introduction

When someone applies for life insurance, the insurer must decide whether to accept the risk and, if it does, at what price. That decision is underwriting. To make it, the insurer collects personal information, much of it sensitive. Several federal laws control how that information is gathered, shared and protected. A separate federal rule makes insurers guard certain products against misuse by criminals.

This lesson connects those pieces. For each step of an application, you will learn who decides, what information is used, which permission or notice applies, and what a producer does.

By the end of this lesson, you should be able to:

• Tell medical evidence, consumer reports and the underwriting decision apart, and explain what an MIB report can and cannot do.
• Apply introductory Fair Credit Reporting Act (FCRA) rules: a proper purpose for ordering a report, consent for medical information, investigative report disclosures and adverse action notices.
• Tell a GLBA privacy notice, a HIPAA authorization and an HIV test consent apart.
• Describe what the insurer must do and what the producer must do to help prevent money laundering.
• Compare preferred, standard, rated and declined outcomes.

Before you start: You should know the different roles of the applicant, owner, insured and beneficiary from Who is insured, who owns the policy, and who receives the money?. You should also know how an application and its receipts work from Complete an application accurately.

This lesson covers federal rules and general industry practice. Nevada law and each insurer's own procedures can add requirements. When they do, follow them as well. All people, cases and amounts in this lesson are fictional.

Underwriting is the insurer's risk decision

Underwriting means the insurer judges how risky it would be to insure a person. It then decides whether to offer coverage, how much to offer, and at what price. Plain English: underwriting is the insurer's "yes, no, or yes-at-this-price" decision.

The person who makes that decision is the underwriter, a trained risk specialist who works for the insurer. The producer (agent) is not the underwriter. A producer helps the client choose the type and amount of coverage, helps complete the application and submits it to the insurer. That is why a producer should never promise a client a particular price or approval. The producer does not make that decision.

Evidence comes in two broad kinds

The underwriter decides from evidence, meaning information about the proposed insured.

• Medical evidence describes the person's health. Examples are health answers on the application, a short paramedical exam (height, weight, blood pressure, blood and urine samples), statements from the person's doctors (often called attending physician statements), and prescription history.
• Nonmedical evidence describes everything else that affects risk. Examples are driving record, credit history, occupation, hobbies such as scuba diving or skydiving, travel plans, finances and public records.

Keep three ideas separate. Evidence is the information. A consumer report is one way some evidence reaches the insurer; it comes from an outside reporting company, as you will see below. The underwriting decision is the underwriter's conclusion after weighing the evidence. A report is an input. It is not the decision.

A connected example

Fictional case: Jordan, age 40, applies for a traditional life policy. Jordan answers health questions, completes a paramedical exam with blood and urine samples, and signs forms allowing the insurer to obtain medical records and other reports. The underwriter reviews the application, the lab results, Jordan's doctor's records and a driving record, then decides what to offer.

Change one fact: Jordan applies instead through an insurer's accelerated underwriting program. There is no exam and no blood or urine sample. The insurer still gathers outside data, such as prescription history, driving records, credit reports and MIB results, and uses models to judge the risk. The insurer has changed how it gathers evidence. It has not stopped judging risk. If the available data is not enough to judge Jordan's risk, Jordan can still be sent to the traditional process, including an exam.

Simplified issue policies also skip the exam. They use a shorter application, and they usually have lower coverage limits and higher premiums. Guaranteed issue coverage is different: an applicant who meets the product's eligibility conditions, such as its issue-age limits, does not go through individual medical underwriting and does not have to qualify on health. It usually pays only a small benefit, often enough for final expenses. Guaranteed issue does not mean anyone of any age can buy it, and the product's premiums still reflect the insurer's pricing of the risk it expects to cover.

The tempting mistake: "No exam means no underwriting." The exam is one source of evidence. Without it, accelerated and simplified issue programs still medically underwrite the individual applicant. Only guaranteed issue coverage skips individual health qualification, and only for applicants who meet its eligibility conditions.

Try it: Fictional case: Priya applies through a no-exam accelerated program. A friend tells Priya, "Since there's no exam, they aren't looking at your health." What is wrong with the friend's reasoning, and what could still happen to Priya's application?

Answer: Explanation

The friend is confusing the exam with underwriting. An accelerated program still assesses risk using outside data such as prescription history, driving records, credit reports and MIB results. If that data is not enough for the insurer to judge Priya's risk, Priya may be moved to traditional underwriting, which can include a physical exam and fluid samples.

Risk classes show what the decision looks like

When the underwriter approves an applicant, the underwriter assigns a risk class: a group of applicants with similar expected risk who are charged the same rate. Plain English: the risk class is the price tier the insurer places you in. Names and criteria vary by insurer, but the general order from most favorable to least favorable is:

• Preferred (some insurers also use "preferred plus"): better-than-average risk, so a lower rate.
• Standard (some insurers also use "standard plus"): a normal risk under the insurer's standards, insurable at its standard rates. This is the baseline. It is not the best class.
• Substandard, also called impaired or rated: higher-than-normal risk, for example because of a serious medical condition or a hazardous job. The insurer may still make an offer, using a higher premium, a special policy form or a waiver that excludes a specific risk. Many insurers express higher premiums as "table ratings."
• Declined: the insurer makes no offer.

Many insurers also use separate tobacco classes, which cost more than the matching non-tobacco classes.

The key difference is offer versus no offer. A rated applicant receives an offer that costs more or has modified terms. A declined applicant receives no offer.

Fictional case: Jordan hoped for preferred but is offered standard. Jordan is still approved, at the insurer's normal rate. Change one fact: Jordan has a serious heart condition. The insurer offers a rated policy with a higher premium. If Jordan accepts and meets the policy's delivery requirements, Jordan has coverage. Change it again: the risk is too high for this insurer's guidelines, so the insurer declines. Now there is no offer to accept.

Two tempting mistakes:

• "Standard means the best class." No. Standard is the baseline. Preferred classes are better.
• "Rated means rejected." No. A rated offer is still an offer, at a higher price or with modified terms.

Try it: Classify each fictional outcome as preferred, standard, rated or declined.

1. Ana is offered coverage at the insurer's normal rate for an average-risk applicant.
2. Ben is offered coverage at a higher premium because of a hazardous occupation.
3. Chris receives a letter saying the insurer will not issue any policy.
4. Dee is offered a rate below the insurer's normal rate because of excellent health history.

Answer: Explanation

1. Standard. Normal risk at the insurer's standard rates. Standard is not the top class.
2. Rated (substandard). Ben still has an offer. It costs more because the risk is higher than normal.
3. Declined. There is no offer at all. That is what separates a decline from a rating.
4. Preferred. Better-than-standard risk earns a discounted rate.

If you labeled Ben "declined," look again: a higher price is still an offer.

MIB: an alert, not a medical file

MIB is a reporting company used by member insurers that sell individually underwritten life, health, disability income, long-term care and critical illness insurance. Plain English: MIB is a coded cross-check that warns an insurer when an application may be missing something.

Here is how it works:

1. An earlier member insurer underwrote the person and found a condition or a hazardous activity that significantly affects risk. That insurer reported it to MIB as a code.
2. Later, the person applies to another member insurer. Before searching MIB, that insurer must give the applicant an MIB notice and obtain the applicant's written authorization.
3. The underwriter compares the MIB codes with what the applicant wrote on the application.

What an MIB record is not:

• It is not a medical file. MIB does not store medical records, lab results, doctors' statements, x-rays or EKGs. Its codes describe broad categories.
• It does not show what the earlier insurer decided (approval, decline or rating) or how much coverage was applied for.
• It holds no credit or payment history and uses no scoring system.
• It cannot be the sole basis for an adverse decision. If a code points to something the application did not mention, the underwriter must investigate further, for example by requesting medical records, before declining the applicant or charging more.

Fictional case: Sam's application says Sam has never been treated for a heart condition. The MIB search returns a heart-related code. The underwriter cannot decline Sam on the code alone, so the underwriter orders Sam's medical records. The records confirm a past heart condition, and the insurer makes a rated offer.

Change one fact: Sam fully disclosed the heart condition on the application. The MIB code now matches what Sam already reported. It tells the underwriter nothing new and should play little role in the decision. The records, not the code, drive the outcome.

Sam's first case leads into the next section. MIB is a consumer reporting agency, so its report is a consumer report. Because that report was part of the chain that led to a rated offer, Sam must receive an adverse action notice. You will learn what that notice contains below.

Try it: Fictional case: A coworker tells Riley, "If you have an MIB record, every insurer can see your full medical chart, and you'll be denied automatically." Correct both parts of the coworker's statement.

Answer: Explanation

First, MIB stores codes for broad categories of conditions and activities, not medical records, lab results or doctors' notes. Second, an insurer cannot make an adverse decision based only on an MIB record. If a code reveals something missing from the application, the underwriter must investigate further first. If Riley's application already disclosed the conditions behind the codes, the codes add nothing new.

Consumer reports and the FCRA

The Fair Credit Reporting Act (FCRA) is a federal law that protects the privacy and accuracy of information supplied by reporting companies.

A consumer reporting agency is a business that regularly gathers information about people in order to provide reports to others. A consumer report is information from such an agency about a person's credit, character, reputation, personal characteristics or way of living, used to help decide whether the person is eligible for something such as insurance. Plain English: a consumer report is an outside company's file on you, used to help an insurer decide about you.

A consumer report is not necessarily a credit report. It may cover credit history, but it may also cover medical conditions, driving record, criminal history or participation in dangerous sports. An MIB report is a consumer report that contains no credit information at all.

Rule 1: The insurer needs a proper purpose

Before obtaining a consumer report, the insurer must have a permissible purpose. For insurers, this generally means the report will be used to underwrite insurance involving that person, or the person has given permission.

Rule 2: Medical information needs the person's consent

If a consumer report contains medical information, the applicant must affirmatively consent before the reporting agency can provide it for an insurance transaction. Federal guidance says this consent can be oral, electronic or written. Some services require more: MIB, for example, requires written authorization before a member searches its database. After receiving medical information, the insurer may share it only to carry out the transaction it was obtained for, or as the law otherwise permits.

Notice that these are two separate requirements. Having an underwriting purpose does not replace the consent needed for medical information.

Rule 3: Investigative reports need disclosure and timing

An investigative consumer report is a consumer report, or part of one, in which information about the person's character, reputation, personal characteristics or way of living comes from personal interviews with neighbors, friends, associates or others who know the person. Plain English: someone is asking people who know you about you.

Because interviews are more intrusive, the insurer that orders one must:

• Tell the person in writing that such a report may be made. The disclosure must be mailed or otherwise delivered no later than three days after the report was first requested. It must include a statement of the person's right to ask for more detail and a written summary of the person's FCRA rights.
• Certify to the reporting agency that it made that disclosure and will answer follow-up requests.
• Explain the investigation if asked. If the person makes a written request within a reasonable time after receiving the disclosure, the insurer must make a complete and accurate written disclosure of the nature and scope of the investigation. That writing must be mailed or otherwise delivered no later than five days after the request is received or the report was first requested, whichever is later.

Both deadlines are for the insurer's action: mailing or otherwise delivering the writing. They do not promise that the person will have received it by that date.

Memory aid: 3 days to tell; 5 days to explain if asked.

Fictional timeline: An insurer first requests an investigative report on Taylor on March 2. The written disclosure must be mailed or otherwise delivered no later than March 5. Taylor sends a written request for details, which arrives March 20. The nature-and-scope disclosure must be mailed or otherwise delivered no later than March 25, because March 20 is later than March 2.

Try it: Fictional case: An insurer first requested an investigative consumer report on Jesse on May 10. Jesse's written request for the nature and scope of the investigation arrived on May 12. By what date must each disclosure be mailed or otherwise delivered?

Answer: Explanation

The first disclosure (that the report may be made) had to be mailed or otherwise delivered no later than May 13, three days after the report was first requested. For the nature-and-scope disclosure, compare the two trigger dates: the request arrived May 12 and the report was first requested May 10. The later date is May 12, so this disclosure must be mailed or otherwise delivered no later than May 17.

If you counted from May 10 and answered May 15, you used the earlier date. The rule uses whichever date is later.

Adverse action notices

In insurance underwriting, an adverse action includes denying or canceling coverage, increasing the charge, or reducing coverage or changing its terms unfavorably. This applies to coverage applied for and to existing coverage. Plain English: any decision that leaves the person with less coverage, worse terms or a higher price than they sought or had.

The rule: If an insurer takes an adverse action based in whole or in part on information in a consumer report, the insurer must notify the person. The notice is required even if the report played only a small part in the decision.

The notice may be oral, written or electronic, although many insurers send it in writing. It must give:

• the name, address and telephone number of the reporting agency that supplied the report, including a toll-free number if the agency operates nationwide;
• a statement that the agency did not make the decision and cannot explain the specific reasons for it;
• notice of the person's right to a free copy of the report from that agency, including the 60-day period for requesting it; and
• notice of the person's right to dispute the accuracy or completeness of the report with the agency.

If the insurer used a numerical credit score in the adverse decision, it must also disclose that score and related details about it.

Fictional case: Lee is offered a rated policy instead of the class applied for. The main reason is Lee's blood pressure readings from the paramedical exam. A driving record report from a reporting agency contributed only slightly. Because the report contributed in part, Lee must receive an adverse action notice.

Change one fact: The insurer reviewed the same driving record report but approved Lee at the class Lee applied for. Nothing adverse happened, so no adverse action notice is required.

The tempting mistake: "The report barely mattered, so no notice." The rule is "in whole or in part." A small contribution still counts.

Try it: Fictional case: Avery is declined. The underwriter says the decline was mostly because of a recent cancer diagnosis in Avery's medical records, but an MIB report started the investigation that uncovered it. Does Avery receive an adverse action notice? Name two things it must tell Avery.

Answer: Explanation

Yes. The MIB report is a consumer report, and it was part of the basis for the decline because it led to the investigation. The notice must include any two of the following: MIB's name, address and phone number (including its toll-free number); a statement that MIB did not make the decision and cannot explain the reasons; Avery's right to a free copy of the MIB report within 60 days; and Avery's right to dispute the report's accuracy or completeness with MIB.

Three privacy documents that answer three different questions

During an application, a client may receive or sign several privacy-related documents. They are easy to confuse because they all involve "privacy." Each one answers a different question.

GLBA privacy notice: "What does this company do with my information?"

The Gramm-Leach-Bliley Act (GLBA) applies to financial institutions, which include insurers. It requires them to explain their information-sharing practices to customers and to safeguard customer information with administrative, technical and physical protections.

Before sharing nonpublic personal information (private information about a customer) with an unrelated outside company, the institution must give a privacy notice. For many kinds of outside sharing, it must also give the customer a chance to opt out, which means to say "don't share it." Some sharing does not require an opt-out. Examples include sharing needed to process or service a transaction the customer requested, sharing with the customer's consent, reporting to a consumer reporting agency under the FCRA, preventing fraud, and complying with the law. A service company working for the institution can also receive information if the sharing is disclosed and the service company is contractually required to keep it confidential.

Plain English: the privacy notice tells you the company's practices. It is not you giving permission.

HIPAA authorization: "May my doctor release my health records to this insurer?"

HIPAA's privacy rules apply to covered entities: health plans (including health insurers), most health care providers, and health care clearinghouses. Their business associates must follow parts of the rules too.

Life insurers are not HIPAA covered entities just because they are life insurers. Federal guidance lists life insurers among the organizations that do not have to follow HIPAA's Privacy and Security Rules. Holding health information does not, by itself, make a life insurer a covered entity.

So why do life applicants sign HIPAA authorizations? Because the doctor or hospital is a covered entity. A covered provider generally cannot release a patient's health information without a valid written authorization, unless the rule otherwise permits or requires the release. The authorization lets the provider send records to the insurer.

A valid authorization must include at least:

• a specific description of the information to be released;
• who may release it;
• who may receive it;
• the purpose; and
• an expiration date or expiration event.

It is not valid if it has expired, is incomplete, is known to have been revoked, or contains material information known to be false. Any release must stay within what the authorization describes, so a signature does not give unlimited permission. A person may revoke an authorization in writing. Revocation does not undo actions already taken in reliance on it, and when the authorization was a condition of obtaining coverage, other law may still give the insurer the right to contest a claim or the policy.

HIV test consent: "May my sample be tested for HIV?"

A records authorization allows existing records to be released. Testing a blood or urine sample for HIV is a different act: it creates new medical information. That act calls for its own consent.

An insurer-specific example: Pacific Life's January 2008 specimen life application listed an "HIV Consent Form" among the additional forms that might be necessary with an application. That form was separate from the application itself and from the authorization to obtain information. In real cases, use the HIV consent form the insurer requires, and follow the consent, confidentiality and results-handling rules that apply where the application is taken. This lesson does not state a Nevada-specific HIV testing rule.

Compare the three

• GLBA privacy notice answers: What does this financial company do with my information, and what sharing can I opt out of? It informs; it does not authorize.
• HIPAA authorization answers: May a covered provider release these specific health records to this recipient, for this purpose, until this date or event?
• HIV test consent answers: May my sample be tested for HIV?

These are different documents with different jobs. They are not competing versions of one permission.

Fictional case: Morgan receives the insurer's privacy notice and signs the application, a HIPAA authorization for Morgan's clinic, and the insurer's HIV consent form. The clinic may send the described records, and the lab may run the HIV test.

Change one fact: Morgan signed only the application and the HIPAA authorization. The insurer's requirements call for an HIV test. The records authorization does not cover the test, so the insurer's HIV consent form is still needed before testing.

Try it: Identify the mistake in each fictional statement.

1. "Kai got the insurer's privacy notice and didn't opt out, so Kai's doctor can now send Kai's records to the insurer."
2. "The life insurer holds Quinn's lab results, so HIPAA's Privacy Rule now covers the life insurer."

Answer: Explanation

1. A GLBA privacy notice explains the insurer's information practices. Not opting out is not an authorization. Kai's doctor, a covered provider, generally needs a valid HIPAA authorization from Kai before releasing records to the insurer.
2. Holding health information does not make a life insurer a HIPAA covered entity. Covered entities are health plans, most health care providers and clearinghouses. Federal guidance lists life insurers among organizations not required to follow HIPAA's privacy and security rules. Other laws, such as the FCRA's limits on sharing medical information, still apply.

Anti-money laundering: who does what

Money laundering means making money from crime look legitimate by moving it through legitimate financial products. Plain English: using a real financial product to clean dirty money. Insurance products with a cash value or investment feature can hold money and later pay it back out, which makes them attractive to launderers.

Which products the insurer rule covers

The federal anti-money laundering (AML) rule for insurers applies to covered products:

• permanent life insurance, other than group life;
• annuities, other than group annuities; and
• any other insurance product with cash value or investment features.

Products such as group insurance, term life (including credit life), property, casualty, health and title insurance are not covered products under this rule.

"Not a covered product under this rule" does not mean "no rules apply." Other laws in this lesson, such as the FCRA and GLBA, still apply, and an insurer may choose to apply its AML program to all of its products. Follow the insurer's procedures for every sale.

What the insurer must do

An insurer that issues covered products must have a written, risk-based AML program approved by senior management. Risk-based means the program puts more effort where the risk is greater. At a minimum, the program includes:

• Policies, procedures and internal controls based on the insurer's assessment of its risks. These must include integrating its agents and brokers into the program and obtaining the customer information needed for an effective program.
• A compliance officer responsible for running the program, keeping it updated, making sure the right people are trained, and monitoring agents' and brokers' compliance.
• Ongoing training for appropriate people. The insurer may train producers directly or verify that they received adequate training elsewhere.
• Independent testing of the program, including whether agents and brokers are meeting their obligations under it.

What the producer must do

The producer does not need to create a separate AML program under the insurer rule. However, the producer still has duties: the producer is part of the insurer's program and must follow it. A producer meets customers directly, so the producer often knows the most about the source of the money and why the client is buying the product. In practice, the producer:

• completes the training the insurer requires;
• collects the customer identification and other information the insurer's procedures require; and
• watches for red flags and reports concerns through the insurer's procedures.

The insurer monitors producers' compliance and may end its relationship with a producer who will not comply. A producer who is also a registered securities broker-dealer may have separate obligations under other rules.

Examples of red flags include:

• a product that does not fit the customer's needs;
• unusual payment methods, such as cash where cash is unusual;
• early cancellation, especially at a cost to the customer, or a refund sent to an apparently unrelated third party;
• transferring the policy's benefit to an apparently unrelated third party;
• little interest in investment performance but strong interest in how to cancel early;
• reluctance to give identifying information, or information that seems minimal or made up; and
• borrowing the maximum amount soon after purchase.

Two tempting mistakes:

• "The producer must build a separate AML program." No. The insurer builds and is responsible for the program, and the producer works inside it.
• "AML is the insurer's job, so the producer has no duties." Also no. The insurer must integrate producers into its program, and producers must follow it.

Fictional case: Casey wants a large individual annuity, wants to pay in cash, shows little interest in how the annuity will perform, and asks several questions about canceling early and sending the refund to a business Casey doesn't seem connected to. The annuity is a covered product, and several red flags are present. The producer follows the insurer's AML procedures, collects the required information and reports the concerns as those procedures direct.

Change one fact: Casey instead applies for an individual term policy with no cash value. Term life is not a covered product under the insurer AML rule. The producer still follows the insurer's procedures and all other applicable laws.

Try it: Fictional case: A new producer says, "I sell whole life and individual annuities, so I need to write my own AML program and file my own compliance plan with the government." Is the producer right? What should the producer actually do?

Answer: Explanation

The producer is not right. Whole life and individual annuities are covered products, but the AML program duty under the insurer rule belongs to the insurer, which must integrate its agents and brokers into its program. The producer should complete the insurer's AML training, gather the customer information the insurer requires, watch for red flags and report concerns through the insurer's procedures. If the producer has another role, such as a broker-dealer registration, separate rules may apply to that role.

Practice on your own

Answer each question before opening its explanation. All cases are fictional.

Question 1. Robin's application is approved, but at a higher premium than the class Robin applied for. A credit-based report from a reporting agency was one of several factors. The underwriter says the report "barely mattered." What must the insurer do, and why?

Answer: Explanation

The insurer must give Robin an adverse action notice. A higher charge than applied for is an adverse action, and the decision was based in part on a consumer report. A small contribution still triggers the notice. If the insurer used a numerical credit score in the decision, it must also disclose that score and related details.

Question 2. An insurer wants a reporting agency to interview Drew's neighbors about Drew's lifestyle. What must the insurer do before or shortly after requesting the report, and what must it do if Drew sends a written request for details?

Answer: Explanation

This is an investigative consumer report because it relies on personal interviews. The insurer must mail or otherwise deliver a written disclosure no later than three days after first requesting the report, including a statement of Drew's right to request more details and a summary of Drew's rights. It must also certify to the agency that it made the disclosure and will comply with follow-up requests. If Drew sends a written request within a reasonable time, the insurer must make a complete and accurate written disclosure of the nature and scope of the investigation, mailed or otherwise delivered no later than five days after the later of the date it received the request or the date the report was first requested.

Question 3. A client asks, "My friend got a 'standard' rating. Is that the best one?" How do you answer accurately?

Answer: Explanation

No. Standard is the insurer's baseline for a normal risk, charged at standard rates. Preferred classes are more favorable and cost less. Substandard (rated) classes cost more or have modified terms. Class names and criteria vary by insurer.

Question 4. A life insurer's underwriting form says the applicant authorizes "release of medical records." The insurer's requirements call for HIV testing. Is the records authorization enough?

Answer: Explanation

It should not be treated as enough. A records authorization covers releasing existing records. HIV testing is a separate act that creates new information. Use the HIV consent form the insurer requires, as in the Pacific Life specimen that listed a separate HIV consent form, and follow the consent and confidentiality rules that apply.

Question 5. An insurer wants to search MIB for Ellis. What must happen first? If the search shows a code for a condition Ellis didn't report, can the underwriter decline Ellis right away?

Answer: Explanation

The insurer must first give Ellis an MIB notice and get Ellis's written authorization. Because MIB reports can contain medical information, the FCRA also requires Ellis's affirmative consent. The underwriter cannot decline on the code alone. The underwriter must investigate further, for example by obtaining medical records, before making any adverse decision.

Question 6. Sort these into "covered product under the insurer AML rule" or "not a covered product under that rule": an individual whole life policy, a group term life plan, an individual deferred annuity, an individual 20-year term policy.

Answer: Explanation

Covered: the individual whole life policy (permanent, not group) and the individual deferred annuity (not group). Not covered under that rule: the group term life plan (group, and term) and the individual 20-year term policy (term with no cash value). "Not covered" does not mean no rules apply. Follow the insurer's procedures and other applicable laws for every sale.

What to remember

• Underwriting is the insurer's decision about whether to offer coverage, how much and at what price. The underwriter decides; the producer helps the client apply. "No exam" changes how evidence is gathered, not whether risk is judged. Only guaranteed issue skips individual medical underwriting, and only for applicants who meet the product's eligibility conditions.
• Risk classes: preferred is better than standard. Standard is the baseline. Rated means an offer at a higher price or with modified terms. Declined means no offer.
• MIB gives coded alerts, not medical files. It requires notice and written authorization before a search, and it can never be the sole basis for an adverse decision.
• Consumer reports are broader than credit reports. Insurers need a permissible purpose, plus affirmative consent when a report contains medical information.
• Investigative reports: the written disclosure must be mailed or otherwise delivered within 3 days of the first request, and the nature-and-scope disclosure must be mailed or otherwise delivered within 5 days of the later trigger date.
• Adverse action notice: required when a report contributes in whole or in part, even slightly. It names the reporting agency, says the agency didn't decide, and explains the free-report (60-day) and dispute rights.
• GLBA notice explains information sharing and opt-outs; it is not permission. A HIPAA authorization lets covered providers release specific records. Life insurers are not HIPAA covered entities merely because they hold health data. HIV testing needs its own consent under the insurer's requirements and applicable law.
• AML: the insurer runs a written, risk-based program for covered products (non-group permanent life, non-group annuities and other cash value or investment products). Producers don't build their own program under that rule, but they must train, collect the required information and report red flags through the insurer's procedures.