Applications, underwriting information and privacy: what the insurer asks, how it decides, and how it protects what it learns

Introduction

Before an insurer agrees to cover a home, it needs facts about the home and the person applying. Those facts come from the application (the form of questions the applicant answers) and, sometimes, from outside reports. The insurer uses them for underwriting: deciding whether to accept the risk and on what terms.

This lesson follows that information through four steps:

1. What the applicant says.
2. What happens in Nevada if an answer turns out to be wrong.
3. When the insurer may pull an outside report, and what it must tell the applicant afterward.
4. How the insurer must protect and limit sharing of what it has learned.

What you'll be able to do

• Tell a representation, a warranty and concealment apart, and explain how Nevada treats statements in an application.
• Say why an insurer asks for underwriting information, and recognize when a request has no proper purpose.
• Decide whether a consumer report may be obtained, and recognize when an adverse-action notice is required.
• Identify the federal privacy safeguards, the notice and opt-out rule for sharing, and the exceptions to that rule.
• Explain what happens when application information is incomplete or inaccurate.

Before you start: This lesson builds on Contract formation and the policy map, especially the idea that the application is part of how the insurance contract comes together.

Applications and underwriting: the facts the insurer uses to decide

Underwriting is the insurer deciding whether to take on a risk and on what terms. Nevada's statute on application statements names the decisions those facts can affect:

• whether to issue the policy at all
• what premium (price) to charge
• how large a policy to issue
• whether to cover a particular kind of danger

Appropriate underwriting information is information that bears on one of those decisions. "Why are you asking?" should have an answer tied to accepting, pricing, sizing or shaping coverage.

Example (fictional). Dana Ortiz applies for a homeowners policy on a house in Henderson. In this example, the insurer's application asks whether Dana lives in the house or rents it out. The policy assumption is that this insurer prices rented homes differently from owner-occupied homes. The question is appropriate because the answer changes the price. Not every insurer asks the same questions or weighs occupancy the same way. The question matters here because of this insurer's stated rule.

When the applicant doesn't know an answer. The application also asks for the roof's age, and Dana doesn't know it. The producer (the licensed person taking the application) is tempted to write "about 10 years" to finish the form. That guess would become an incorrect statement in the application.

Unknown facts call for clarification, not a made-up answer. The insurer is deciding based on what the application says. An invented answer replaces a true fact with a guess, and the next section shows how a wrong answer can matter later.

A related point: information can be inaccurate even when nobody guessed. A form can contain a typo, and an outside report can contain errors. Later sections show how the law handles both.

Check: A producer asks an applicant for a homeowners policy, "What's your favorite sports team?" and records the answer on the application. Is this appropriate underwriting information?

Representation, warranty or concealment: a factual answer, a guarantee, or a withheld fact

These three terms describe different ways information enters, or stays out of, an application.

Representation: a statement of fact the applicant gives the insurer. It is the applicant saying, "Here is the fact."

• Example: Dana writes, "The house was built in 2009."
• Why it fits: Dana is stating a fact so the insurer can make its decision.

Warranty: a guarantee that a statement is true. It is a stronger promise than a representation. The person is vouching for the statement, not just reporting it.

• Example: a form that says, "Applicant guarantees every answer is exactly correct."
• Why the label matters in Nevada: Nevada law says every statement and description in an application, by or for the insured, is treated as a representation, not a warranty. Wording on the form that calls the answers guarantees does not turn them into warranties.

Concealment: withholding a fact. It is staying silent about something rather than saying something false.

• Example: Dana knows the garage was converted into a rented studio and leaves that out.
• Why it fits: no false sentence was written. A fact was kept from the insurer.
• Qualification: whether the withholding was deliberate is a separate question. The fraud test in the next section asks it.

Compare the neighboring terms:

• Representation asks: What fact did the applicant state?
• Warranty asks: Did someone guarantee the statement is true?
• Concealment asks: What fact was kept back?

In Nevada, the answers in an application fall under the representation rules. Concealment and omissions (things left out) are judged by the same Nevada test as false statements.

Check: An application's fine print says, "The applicant warrants that all answers above are true." A Nevada applicant signs it. Are the answers warranties?

When a wrong answer can block payment under Nevada law

Under NRS 687B.110, misrepresentations, omissions, concealment of facts and incorrect statements do not prevent recovery under the policy unless at least one of these is true:

1. Fraudulent. The statement or withholding was fraud.
2. Material. It was important to the insurer's decision to accept the risk, or to the danger the insurer took on.
3. Would have changed the insurer's decision. If the true facts had been known, the insurer in good faith would have: - not issued the policy, or - not issued it at the same premium, or - not issued it in as large an amount, or - not covered the kind of danger that caused the loss.

The basic idea: an error does not automatically defeat a claim. The question is whether the error was fraudulent, or whether it mattered to the insurer's decision.

Worked example. Dana wrote that the house was built in 2009, but it was built in 2008. Assume no fraud. Also assume this insurer treats 2008 and 2009 homes identically, so the true year would not have changed acceptance, price, amount or coverage.

• Ground 1: not met (no fraud).
• Ground 2: not met (the year did not matter to the decision).
• Ground 3: not met (the insurer would have decided the same way).

Result: the error does not prevent recovery.

Change one fact. Dana instead wrote that they live in the house, but they rent the whole house to tenants. Keep the stated policy assumption: this insurer charges a higher premium for rented homes. Dana honestly misunderstood the question, so there was no fraud.

• Ground 3: met. With the true facts, the insurer in good faith would not have issued the policy at the same premium.

Result: this misstatement can prevent recovery, even though it was honest.

Two tempting mistakes:

• "Any wrong answer cancels the coverage." No. An error that is not fraudulent and does not matter to the decision does not prevent recovery.
• "Honest mistakes never count." Also no. Grounds 2 and 3 do not require fraud. An honest error that changes the insurer's decision can still prevent recovery.

Check: An applicant leaves blank a question about whether the home has a wood-burning stove. The applicant forgot it was there. Assume this insurer would have refused to cover fire from such a stove if it had known, and a fire starts at the stove. Does the omission matter under Nevada's rule?

Consumer reports (outside reports about a person): only for a permitted purpose

A consumer reporting agency is an outside company that compiles information about people and furnishes it in reports. A consumer report is one of those reports about a particular person. A credit report is one familiar kind. These terms come from the federal Fair Credit Reporting Act (FCRA).

The rule (15 U.S.C. § 1681b): a consumer reporting agency may furnish a report only for purposes the law lists. A person may not obtain or use a consumer report unless:

• it is for one of those listed purposes, and
• the purpose has been certified to the agency.

Two listed purposes matter in this lesson:

• Insurance underwriting. The user intends to use the information in underwriting insurance that involves that consumer.
• The consumer's written instructions. The consumer has asked in writing for the report to go to that person.

Worked example. Dana's insurer obtains a report on Dana to underwrite Dana's homeowners application. That is a listed purpose: underwriting insurance involving the consumer. The report is permissible.

Change one fact. The producer looks up Dana's neighbor, who has not applied for anything, just to see their history. Curiosity is not a listed purpose, so obtaining or using that report is not permitted.

Tempting mistake: borrowing the employment rules. The FCRA has a separate procedure for reports used for employment (hiring and similar decisions): a standalone written disclosure plus the person's written authorization. That procedure belongs to employment purposes. It is not the federal requirement for every insurance underwriting report. Don't import the employment checklist into an insurance question. Nevada does add its own disclosure rule for some insurance, covered next.

Check: An insurer wants a consumer report on someone who has asked it in writing to obtain the report. The person has not applied for insurance. Is there a permissible purpose?

Nevada's credit disclosure: telling the applicant up front

Credit information here means information drawn from a person's credit history, such as a credit report. A credit-based insurance score is a score built from credit-report information.

Where this rule applies: Nevada's credit-information rules (NRS 686A.600 to 686A.730) do not apply to surety insurance or to any commercial or business policy. This lesson's examples use a personal homeowners policy, which is not excluded.

The rule (NRS 686A.700(1)): if an insurer uses credit information in underwriting or rating an applicant (rating means setting the price), the insurer or its agent must tell the applicant that the insurer may obtain credit information in connection with the application.

• When: either on the application itself or at the time the application is taken.
• How: in writing, or in the same medium as the application. A phone application gets the disclosure by phone.
• Renewal exception: the insurer need not repeat the disclosure at renewal if the policyholder already received it in connection with that policy.

This is a disclosure, meaning the insurer tells the applicant. This section does not describe it as a request for permission.

Worked example. Dana applies by phone for a personal homeowners policy, and the insurer uses credit information in pricing. The agent tells Dana on that call that the insurer may obtain credit information. The disclosure came at the time of application and in the same medium as the application, so it satisfies the rule.

Change one fact. Dana instead applies for a commercial policy for Dana's bakery. NRS 686A.670 says these credit-information sections do not apply to commercial or business policies, so this Nevada disclosure rule does not govern that application.

Check: Dana received the credit disclosure when applying last year. The same policy is now renewing. Must the insurer give the disclosure again?

Adverse-action notice (the required explanation after an unfavorable decision): when a report played a part

An adverse action is an unfavorable decision about a consumer. Its full legal definition is in a section not covered here. In this lesson's examples, a denial of the application is treated as an adverse action.

Federal rule (15 U.S.C. § 1681m(a)): if any person takes an adverse action based in whole or in part on information in a consumer report, that person must give the consumer four things:

1. Notice of the adverse action, orally, in writing or electronically.
2. Credit score disclosure, in writing or electronically, if a numerical credit score was used. This includes the score and related information the law requires.
3. The reporting agency's contact details (name, address and phone number, including a toll-free number for nationwide agencies), plus a statement that the agency did not make the decision and cannot give the specific reasons for it.
4. Notice of the consumer's rights: - to get a free copy of the report from that agency, including notice of the 60-day period for requesting it, and - to dispute the accuracy or completeness of information in the report with the agency.

Why the agency statement matters: the agency supplied information; the insurer made the decision. Item 4 matters because reports can contain errors, and the consumer needs a way to see and correct them.

Nevada additions (NRS 686A.710). Where Nevada's credit-information rules apply and the insurer takes adverse action based on credit information, the insurer must:

• give the federal notice described above, and
• explain the reasons in language clear and specific enough that a person can identify the basis for the decision.

The Nevada explanation must:

• describe no more than four factors that were the primary influences on the decision,
• avoid vague labels alone. "Poor credit history," "poor credit rating" and "poor insurance score" do not meet the requirement, and
• use a form approved by the Nevada Commissioner of Insurance.

Worked example. Dana's personal homeowners application is denied, partly because of Dana's credit-based insurance score.

• Federal trigger: met. "In part" is enough, so the four federal items are required.
• Nevada trigger: met. This is a personal policy, and the denial was based on credit information. The insurer must also give clear, specific reasons naming up to four primary factors, on a Commissioner-approved form.

Change one fact. Dana is denied based only on Dana's own application answers and an inspection by the insurer's own employee. No consumer report was used. The consumer-report notice in § 1681m(a) is not triggered, because the decision did not rest on information in a consumer report.

Tempting mistakes:

• "The report played only a small part, so no notice is needed." Wrong. "In whole or in part" includes a partial role.
• "The reporting agency turned me down." Wrong. The notice itself must say the agency did not make the decision.

Check: A Nevada homeowners denial letter says only, "Denied due to poor insurance score." It names the reporting agency and includes its contact details. What Nevada requirement is clearly unmet?

Privacy safeguards (protections for customer records) and sharing limits

Policy assumption for this section: assume the insurer in these examples is a "financial institution" covered by the federal financial privacy provisions in 15 U.S.C. §§ 6801–6802 (part of the Gramm-Leach-Bliley Act).

Nonpublic personal information is, in plain terms, private customer information. Its full legal definition is in a section not covered here.

The continuing duty to protect

Under § 6801(a), Congress declared that each financial institution has an affirmative and continuing obligation to:

• respect its customers' privacy, and
• protect the security and confidentiality of their nonpublic personal information.

"Affirmative" means the institution must take active steps, not just avoid misconduct. "Continuing" means the duty does not end once the policy is sold.

Under § 6801(b), the regulators named in the law set standards for three kinds of safeguards:

• Administrative: rules and practices for people, such as limiting which employees may open customer files.
• Technical: protections built into systems, such as password-protected records.
• Physical: protections for places and things, such as locked file storage.

These examples illustrate the categories. The statute itself does not list specific tools. Those standards must serve three goals:

1. Keep customer records secure and confidential.
2. Protect against anticipated threats or hazards to the records' security or integrity.
3. Protect against unauthorized access or use that could cause substantial harm or inconvenience to a customer.

The rule for sharing with outside companies

A nonaffiliated third party is an outside company that is not part of the institution's own corporate family.

Under § 6802(a)–(b), before sharing nonpublic personal information with a nonaffiliated third party, the institution must:

• give the consumer a privacy notice that meets the federal requirements,
• clearly and conspicuously tell the consumer the information may be shared with such a third party,
• give the consumer a chance, before the information is first shared, to say it must not be shared, and
• explain how to use that option.

This is an opt-out: the consumer gets the chance to say no. It is not affirmative consent, where nothing happens until the consumer says yes. Under this rule, the institution does not need a yes. It must offer a real chance to say no before sharing.

Exceptions: sharing that does not need notice and opt-out

Under § 6802(e), the notice and opt-out rules do not block certain disclosures. The exceptions include:

• Transactions: disclosure needed to carry out, administer or enforce a transaction the consumer requested or authorized, or to service or process a product the consumer requested.
• Consent: disclosure with the consumer's consent or at the consumer's direction.
• Protection: disclosure to protect the confidentiality or security of records, or to protect against or prevent actual or potential fraud, unauthorized transactions, claims or other liability.
• Legal requirements: disclosure to comply with laws, a properly authorized investigation, subpoena or summons, or regulators with authority over the institution.

Worked example. The insurer wants to give Dana's name and policy details to an unrelated home-décor company for that company's marketing. Assume no exception applies. The insurer must give the notice, the clear disclosure, the chance to opt out before the first disclosure, and an explanation of how to opt out.

Change one fact. The insurer instead shares Dana's claim information with an investigator to check a suspected fraudulent claim. Preventing actual or potential fraud is a listed exception, so the notice and opt-out requirements do not block this disclosure.

Tempting mistakes:

• "Every sharing needs the customer's yes." No. The basic rule is notice plus a chance to opt out, and some disclosures fall under exceptions.
• "Sending a notice is enough." Also no. Where the rule applies, the consumer must also get the chance to opt out before the first disclosure and an explanation of how.

Check: A state insurance regulator examining the insurer requests certain customer records. Must the insurer first give customers a chance to opt out?

Three notices that are easy to mix up

• Nevada credit disclosure (NRS 686A.700): When is it given? At or on the application, before any decision. What does it say? That the insurer may obtain credit information.
• Adverse-action notice (15 U.S.C. § 1681m(a), plus NRS 686A.710 where it applies): When is it given? After an unfavorable decision that relied, in whole or in part, on report information. What does it say? What happened, who supplied the report, and the consumer's rights to a copy and a dispute. In Nevada, it also gives specific reasons.
• Privacy sharing notice and opt-out (15 U.S.C. § 6802): When is it given? Before nonpublic personal information is first shared with an outside company, unless an exception applies. What does it say? That sharing may happen, and how to say no.

Practice on your own

Practice 1: Wrong answer, honest applicant

Sam applies for a homeowners policy and answers yes to "Is the alarm system professionally monitored?" Sam honestly believes it is, but the monitoring contract ended years ago. Assume this insurer gives a lower premium only for monitored alarms and would have charged more with the true facts. A burglary loss occurs. Can the incorrect answer prevent recovery in Nevada?

Practice 2: Missing fact, guessed answer

An applicant doesn't know whether the home has had prior losses and leaves the question blank. To finish quickly, the producer writes "None." What is wrong with this, and what is the right approach?

Practice 3: Three report requests

Which of these has a permissible purpose for obtaining a consumer report?

1. An insurer obtains a report on an applicant to underwrite that applicant's homeowners policy.
2. A producer obtains a report on a celebrity to see what is in it.
3. An insurer obtains a report on a person who asked in writing that it be sent to the insurer.

Practice 4: Reviewing a denial letter

A personal homeowners application in Nevada is denied, partly because of a credit-based insurance score. The letter:

• says the application was denied,
• discloses the score, and
• lists four specific reasons on a Commissioner-approved form.

It says nothing about the reporting agency. What is missing?

Practice 5: Two sharing requests

The insurer plans two disclosures of customer information:

• (a) It sends its customer list to an unrelated travel company so that company can market trips.
• (b) It provides records in response to a properly authorized subpoena.

Which requires notice and an opt-out opportunity first? Assume the stated policy assumption for this section and no other exception for (a).

Practice 6: Credit disclosure, two applications

An insurer uses credit information to price policies.

• (a) It takes an online application for a personal homeowners policy.
• (b) It takes an application for a commercial property policy for a business.

Where must the Nevada credit disclosure be given?

Practice 7: A fact left out on purpose

Jordan applies for a homeowners policy. Jordan knows the basement flooded twice last year, but deliberately skips the question about prior water damage. Everything Jordan does write on the form is accurate. Assume this insurer treats prior water damage as important to its decision to accept the risk. Is this a representation, a warranty or concealment? What fact decides the label, and does the label alone mean the policy can never pay?

Practice 8: Sorting three safeguards

Assume the stated policy assumption for the privacy section. The insurer adopts three new controls:

• (a) A written rule requiring every employee who handles customer files to complete privacy training each year.
• (b) Software that automatically logs a user out of the policy system after 10 minutes of inactivity.
• (c) A badge-only door on the room where paper applications are stored.

Classify each as an administrative, technical or physical safeguard, and explain each choice.

What to remember

• Underwriting is the insurer deciding whether to accept a risk and on what terms. Appropriate information is connected to those decisions. Unknown facts call for clarification, not guesses.
• Representation is a stated fact, warranty is a guarantee, and concealment is a withheld fact. In Nevada, every statement in an application is a representation, not a warranty, whatever the form calls it.
• Inaccurate or incomplete information prevents recovery in Nevada only if it is fraudulent, material, or would have changed the insurer's good-faith decision about issuing, price, amount or coverage of the danger that caused the loss. Grounds 2 and 3 do not require dishonesty.
• Consumer reports require a listed purpose, such as insurance underwriting involving the consumer or the consumer's written instructions. Curiosity is not one. The FCRA's employment procedure is a separate rule.
• Adverse-action notice: any adverse action based in whole or in part on a consumer report requires the four federal items. Where Nevada's credit rules apply, the insurer must also give clear, specific reasons naming up to four primary factors on an approved form. Vague labels are not enough.
• Nevada credit disclosure: if credit information is used, tell the applicant on or at the time of the application, in writing or the same medium. It is not needed again at renewal of the same policy, and the rule does not apply to commercial or business policies.
• Privacy: there is a continuing duty to protect customer information through administrative, technical and physical safeguards. Sharing with outside companies requires notice and an opt-out chance unless an exception applies, such as fraud prevention, consumer consent, transaction servicing or legal compliance. An opt-out is not affirmative consent.