Privacy Activity Seen On Several Fronts

The critical developments in privacy legislation and regulationcan generally be sorted by discrete categories, one top insurancecompany group contends.

In the first category are the states that are still trying toimplement the disclosure requirements of Title V of the federalGramm Leach Bliley Financial Services Modernization Act of 1999,noted Reynold E. Becker, vice president, property-casualty, for theAlliance of American Insurers in Downers Grove, Ill.

Since GLB took effect, every customer of a financial servicesinstitution, including customers of p-c insurers, was supposed toreceive initial privacy notices. The customers will continue toreceive annual notices “unless the law changes,” Mr. Becker stated.This practice has been implemented in more than 40 jurisdictions,he added.

About 20 years ago, several states, including Ohio,Massachusetts and Minnesota, adopted versions of the NationalAssociation of Insurance Commissioners Insurance Information andPrivacy Protection model act, also known as the 1982 model act.However, those laws, still on the books of 15 states, do not applyto the p-c insurance industry, said Mr. Becker.

Arizona, Montana, North Carolina, Oregon and Virginia enactedlaws to conform to GLBs privacy mandates. Other states, such asConnecticut, are considering regulations to conform to Title V.

In Ohio, the insurance department has been circulating draftlegislation “to try to tweak the law to conform it with GLB andmake the necessary adjustments,” Mr. Becker reported. He said he isnot aware of any similar activity in Massachusetts, althoughlegislation to conform state privacy law to the federal GLB Act ispending.

Kathleen N. Jensen, insurance services counsel for the NationalAssociation of Independent Insurers in Des Plaines, Ill., addedthat Minnesota this year had proposed legislation to revise itsprivacy statute. When last years proposal died upon adjournment ofthe legislature, the Minnesota insurance department issued abulletin to insurers that write business in the state, advisingthem of the need to comply with both the 1982 model act and GLB,Ms. Jensen reported.

The second category involves efforts to implement another facetof Title V–the safeguarding of customer information, Mr. Beckersaid. “Its not really direct dealings with your customers anymore.Its how you handle the information you have about them,” heexplained.

More specifically, Title V obligates financial servicescompanies to have procedures and practices in place to maintain theconfidentiality of customer information.

Mr. Becker said this “manifests in a variety of ways: who hasaccess to information, how do you handle it internally, whatunderstandings do you have in place with vendors or other thirdparties that might have access to this information, and how do youdispose of the information when youre finished with it.”

He noted that the NAIC adopted a model regulation addressingthis issue shortly after its March national meeting in Reno. “Atthis point a variation of the model has been adopted in New Yorkand there is a version pending in California,” Mr. Becker reported.“But basically you have 49 other jurisdictions that still need todo something to implement GLBs customer-information safeguardingrequirements.”

He predicted significant legislative and regulatory activity inthis area this year and next.

In the third category are those states that, in the view ofinsurance industry groups, “are attempting to go above and beyondGLB,” said Mr. Becker.

For example, Vermont and New Mexico have regulations in placethat impose an opt-in approach to disclosures to consumers, Mr.Becker said. A similar draft regulation is circulating in Alaska,and legislation pending in California proposes an opt-in approach,he added.

The Vermont privacy regulation has gone into effect, but theinsurance departments authority to promulgate it is the subject ofa lawsuit by all four national p-c insurer associations as well asthe American Council of Life Insurers, based in Washington,D.C.

The NAIIs Ms. Jensen reported that the plaintiffs in that casehad recently served interrogatories. Both she and Mr. Becker saidthat the litigation will take awhile to resolve.

The fourth category, which Mr. Becker said overlaps with some ofthe others, involves privacy standards for a consumer's personalhealth information. The U.S. Department of Health and HumanServices promulgated regulations on the privacy of medical records,which will go in effect in April 2003, noted Mr. Becker.

The HHS regulations technically apply only to doctors,hospitals, health insurance companies and health maintenanceorganizations, not to workers' compensation and auto insurers,noted Mr. Becker. However, the p-c industry is concerned it willend up “being very much indirectly affected by the regulationsbecause doctors and hospitals are being placed in the awkwardposition of determining whether theyre providing enough informationor too much information,” he said.

“We are concerned that healthcare providers will err on the sideof restricting the flow of information even if its information thatauto insurers and workers' comp insurers are entitled to receive,”Mr. Becker explained. (For more details see Steven Brostoff'sarticle on page 15.)

A fifth category is found at the federal level, Mr. Beckeradded. As mandated by GLB, the U.S. Department of the Treasury isconducting a study of information-sharing practices.

The Treasury Department recently closed the period forsoliciting comments “on how the financial-information privacysystem is working so far and on what changes Congress ought toconsider going forward,” Mr. Becker said. The insurance industryanticipates the Treasury Departments report later this year andbelieves it might include proposals for federal legislation.

Reproduced from National Underwriter Property &Casualty/Risk & Benefits Management Edition, May 27 2002.Copyright 2002 by The National Underwriter Company in the serialpublication. All rights reserved.Copyright in this article as anindependent work may be held by the author.