AZ Regulatory Bulletin 2001-11: Information Privacy Rules

STATE OF ARIZONA

DEPARTMENT OF INSURANCE

JANE DEE HULL

2910 NORTH 44th STREET, SUITE 210

CHARLES R. COHEN

Governor

PHOENIX, ARIZONA 85018-7256

Director of Insurance

602/912-8456 (phone) 602/912-8452 (fax)

Regulatory Bulletin 2001-11

TO:

Insurance Institutions, Producers, Insurance Support Organizations,

Insurance Trade Associations and Other Interested Parties

FROM:

Charles R. Cohen

Director of Insurance

DATE:

August 31, 2001

RE:

Information Privacy Issues

This bulletin is issued to:

! Remind insurance institutions, insurance producers, and insurance support

organizations (collectively referred to as “insurance entities”) of their long-standing

obligations under Arizona’s Information and Privacy Protection Act (A.R.S. Title 20,

Chapter 11) (“the Privacy Act” or “the Act”);

! Discuss how SB 1288 (Laws 2001, Ch. 220) amended the Privacy Act; and

! Address questions that have arisen regarding the Department’s interpretation and

enforcement of the Privacy Act, particularly in light of requirements mandated by the

federal Gramm Leach Bliley Act (GLB).

This bulletin does not address certain obligations imposed by the Privacy Act that lack

GLB counterparts. Interested parties are advised to carefully review the Privacy Act to

determine their obligations under these other sections.1

1 A.R.S. § 20-2107; Investigative consumer reports. (An individual has a right to be interviewed in

connection with any consumer report commissioned about that individual.)

A.R.S. § 20-2108; Access to recorded personal information; definition. (An individual has a right to review

recorded personal information about the individual and to know the source of that information.)

A.R.S

1 A.R.S. § 20-2107; Investigative consumer reports. (An individual has a right to be interviewed in

connection with any consumer report commissioned about that individual.)

A.R.S. § 20-2108; Access to recorded personal information; definition. (An individual has a right to review

recorded personal information about the individual and to know the source of that information.)

A.R.S. § 20-2109; Correction, amendment or deletion of recorded personal information; definition (An

individual has a right to request correction of recorded personal information the individual believes is

inaccurate, or to have a supplemental statement included with the recorded information if the insurance

entity will not correct it.)

A.R.S. § 20-2110; Reasons for adverse underwriting decision (An individual subject to an adverse

underwriting decision (a broadly defined term) has a right to know the reason for the decision, the

information supporting the decision, and the source of that information.)

A.R.S. §§ 20-2111 and 20-2112; Adverse underwriting decisions. (Limits an insurer’s ability to rely on

previous adverse underwriting decisions.)

Regulatory Bulletin 2001-11

August 31, 2001

Page 2

Background

Although passage of GLB has ignited interest in the issue of information privacy, it is

important to remember that Arizona has had statutes protecting the privacy of insurance

consumers’ personal and privileged information since the early 1980s. The enactment

of GLB necessitated few changes in Arizona’s laws because Arizona’s Privacy Act

already meets or exceeds most of the federal minimum standards.

To satisfy the requirements of GLB, many states with no existing privacy laws chose to

enact some form of a new model regulation adopted by the National Association of

Insurance Commissioners (new NAIC model privacy regulations). Arizona’s law differs

from the new NAIC model

few changes in Arizona’s laws because Arizona’s Privacy Act

already meets or exceeds most of the federal minimum standards.

To satisfy the requirements of GLB, many states with no existing privacy laws chose to

enact some form of a new model regulation adopted by the National Association of

Insurance Commissioners (new NAIC model privacy regulations). Arizona’s law differs

from the new NAIC model. Arizona insurance entities should be cautious about relying

on general compliance advice because much of that general advice may be based on

an analysis of requirements established by GLB or the new NAIC model, rather than

Arizona-specific requirements.

Arizona Information Privacy Act

Scope

The Act applies to life, health, disability, property, and casualty insurance. The Act’s

protections generally extend to information gathered in an “insurance transaction,” a

term defined to mean insurance purchased “primarily for personal, family or household

needs rather than business or professional needs.” Historically, the Department has not

applied the Act to commercial insurance or workers’ compensation insurance and does

not intend to change its interpretation at this time. This interpretation appears

consistent with GLB. GLB’s protections extend to “consumers,” a term defined to mean

“an individual who obtains…financial products or services which are to be used primarily

for personal, family, or household purposes.” Persons transacting insurance in other

states should note, however, that some states are extending the privacy requirements

to the area of workers’ compensation.

Arizona’s statutory standard is that the insurance be purchased primarily (not solely) for

personal, family, or household use. In determining whether a particular insurance

transaction is subject to the requirements of the Privacy Act, a party should consider all

pertinent circumstances, including the underlying purpose of the insurance, what needs

the insured is addressing with the insurance, and how premium is allotted

ard is that the insurance be purchased primarily (not solely) for

personal, family, or household use. In determining whether a particular insurance

transaction is subject to the requirements of the Privacy Act, a party should consider all

pertinent circumstances, including the underlying purpose of the insurance, what needs

the insured is addressing with the insurance, and how premium is allotted. For

example, a business owner may purchase a commercial auto policy for a commercial

vehicle, but also choose to insure personal vehicles under the policy. The business

owner is entitled to the protections of the Privacy Act because the business owner has

purchased insurance for personal use. Three business partners may purchase

coverage for a jointly owned airplane that is used for pleasure flying. The partners are

entitled to the protections of the Act. An individual may purchase professional liability

coverage. This is not an insurance transaction subject to the act because the insurance

was purchased for a business or commercial purpose.

Regulatory Bulletin 2001-11

August 31, 2001

Page 3

Who Does the Act Protect?

In most cases, the benefits of the Privacy Act extend to applicants for insurance and

policyholders. Some sections of the Act, however, protect a broader class of

individuals. For example, A.R.S. § 20-2104 proscribes who is entitled to receive a

privacy notice, and refers to “applicants” and “policyholders.” However, A.R.S. § 20-

2113 prohibiting release of personal information, applies to “individuals” and thus

encompasses information gathered about a claimant as well as a policyholder or

applicant. This section also protects an employee of a group who has supplied

personal health information for the purpose of a group health insurance application,

even though the particular employee was not seeking coverage under the group policy.

Insurance entities should look at the precise terms used in each specific section of the

Act to determine who has rights under a particular section

or

applicant. This section also protects an employee of a group who has supplied

personal health information for the purpose of a group health insurance application,

even though the particular employee was not seeking coverage under the group policy.

Insurance entities should look at the precise terms used in each specific section of the

Act to determine who has rights under a particular section.

GLB’s protections generally extend to “consumers” and “customers,” which are terms

and concepts derived from the banking industry rather than the insurance industry.

Under GLB, rights vary depending on whether the financial institution has established a

“customer relationship” with the consumer.

Who Is Subject to the Act?

The Act applies to “insurance institutions” “agents and brokers” (referred to as

“producers” as of October 1, 2001), managing general agents, and insurance support

organizations. “Insurance institution” generally includes all types of insurers, including

HMOs.

Several entities have contacted the Department to inquire as to whether a particular

entity is an insurance support organization. That term is defined in the statute (A.R.S. §

20-2102(12)). An interested party should consult the statute and apply it to the party’s

conduct and business operations to determine if the definition applies.2

What information is subject to the Act and must be protected?

The Act generally protects both personal and privileged information. Personal

information is defined in the broadest terms, as follows:

[A]ny individually identifiable information gathered in connection with an

insurance transaction and from which judgments can be made about an

individual’s character, habits, avocations, finances, occupation, general

reputation, credit, health or any other personal characteristics. Personal

information includes an individual’s name and address and medical record

information but does not include privileged information

entifiable information gathered in connection with an

insurance transaction and from which judgments can be made about an

individual’s character, habits, avocations, finances, occupation, general

reputation, credit, health or any other personal characteristics. Personal

information includes an individual’s name and address and medical record

information but does not include privileged information.

2 Drafting notes to the 1982 NAIC Insurance Information and Privacy Protection Model Act, upon which

Arizona’s Privacy Act is based, indicate that the term was used to describe two different types of entities.

First, there are nonprofit entities that exist “solely as a repository of information for the insurance

industry.” Insurers file information with these entities and retrieve it as needed; the notes referred to the

Medical Information Bureau (MIB) as an example. Second, there are entities such as consumer credit

reporting agencies, that gather information from multiple sources and serve numerous industries,

including insurance.

Regulatory Bulletin 2001-11

August 31, 2001

Page 4

Privileged information means:

[A]ny individually identifiable information that relates to a claim for insurance

benefits or a civil or criminal proceeding involving an individual and is collected

in connection with or in reasonable anticipation of a claim for insurance benefits

or a civil or criminal proceeding involving an individual, except that information

otherwise meeting the requirements of this paragraph is considered personal

information …if it is disclosed in violation of section 20-2113.

GLB protects “nonpublic personal information” which is generally defined as “personally

identifiable financial information” that is not otherwise publicly available. The new

NAIC model regulation covers both financial information and medical information;

however, not all states have adopted the NAIC provisions covering medical information

when enacting insurance privacy laws

n of section 20-2113.

GLB protects “nonpublic personal information” which is generally defined as “personally

identifiable financial information” that is not otherwise publicly available. The new

NAIC model regulation covers both financial information and medical information;

however, not all states have adopted the NAIC provisions covering medical information

when enacting insurance privacy laws. Thus, Arizona’s law generally protects more

information, including medical information3, than is protected under GLB or the laws of

many other states.

What conduct is required under Arizona’s Privacy Act?

1. Issuance of a Privacy Notice

A.R.S. § 20-2104 generally requires insurers and producers to give applicants and

policyholders a notice describing the insurer or producer’s information practices. The

timing and content of the notice will vary depending on the nature and status of the

insurance transaction, and whether the individual is an applicant for insurance or a

policyholder.

Who is entitled to notice?

An insurer or producer must provide the notice to applicants and policyholders. Arizona

law allows a short form notice to an applicant. A.R.S. § 20-2104(D). The short form

notice may be given orally. All policyholders must receive the full written notice

prescribed by A.R.S. § 20-2104(C).

For group insurance, an insurer or producer is not required to give notice to the

individual insured if the insurer gives notice to the plan sponsor or group policyholder

and does not disclose personal information about the individual insured except as

allowed under A.R.S. § 20-2113. See A.R.S. § 20-2104(F).

When must notice be given?

A.R.S. § 20-2104(B) requires an initial notice when the insurer or producer delivers the

policy or certificate, or first collects information about the applicant from a source other

than the applicant, whichever occurs first. An annual notice must be provided during

the continuation of the relationship with the policyholder

er A.R.S. § 20-2113. See A.R.S. § 20-2104(F).

When must notice be given?

A.R.S. § 20-2104(B) requires an initial notice when the insurer or producer delivers the

policy or certificate, or first collects information about the applicant from a source other

than the applicant, whichever occurs first. An annual notice must be provided during

the continuation of the relationship with the policyholder. Notice is also required when a

3 A.R.S. § 20-2102(17) defines “medical record information” as “personal information which relates to an

individual’s physical or mental condition, medical history or medical treatment and is obtained from a

medical professional or medical care institution, the individual or the individual’s spouse, parent or legal

guardian.”

Regulatory Bulletin 2001-11

August 31, 2001

Page 5

policy is reinstated, unless the policyholder has received a notice within the 12 months

immediately preceding reinstatement.

When is notice excused?

An insurer or producer is not required to give notice to an insured whose policy has

lapsed, expired, or become inactive. A policy is “inactive” when the insurer or producer

has not communicated with the policyholder for at least 12 consecutive months, other

than to provide an annual privacy notice, material required by law, or promotional

materials. The Department thinks it is unlikely that a health, automobile, homeowners

or personal umbrella policy would ever become “inactive” because such policies tend to

renew at least annually. It is possible that a paid up life insurance policy could become

inactive where there is no ongoing need for communication until a claim for benefits is

made.

Notice is also not required for a policyholder with an invalid address. An address is

invalid if mail has been returned as undeliverable and the insurer or producer has

subsequently tried, without success, to obtain a valid address.

What form is required for the notice?

The notice to policyholders must be in writing

re there is no ongoing need for communication until a claim for benefits is

made.

Notice is also not required for a policyholder with an invalid address. An address is

invalid if mail has been returned as undeliverable and the insurer or producer has

subsequently tried, without success, to obtain a valid address.

What form is required for the notice?

The notice to policyholders must be in writing. The short form notice to an applicant

may be oral. Often, first contact with a prospective insured occurs telephonically when

an applicant is seeking a phone quote. To provide the quote, a producer may

simultaneously reference outside data sources such as Department of Motor Vehicle

records. When giving a phone quote, there may be no practical method for delivering a

written notice. In this case, Arizona law permits the producer to give oral notification of

information practices.

A notice may be in electronic form if the policyholder agrees to receipt in this form.

Should a question arise, the burden is on the insurer or producer to show that the

policyholder agreed to notice in electronic form. A notice may also be faxed.

What information must be in the notice?

For “short form” notice to applicants under A.R.S. § 20-2104(D), the insurer or producer

must advise the applicant (either orally or in writing) of the following before seeking data

from any source other than the applicant:

(1) That the producer will collect information about the potential insured from

outside sources (meaning sources other than the applicant);

(2) The collected information may be disclosed to third parties without

authorization.4

§ 20-2104(D), the insurer or producer

must advise the applicant (either orally or in writing) of the following before seeking data

from any source other than the applicant:

(1) That the producer will collect information about the potential insured from

outside sources (meaning sources other than the applicant);

(2) The collected information may be disclosed to third parties without

authorization.4

(3) The individual has the right to access his own personal information and to

submit corrected information if the individual believes the information is

inaccurate.

4 This statement about the possibility of disclosure does not alter the substantive prohibition on disclosure

set forth in A.R.S. § 20-2113. Any disclosures must still comply with that section and occur either with

authorization or pursuant to a listed exception.

Regulatory Bulletin 2001-11

August 31, 2001

Page 6

(4) A complete written notice describing the insurer’s or producer’s information

privacy practices is available upon request.

If requested to do so, the producer or insurer must provide the caller with a copy of the

full written notice described below, regardless of whether the caller becomes a

policyholder. If the applicant becomes a policyholder, the insurer or producer must

provide the full written notice described below.

Except as described above for the “short form” notice, the notice under A.R.S. § 20-

2104(C) must be in writing and include the following information:

(1) Whether the insurer or producer collects information about the insured from

persons other than the insured;

(2) The types of information that may be collected about the insured, the likely

sources of that information, and the methods used to collect the information;

(3) The types of disclosures allowed under A.R.S. § 20-2113 and the typical

circumstances when the insurer or producer will release information without

prior authorization;

s information about the insured from

persons other than the insured;

(2) The types of information that may be collected about the insured, the likely

sources of that information, and the methods used to collect the information;

(3) The types of disclosures allowed under A.R.S. § 20-2113 and the typical

circumstances when the insurer or producer will release information without

prior authorization;

(4) A description of the insured’s rights under A.R.S. § 20-2108 (the right to

access one’s own information that has been collected and to receive

information on how the insurer or producer has used that information) and

20-2109 (the right to correct or supplement information the insured believes

is inaccurate), and how the insured can exercise those rights.

As amended by SB 1288, the Privacy Act does permit an insurer or producer to use, in

lieu of the Arizona specific notice, a notice that complies with the requirements

established under GLB § 503. GLB § 503 requires disclosure of the following

information:

(1) the insurance entity’s policies and practices for disclosure of information

about current or former applicants and policyholders to affiliated and non-

affiliated third parties, including the types of persons to whom information is

disclosed other than persons to whom disclosures are made pursuant to an

exception under GLB § 502(e) (GLB § 502(e) is comparable to A.R.S. § 20-

2113);

(2) the types of information collected;

(3) the insurance entity’s policies for protecting confidentiality and security of

personal information;

to affiliated and non-

affiliated third parties, including the types of persons to whom information is

disclosed other than persons to whom disclosures are made pursuant to an

exception under GLB § 502(e) (GLB § 502(e) is comparable to A.R.S. § 20-

2113);

(2) the types of information collected;

(3) the insurance entity’s policies for protecting confidentiality and security of

personal information;

(4) any disclosures required under the Fair Credit Reporting Act.5

Similar information is required for a privacy notice under A.R.S. § 20-2104(C) and a

notice under GLB § 503, except that Arizona law expressly requires disclosure of

statutory rights under A.R.S. §§ 20-2108 and 20-2109 that are peculiar to Arizona’s

Privacy Act. If an insurance entity elects to use the GLB notice it has developed for use

in other states as its notice under A.R.S. § 20-2104, the insurance entity must include

an addendum that apprises applicants and policyholders of their rights under A.R.S. §§

20-2108 and 20-2109. GLB requires disclosure of information practices. Those

5 For disclosures required under the Fair Credit Reporting Act, see 15 U.S.C. §§ 1681d and 1681h.

Regulatory Bulletin 2001-11

August 31, 2001

Page 7

information practices may vary from state to state or from insurer to insurer. In Arizona,

information practices include the rights and procedures set forth in A.R.S. §§ 20-2108

and 20-2109. Consequently, those practices must be disclosed in, or as an addendum

to, the privacy notice used in Arizona.

Who must give the notice?

A.R.S. § 20-2104(E) permits one insurer or producer to satisfy the notice obligation for

another insurer or producer that is authorized to act on its behalf. The statute does not

explain what constitutes “authorization.” Any authorization should be memorialized in

some form of written understanding between the insurer and the producer or between

affiliated entities

ona.

Who must give the notice?

A.R.S. § 20-2104(E) permits one insurer or producer to satisfy the notice obligation for

another insurer or producer that is authorized to act on its behalf. The statute does not

explain what constitutes “authorization.” Any authorization should be memorialized in

some form of written understanding between the insurer and the producer or between

affiliated entities.

Producers have inquired about whether they are obligated to give notice if the insurer is

giving notice, either when issuing the initial policy, or at renewal. If the insurer and

producer have a clear written understanding that the insurer will provide notice on

behalf of the producer, the producer need not send a duplicative notice. However, the

producer should take steps to ensure that the insurer’s notice satisfies the producer’s

obligations under the statute. There may also be situations (e.g. phone quotes) when

there is no opportunity for an insurer to satisfy the obligation on behalf of a producer. In

these situations, the producer must take steps to ensure that the producer’s obligations

are met. Should questions arise, the producer has the burden of proving that the

consumer received a notice that complies with the statute.

2. Maintaining confidentiality of information

The Privacy Act also requires insurance entities to maintain confidentiality of an

individual’s personal and privileged information, as specified below. Arizona’s Privacy

Act is more restrictive than GLB regarding disclosure of an individual’s personal or

privileged information, as follows:

GLB

Arizona

Financial institution may freely share

information with affiliates.

Insurers and producers must not

disclose an individual’s personal or

privileged

information

to

anyone

without the individual’s authorization, or

unless disclosure is allowed under an

exception listed in A.R.S. § 20-2113.

A.R.S

LB regarding disclosure of an individual’s personal or

privileged information, as follows:

GLB

Arizona

Financial institution may freely share

information with affiliates.

Insurers and producers must not

disclose an individual’s personal or

privileged

information

to

anyone

without the individual’s authorization, or

unless disclosure is allowed under an

exception listed in A.R.S. § 20-2113.

A.R.S. § 20-2113(12) does permit

disclosure of information (other than

medical record information) to an

affiliate if the affiliate will use the

information solely for the purpose of

marketing

insurance

or

financial

products and agrees not to further

disclose the information.

Regulatory Bulletin 2001-11

August 31, 2001

Page 8

Financial institution may freely share

information

with

nonaffiliated

third

parties that have a joint agreement with

the financial institution to perform

services on behalf of the institution.

The agreement must require the third

party to maintain confidentiality.

Insurers and producers may not share

information with anyone without the

affirmative permission of the individual,

or unless sharing is allowed under an

exception listed in A.R.S. § 20-2113.

A.R.S. § 20-2113(2)(a) does allow

disclosure to a third party if disclosure

is necessary to enable the third party to

perform a function for the insurance

entity, and the third party agrees not to

disclose the information further. Note

that the Department expects insurance

entities

to

manifest

the

required

agreement in writing, consistent with

GLB’s

requirements

for

“joint

agreements.”

Financial institution may not share

information with non-affiliated third

parties unless the financial institution

gives the customer a chance to “opt

out”. If the consumer does not

affirmatively opt out (i.e. instruct “no

sharing or disclosure”), the institution

may disclose information

o

manifest

the

required

agreement in writing, consistent with

GLB’s

requirements

for

“joint

agreements.”

Financial institution may not share

information with non-affiliated third

parties unless the financial institution

gives the customer a chance to “opt

out”. If the consumer does not

affirmatively opt out (i.e. instruct “no

sharing or disclosure”), the institution

may disclose information.

Insurers and producers may not share

information with anyone without the

affirmative permission of the individual,

or unless sharing is allowed under an

exception listed in A.R.S. § 20-2113.

A.R.S. § 20-2113(11) allows disclosure

of very limited information6 to a person

who wishes to use the information for

marketing a product or service if the

insurer or producer gives the individual

an opportunity to opt out and the

individual does not opt out. The person

receiving the information must agree to

no further disclosure.

Producers have expressed concern about their ability to share an applicant’s

information with potential insurers, with whom the producer is seeking to place

coverage. A.R.S. § 20-2113 (3) permits disclosure to an insurer or producer “if the

information disclosed is limited to that which is reasonably necessary…for either the

disclosing or receiving [insurance entity] to perform its function in connection with an

insurance transaction involving the individual.” When an individual approaches a

producer seeking coverage, it is necessary for the producer to provide the insurer with

information about the applicant in order to obtain coverage for the insured

d is limited to that which is reasonably necessary…for either the

disclosing or receiving [insurance entity] to perform its function in connection with an

insurance transaction involving the individual.” When an individual approaches a

producer seeking coverage, it is necessary for the producer to provide the insurer with

information about the applicant in order to obtain coverage for the insured. The privacy

act should not be read to impede the free flow of information between an insurer and a

6 Under this exception, the insurance entity may not share: (1) medical record information, (2) privileged

information, (3) personal information relating to an individual’s character, personal habits, mode of living

or general reputation, or (4) any classification derived from the individual’s information.

Regulatory Bulletin 2001-11

August 31, 2001

Page 9

producer, if that flow of information is required to carry out the insurance

transaction that the insured has authorized.

GLB recognizes a similar exception. Disclosure is allowed, “as necessary to effect,

administer, or enforce a transaction requested or authorized by the [applicant or

insured]…” GLB § 502(e).

In determining whether sharing is permitted under this exception, the insurance entity

must consider the nature and scope of the work the insured has authorized For

example, if an insured is seeking health insurance at the best rate, the producer may

send the insured’s personal information to insurers the producer believes would be

interested in covering the particular risk. However, the producer may not, under this

exception, provide the individual’s personal information to a med-pay insurer to

generate a quote in the hope of being able to sell this related form of insurance, or to

another producer who might wish to sell the individual life insurance

insured’s personal information to insurers the producer believes would be

interested in covering the particular risk. However, the producer may not, under this

exception, provide the individual’s personal information to a med-pay insurer to

generate a quote in the hope of being able to sell this related form of insurance, or to

another producer who might wish to sell the individual life insurance. Because these

latter transactions are outside the scope of the transaction authorized by the insured,

the insurance entity must either find another applicable exception, or obtain the

individual’s further authorization.

Producers have inquired about their ability to share information at the time of policy

renewal. A producer who wishes to “shop” an insured to different insurers at policy

renewal should look at the authority previously conferred, and any authorization the

insured has previously signed. Has the insured asked the producer to renew the policy

or to shop the policy? Does the producer have a current form authorizing disclosure to

the insurance companies to whom the producer will shop the policy? Unless the

producer is sharing information to carry out the insured’s request, or has a current

authorization, the producer may not share information for the purpose of shopping the

policy. A producer can easily satisfy this burden by contacting the policyholder and

confirming that the policyholder wants the producer to share information as needed to

shop and renew the policy. Such communications permit the insured to remain

knowledgeable about and in control of his or her information. It is possible that an

insured may have chosen a particular insurer specifically because of the insurer’s more

restrictive privacy policies, and may not want the producer to shop the policy or share

information with different insurers. An insured’s circumstances or health status may

change during the course of a year resulting in greater concern about privacy

n control of his or her information. It is possible that an

insured may have chosen a particular insurer specifically because of the insurer’s more

restrictive privacy policies, and may not want the producer to shop the policy or share

information with different insurers. An insured’s circumstances or health status may

change during the course of a year resulting in greater concern about privacy.

Producers have also inquired about the need for authorization when the producer is

doing a “book roll” of business to another insurer. The producer should look at

whatever authorization the insured has previously signed to determine if it permits such

information-sharing with a different insurer, and if it is still current. Without a current

authorization, such transactions will generally require the producer to obtain a new

authorization from the insured because they do not occur at the request of the insured.

Authorization for disclosure

An authorization for disclosure must be in writing, or (with an individual’s consent) in

electronic form. Any form that authorizes disclosure of personal or privileged

information must satisfy the requirements of A.R.S. § 20-2106. The form must:

Regulatory Bulletin 2001-11

August 31, 2001

Page 10

1. Be written in plain language;

2. Be dated;

3. Specify who may disclose information about the individual;

4. Specify the information that may be disclosed;

5. Identify the insurance entity seeking authorization for disclosure and the

persons (identified by generic reference) at the insurer authorized to receive

the information;

6. Explain the reason for collecting the information;

7. Specify the length of time for which the authorization is valid (note that

allowable time periods vary depending on the purpose for which information is

collected); and

8. Explain that the individual or an authorized representative may have a copy of

the authorization.

In addition to the statutory elements listed above, the form should:

1. Be conspicuous;

2

ason for collecting the information;

7. Specify the length of time for which the authorization is valid (note that

allowable time periods vary depending on the purpose for which information is

collected); and

8. Explain that the individual or an authorized representative may have a copy of

the authorization.

In addition to the statutory elements listed above, the form should:

1. Be conspicuous;

2. Identify the individual who is the subject of the information.

3. Include the dated signature of the individual; and

4. Include a statement advising the individual that the individual may revoke the

authorization at any time upon written notice to the person holding the

authorization, subject to the rights of anyone who acted in reliance on the

authorization prior to notice of its revocation.

Opting out under A.R.S. § 20-2113(11)

Under A.R.S. § 20-2113(11), an insurer or producer may disclose very limited

information about an individual (e.g. the individual’s name) to someone who wishes to

use the information for marketing a product or service. Before disclosing the

information pursuant to this exception, the insurer or producer must give the individual

the opportunity to “opt out” of such disclosure. Arizona’s statutes do not specify the

requirements for an “opt out” form. A form that satisfies the requirements under GLB or

the new NAIC model regulation is presumed adequate. At a minimum, the form must:

1. Be clear and conspicuous;

2. Advise the individual that the individual may opt out of disclosure; and

3. Provide a reasonable means for the individual to opt out.

Enforcement

The Arizona Department of Insurance regularly cites insurance entities for violations of

the Arizona’s Privacy Act. (See Circular letter 2000-4). The media attention generated

by GLB has caused consumers to be more aware of and sensitive to their privacy rights.

The heightened consumer awareness may result in more inquiries and complaints

about the information privacy practices of insurance entities

Arizona Department of Insurance regularly cites insurance entities for violations of

the Arizona’s Privacy Act. (See Circular letter 2000-4). The media attention generated

by GLB has caused consumers to be more aware of and sensitive to their privacy rights.

The heightened consumer awareness may result in more inquiries and complaints

about the information privacy practices of insurance entities. All insurance entities are

cautioned to review their policies and procedures to ensure full compliance with

Arizona’s Privacy Act, as amended by SB 1366.

Please direct any questions about this regulatory bulletin to Vista Thompson Brown,

Executive Assistant for Policy Affairs, 602-912-8456, vbrown@id.state.az.us.