CARD T263
Health Insurance Portability and Accountability Act (HIPAA)
A federal law addressing health coverage and health-information protections. Privacy rules apply to specified covered entities and business associates.
How it works
HIPAA includes health-coverage provisions and national protections for health information. The Privacy Rule applies to covered health plans, clearinghouses, certain providers, and their business associates; the Security Rule addresses electronic protected health information. It is not a blanket rule covering every person or every health-related fact. Permitted treatment, payment, and health-care-operations disclosures do not generally require individual authorization, although safeguards and applicable limits remain. HIPAA also supports specified group-plan special enrollment rights. [16] [17]
A covered provider may share needed information with a health plan for payment under applicable rules; a producer cannot assume every use for marketing is equally permitted.
HIPAA is not the same as FCRA consumer-report protections or GLBA financial privacy.
Practice Health Insurance Portability and Accountability Act (HIPAA) · 3 questions
CARD T264
Employee Retirement Income Security Act (ERISA)
A federal law governing many private-sector employee benefit plans. It sets requirements involving plan administration, disclosures, and participant protections.
How it works
ERISA sets federal standards for many private-sector employee benefit plans, including disclosure, fiduciary responsibilities, claims procedures, and enforcement rights. It generally does not cover governmental plans or most church plans. It does not require every employer to establish a benefit plan. The employer’s funding structure matters: self-funded ERISA health plans are generally not subject to state insurance benefit mandates in the same way as insured policies, while state insurance regulation still applies to insurers and insured products. [18]
An employee appealing a denied benefit follows the plan’s required claims and appeals procedure rather than assuming the sales brochure is the governing plan document.
ERISA plan regulation and state insurance regulation can apply to different parts of an arrangement.
Practice Employee Retirement Income Security Act (ERISA) · 3 questions
CARD T265
Fair Credit Reporting Act (FCRA)
A federal law governing consumer-report use and consumer rights. It affects insurers’ use of reports in permitted underwriting activities.
How it works
The FCRA regulates consumer reports used for insurance underwriting and other permitted purposes. If adverse action is based wholly or partly on a report, required notice generally identifies the reporting agency, explains that the agency did not make the decision, and describes rights to dispute accuracy and obtain a free report within 60 days. Investigative consumer reports have additional disclosure rules. An insurer must have a permissible purpose; access is not unrestricted. [19]
An insurer offers a higher rate based partly on a consumer report. Applicable adverse-action notice duties can arise even though coverage was offered.
Adverse action is not limited to outright rejection.
CARD T266
Gramm-Leach-Bliley Act (GLBA)
A federal law that includes financial-information privacy and safeguard requirements. Insurance businesses must follow applicable implementing rules.
How it works
The Gramm-Leach-Bliley Act (GLBA) includes rules for protecting customers’ private financial information, such as account and payment details. Applicable rules require privacy notices, safeguards, and controls on certain sharing with outside companies that are not affiliated with the business. An opt-out is a customer’s opportunity to refuse certain sharing. Exceptions allow some disclosures without that choice, so not every transfer requires consent or an opt-out. Insurance businesses follow the relevant implementing rules. Remember the distinction: GLBA concerns financial privacy, HIPAA concerns protected health information, and FCRA concerns consumer reports. [20]
An insurance business reviews whether a proposed disclosure of customer financial information is permitted, requires notice or opt-out, or falls within an exception.
Privacy rules depend on the information, recipient, purpose, and governing rule.
APPLY THE TERMS
Practice questions
Select an answer, then check it to see why each option is right or wrong.
T263 · Health Insurance Portability and Accountability Act (HIPAA)
0 of 3 answered
T264 · Employee Retirement Income Security Act (ERISA)
0 of 3 answered
T265 · Fair Credit Reporting Act (FCRA)
0 of 3 answered
T266 · Gramm-Leach-Bliley Act (GLBA)
0 of 3 answered
Sources & further reading
Original explanations and practice scenarios informed by the following regulatory, legal, and product resources. State examples are not presented as nationwide deadlines or requirements.