In particular, she complained that the Arkansas and West Virginia regulations replace the word "customer" with "consumer."

"By changing the regulation to include consumers, an undue burden is placed on the insurance industry by requiring a higher standard than other financial institutions conducting business within that state," Ms. Jensen said.

In the NAII's view, "The scope of the word consumer is so much broader that a regulation with that language would mean that individuals just filling out applications or asking about insurance products would need to be covered in a company's written program, rather than just a customer with whom the company has a definite business relationship," she said.

According to Ms. Jensen, "If insurers are required to safeguard ?consumer' information, rather than just ?customer' information, insurance companies would have the additional burden of creating costly procedures in their written program.

She said the NAII will be working with insurance departments and legislators in the states to encourage proposals that follow the NAIC model and include customer rather than consumer.

The NAII noted that state regulators are preparing for the next round of privacy proposals that will require a company to create a written information security program for the protection of their customers' personal information.

Such programs, NAII said, must include administrative, technical and physical safeguards, and the scope of the programs will be dependent on the size and complexity of the individual company.

By NAII's count, eight states have consumer privacy proposals: Arkansas, California, Iowa, Nebraska, New York, Oregon, Utah and West Virginia

"Although a handful of states are just now proposing specific customer protection measures, NAII expects to see a flurry of activity in states that need to quickly put these safeguards in place," said Ms. Jensen.

"The General Accounting Office's recent report reminded states that in addition to adopting privacy standards dealing with opt-out privacy notifications, the Gramm-Leach-Bliley Act also required a specific, written program for safeguarding the personal information of a company's customers. We expect that states will play catch-up on complying with this mandate over the next few months, " she noted.

Under GLB, companies must protect a customer's nonpublic personal information, including nonpublic personal financial information and nonpublic personal health information.

The NAIC has adopted a model regulation regarding the standards for safeguarding customer information for states to use as a guide.

In addition to Arkansas and West Virginia, NAII gave a rundown on the proposed and adopted information privacy standards for six other states.

It said California has included the NAIC model in its proposed privacy regulation and Iowa, Nebraska and Utah proposals are all consistent with the NAIC model.

New York's adopted privacy regulation was the basis for the NAIC model, while Oregon's adopted rule requires the licensee to determine if standards should also apply to commercial information derived from noncustomer sources.

The NAII trade association said its 700 members write 34 percent of the property-casualty insurance nationwide.