About 20 years ago, several states, including Ohio, Massachusetts and Minnesota, adopted versions of the National Association of Insurance Commissioners Insurance Information and Privacy Protection model act, also known as the 1982 model act. However, those laws, still on the books of 15 states, do not apply to the p-c insurance industry, said Mr. Becker.

Arizona, Montana, North Carolina, Oregon and Virginia enacted laws to conform to GLBs privacy mandates. Other states, such as Connecticut, are considering regulations to conform to Title V.

In Ohio, the insurance department has been circulating draft legislation “to try to tweak the law to conform it with GLB and make the necessary adjustments,” Mr. Becker reported. He said he is not aware of any similar activity in Massachusetts, although legislation to conform state privacy law to the federal GLB Act is pending.

Kathleen N. Jensen, insurance services counsel for the National Association of Independent Insurers in Des Plaines, Ill., added that Minnesota this year had proposed legislation to revise its privacy statute. When last years proposal died upon adjournment of the legislature, the Minnesota insurance department issued a bulletin to insurers that write business in the state, advising them of the need to comply with both the 1982 model act and GLB, Ms. Jensen reported.

The second category involves efforts to implement another facet of Title V–the safeguarding of customer information, Mr. Becker said. “Its not really direct dealings with your customers anymore. Its how you handle the information you have about them,” he explained.

More specifically, Title V obligates financial services companies to have procedures and practices in place to maintain the confidentiality of customer information.

Mr. Becker said this “manifests in a variety of ways: who has access to information, how do you handle it internally, what understandings do you have in place with vendors or other third parties that might have access to this information, and how do you dispose of the information when youre finished with it.”

He noted that the NAIC adopted a model regulation addressing this issue shortly after its March national meeting in Reno. “At this point a variation of the model has been adopted in New York and there is a version pending in California,” Mr. Becker reported. “But basically you have 49 other jurisdictions that still need to do something to implement GLBs customer-information safeguarding requirements.”

He predicted significant legislative and regulatory activity in this area this year and next.

In the third category are those states that, in the view of insurance industry groups, “are attempting to go above and beyond GLB,” said Mr. Becker.

For example, Vermont and New Mexico have regulations in place that impose an opt-in approach to disclosures to consumers, Mr. Becker said. A similar draft regulation is circulating in Alaska, and legislation pending in California proposes an opt-in approach, he added.

The Vermont privacy regulation has gone into effect, but the insurance departments authority to promulgate it is the subject of a lawsuit by all four national p-c insurer associations as well as the American Council of Life Insurers, based in Washington, D.C.

The NAIIs Ms. Jensen reported that the plaintiffs in that case had recently served interrogatories. Both she and Mr. Becker said that the litigation will take awhile to resolve.

The fourth category, which Mr. Becker said overlaps with some of the others, involves privacy standards for a consumer's personal health information. The U.S. Department of Health and Human Services promulgated regulations on the privacy of medical records, which will go in effect in April 2003, noted Mr. Becker.

The HHS regulations technically apply only to doctors, hospitals, health insurance companies and health maintenance organizations, not to workers' compensation and auto insurers, noted Mr. Becker. However, the p-c industry is concerned it will end up “being very much indirectly affected by the regulations because doctors and hospitals are being placed in the awkward position of determining whether theyre providing enough information or too much information,” he said.

“We are concerned that healthcare providers will err on the side of restricting the flow of information even if its information that auto insurers and workers' comp insurers are entitled to receive,” Mr. Becker explained. (For more details see Steven Brostoff's article on page 15.)

A fifth category is found at the federal level, Mr. Becker added. As mandated by GLB, the U.S. Department of the Treasury is conducting a study of information-sharing practices.

The Treasury Department recently closed the period for soliciting comments “on how the financial-information privacy system is working so far and on what changes Congress ought to consider going forward,” Mr. Becker said. The insurance industry anticipates the Treasury Departments report later this year and believes it might include proposals for federal legislation.

Reproduced from National Underwriter Property & Casualty/Risk & Benefits Management Edition, May 27 2002. Copyright 2002 by The National Underwriter Company in the serial publication. All rights reserved.Copyright in this article as an independent work may be held by the author.