Insurance Claims Privacy Protection Act

SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

    (a) Short Title.--This Act may be cited as the ``Insurance Claims 
Privacy Protection Act''.
    (b) Table of Contents.--The table of contents for this Act is as 
follows:

Sec. 1. Short title; table of contents.
Sec. 2. Findings.
Sec. 3. Purposes.
Sec. 4. Definitions.
Sec. 5. Limitations on disclosure of claims information to law 
                            enforcement agencies.
Sec. 6. Separation of the functions of a crime bureau from the 
                            functions of an insurance data support 
                            organization.
Sec. 7. Coordination with State law.
Sec. 8. Enforcement.

SEC. 2. FINDINGS.

    The Congress finds that--
            (1) property and casualty insurers annually collect 
        information pertaining to the claims filed by millions of 
        policyholders and other individuals;
            (2) this information is generally provided to industry 
        organizations for the purpose of assisting insurers to quickly 
        pay a claim or, alternatively, to determine whether a pattern 
        of claim filings exists that warrants further investigation;
            (3) there is a legitimate need for insurers to pool claims 
        information among themselves and to work with law enforcement 
        agencies in order to assure the integrity of the claims 
        decisionmaking process;
            (4) while the insurance industry has historically taken 
        strong and effective measures to prevent the improper 
        disclosure of personal claims information to law enforcement 
        agencies, it is now preparing to eliminate those protections 
        and provide individual claims information on innocent 
        individuals, as well as their doctors and lawyers, to law 
        enforcement agencies;
            (5) although insurance is generally regulated by the 
        individual States pursuant to the Act of March 9, 1945 
        (referred to as the ``McCarran-Ferguson Act''), and despite the 
        fact that the National Association of Insurance Commissioners 
        has proposed model privacy legislation which has been adopted 
        in certain States and addresses the provision of individual 
        information to law enforcement agencies, the Association's 
        model legislation has not been enacted in most of the States 
        and has not prevented the insurance industry from proceeding 
        with its current plans;
            (6) the unfettered disclosure of personal claims 
        information by insurers to law enforcement agencies on innocent 
        individuals violates fundamental principles of individual 
        privacy and may result in intimidating individuals in 
        exercising their rights to file claims; and
            (7) in the absence of effective State regulation, a uniform 
        rule, established through congressional enactment, is the only 
        method for assuring the protection of personal privacy rights.

SEC. 3. PURPOSES.

    The purposes of this Act are--
            (1) to protect the personal privacy rights of insurance 
        customers and claimants by making certain that property and 
        casualty insurers do not improperly provide personal 
        information about innocent insurance claimants to law 
        enforcement agencies;
            (2) to establish clear rules for separating the operation 
        of an insurance crime bureau from the operation of an insurance 
        data support organization in order to prevent the inappropriate 
        use of insurance claims information; and
            (3) to establish strong and effective remedies for 
        violations of this Act.

SEC. 4. DEFINITIONS.

    As used in this Act:
            (1) All claims database.--The term ``all claims database'' 
        means any data collection system, electronic or manual, which 
        obtains information about property and casualty insurance 
        claims without regard to whether there is a reasonable belief 
        that any specific claimant has engaged in any illegal or 
        fraudulent act.
            (2) Crime bureau.--The term ``crime bureau'' means any 
        nongovernmental organization which, in whole or in part, (A) 
        investigates potentially illegal or fraudulent acts with regard 
to property and casualty insurance claims, or (B) shares information 
about such claims with any law enforcement agency, absent a subpoena or 
court order; except that the term does not include the activities of a 
property and casualty insurer.
            (3) Insurance claims data support organization.--The term 
        ``insurance claims data support organization'' means any 
        nongovernmental organization which regularly engages, in whole 
        or in part, in the practice of assembling or collecting claims 
        information about persons for the primary purpose of providing 
        information to property and casualty insurers, self-insurers, 
        or the administrators of an insurance program; except that the 
        term does not include the activities of a property and casualty 
        insurer.
            (4) Property and casualty insurance.--The term ``property 
        and casualty insurance'' means every line of insurance, except 
        life insurance and health insurance, and includes, but is not 
        limited to, automobile insurance, homeowners insurance, and 
        workers' compensation insurance.
            (5) Property and casualty insurer.--The term ``property and 
        casualty insurer'' means any person engaged in the business of 
        insurance who provides property and casualty insurance, either 
        directly or through agents or brokers.

SEC. 5. LIMITATIONS ON DISCLOSURE OF CLAIMS INFORMATION TO LAW 
              ENFORCEMENT AGENCIES.

    (a) Disclosure by Property and Casualty Insurer and Crime Bureau.--
No property and casualty insurer or crime bureau may disclose to a law 
enforcement agency any information pertaining to a claim unless it is 
doing so--
            (1) to protect the interests of the insurer or crime bureau 
        in preventing or prosecuting the perpetuation of fraud upon it; 
        or
            (2) if the insurer or crime bureau reasonably believes that 
        illegal activities have been conducted by the individual.
    (b) Disclosure by Data Support Organization.--No insurance data 
support organization may disclose to a law enforcement agency any 
information pertaining to a claim unless it is doing so--
            (1) to protect the interests of the organization in 
        preventing or prosecuting the perpetuation of fraud upon it; or
            (2) to respond to a subpoena or court order.

SEC. 6. SEPARATION OF THE FUNCTIONS OF A CRIME BUREAU FROM THE 
              FUNCTIONS OF AN INSURANCE DATA SUPPORT ORGANIZATION.

    (a) In General.--An insurance data support organization may 
establish and operate an all claims data base and may establish a 
system for providing claims information to a crime bureau for the 
purpose of detecting fraudulent or other illegal activities pertaining 
to specific claims or to specific categories of claims where fraudulent 
or other illegal activities are reasonably believed to have occurred; 
but an insurance data support organization may not engage in the 
activities of a crime bureau.
    (b) Crime Bureau.--A crime bureau may engage in activities designed 
to prevent, suppress, and prosecute fraud, including, when otherwise 
authorized by law, the conduct of appropriate investigations of 
claimants and collaborative activities with law enforcement agencies; 
but a crime bureau may not operate an all claims data base or collect 
claims information, either directly or indirectly, that may result in 
the establishment or operation of such a data base.

SEC. 7. COORDINATION WITH STATE LAW.

    (a) In General.--Nothing in this Act shall be read as prohibiting 
any State from enacting legislation establishing more stringent 
protections than are provided in this Act for the privacy of 
information contained in property and casualty insurance claims.
    (b) State Certification.--Without regard to the provisions of 
section 8, any State may certify to the Attorney General of the United 
States that it has established, through law or regulation, the same 
protections and enforcement procedures that are incorporated in this 
Act. Upon approval of that certification by the Attorney General, and 
publication of that certification in the Federal Register, enforcement 
of this Act shall be solely pursuant to that certification. The 
Attorney General may revoke a certification for any material breach of 
its provisions.

SEC. 8. ENFORCEMENT.

    (a) Injunction.--Any violation of this Act may be enjoined in any 
Federal district court without regard to any jurisdictional amount 
otherwise required. Such an injunctive action may be brought by the 
Attorney General or by any private party.
    (b) Civil Penalty.--Any violation of this Act may also be subject 
to a civil penalty of not more than $10,000.

Summary: Insurance Claims Privacy Protection Act - Specifies the circumstances in which disclosure of insurance claims information is allowed to law enforcement agencies by insurers and by nongovernmental crime bureaus (CBs) and insurance data support organizations (IDSOs). Regulates the activities in which CBs and IDSOs may engage.  Provides for enforcement.