Kentucky Administrative Regulations › Title 806 - PUBLIC PROTECTION CABINET - DEPARTMENT OF INSURANCE › Chapter 3 - Authorization of Insurers and General Requirements › Section 806 KAR 3:210 - Privacy of consumer financial and health information

Current through Register Vol. 51, No. 1, July 1, 2024
RELATES TO:
				KRS
				304.2-105,
				15 U.S.C.
				6801-6809, the Gramm-Leach-Bliley Act
NECESSITY, FUNCTION, AND CONFORMITY:
				KRS
				304.2-110 provides that the commissioner of
				the Department of Insurance may make reasonable rules and administrative
				regulations necessary for or as an aid to the effectuation of any provisions of
				the Kentucky Insurance Code. The Gramm-Leach-Bliley Act,
				15 U.S.C.
				6801(b) and
				6805, requires state insurance
				commissioners to establish standards for insurers, agencies, and agents to
				safeguard the security and confidentiality of consumer records and information.
				15 U.S.C.
				6801 to
				6809 applies to financial
				institutions engaging in financial activities such as "Insuring, guaranteeing,
				or indemnifying against loss, harm, damage, illness, disability, or death, or
				providing and issuing annuities, and acting as principal, agent, or broker for
				the purpose of the foregoing, in any State." This administrative regulation
				extends the application to protect individuals "who obtain or are claimants or
				beneficiaries of products or services primarily for personal, family, or
				household purposes from licensees," in harmony with the federal regulations.
				This stricter standard will hold all Kentucky licensees to the same standard,
				protect the privacy of Kentucky citizens, and promote uniformity of state
				insurance administrative regulations across state borders because this
				administrative regulation is based on a national model adopted by the National
				Association of Insurance Commissioners. Although federal law does not prohibit
				financial institutions from discriminating against individuals who have used
				their right to opt out or refused to grant authorization to disclose nonpublic
				personal financial information, this administrative regulation protects
				Kentucky citizens from discrimination. This administrative regulation
				establishes security requirements for an insurer's, agency's, or agent's use of
				consumers' financial and health information.
Section 1. Definitions.
(1) "Affiliate" means a company that
			 controls, is controlled by, or is under common control with another
			 company.
(2) "Annually" means at
			 least once in a period of twelve (12) consecutive months during which a
			 customer relationship exists.
(3)
			 "Clear and conspicuous" means that a notice is reasonably understandable and
			 designed to call attention to the nature and significance of information in the
			 notice.
(4) "Collect" means to
			 obtain information that the licensee organizes or can retrieve by the name of
			 an individual or by identifying number, symbol, or other identifying particular
			 assigned to the individual, irrespective of the source of the underlying
			 information.
(5) "Commissioner"
			 means the Commissioner of the Kentucky Department of Insurance.
(6) "Company" means a corporation, limited
			 liability company, business trust, general or limited partnership, association,
			 sole proprietorship, or similar organization.
(7) "Consumer":
(a)
1.
			 Means an individual who seeks to obtain, obtains, or has obtained an insurance
			 product or service from a licensee that is to be used primarily for personal,
			 family, or household purposes, and about whom the licensee has nonpublic
			 personal information; or
2. Means
			 that individual's legal representative.
(b) Does include:
1. An individual who provides nonpublic
			 personal information to a licensee in connection with obtaining or seeking to
			 obtain financial, investment, or economic advisory services relating to an
			 insurance product or service, regardless of whether the licensee establishes an
			 ongoing advisory relationship;
2.
			 An applicant for insurance prior to the inception of insurance coverage;
			 and
3. An individual subject to
			 disclosure by a licensee of nonpublic personal financial information to a
			 nonaffiliated third party, other than as permitted under Sections 14, 15, and
			 16 of this administrative regulation, if:
a.
			 The individual is a beneficiary of a life insurance policy underwritten by the
			 licensee;
b. The individual is a
			 claimant under an insurance policy issued by the licensee;
c. The individual is an insured or annuitant
			 under an insurance policy or an annuity issued by the licensee; or
d. The individual is a mortgagor of a
			 mortgage covered under a mortgage insurance policy.
(c) Does not mean an individual is
			 a "consumer" solely on the basis that:
1. An
			 individual is a consumer of another financial institution and the licensee is
			 acting as agent for, or provides processing or other services to, that
			 financial institution;
2. An
			 individual is a beneficiary of a trust for which the licensee is a trustee;
			 or
3. An individual has designated
			 the licensee as trustee for a trust.
(d) Does not mean an individual is a
			 "consumer" solely based on the status listed in subparagraph 2a through c of
			 this paragraph, if:
1. The licensee provides
			 the initial, annual, and revised notices under Sections 5, 6, and 9 of this
			 administrative regulation to the plan sponsor, group, or blanket insurance
			 policyholder, group annuity contract holder, or workers' compensation plan
			 participant; and
2. The licensee
			 does not disclose to a nonaffiliated third party nonpublic personal financial
			 information, other than as permitted under Sections 14, 15, and 16 of this
			 administrative regulation, about an individual who is:
a. A participant or a beneficiary of an
			 employee benefit plan that the licensee administers or sponsors or for which
			 the licensee acts as a trustee, insurer, or fiduciary;
b. Covered under a group or blanket life
			 insurance policy or group annuity contract issued by the licensee; or
c. A beneficiary in a workers' compensation
			 plan.
(e)
			 Does mean the individuals described in paragraph (d)2a through c of this
			 subsection are consumers of a licensee if the licensee fails to meet all the
			 conditions of paragraph (d)1 and 2 of this subsection.
(8) "Consumer reporting agency" is defined in
			 15 U.S.C.
			 1681a(f) of the federal Fair
			 Credit Reporting Act.
(9)
			 "Continuing relationship":
(a) Means a
			 relationship between a consumer and a licensee if:
1. The consumer is a current policyholder of
			 an insurance product issued by or through the licensee; or
2. The consumer obtains financial,
			 investment, or economic advisory services relating to an insurance product or
			 service from the licensee for a fee.
(b) Does not mean that a consumer has a
			 continuing relationship with the licensee if:
1. The consumer applies for insurance but
			 does not purchase the insurance;
2.
			 The licensee sells the consumer airline travel insurance in an isolated
			 transaction;
3. The individual is
			 no longer a current policyholder of an insurance product or no longer obtains
			 insurance services with or through the licensee;
4. The consumer is a beneficiary or claimant
			 under a policy and has submitted a claim under that policy choosing a
			 settlement option involving an ongoing relationship with the
			 licensee;
5. The consumer is a
			 beneficiary or claimant under a policy and has submitted a claim under that
			 policy choosing a lump sum settlement option;
6. The customer's policy has lapsed, expired,
			 or is otherwise inactive or dormant under the licensee's business practices,
			 and the licensee has not communicated with the customer about the relationship
			 for a period of twelve (12) consecutive months, other than annual privacy
			 notices, material required by law or administrative regulation, communication
			 at the direction of a state or federal authority, or promotional
			 materials;
7. The individual is an
			 insured or an annuitant under an insurance policy or annuity, respectively, but
			 is not the policyholder or owner of the insurance policy or annuity;
			 or
8. The individual's last known
			 address according to the licensee's records is invalid. An address of record is
			 invalid if mail sent to that address by the licensee is returned by the postal
			 authorities as undeliverable and if subsequent attempts by the licensee to
			 obtain a current valid address for the individual are unsuccessful.
(10) "Control" means:
(a) Ownership, control, or power to vote
			 twenty-five (25) percent or more of the outstanding shares of any class of
			 voting security of the company, or acting through one (1) or more other
			 persons;
(b) Control over the
			 election of a majority of directors, trustees, or general partners, or
			 individuals exercising similar functions of the company; or
(c) The power to exercise a controlling
			 influence over the management or policies of the company.
(11) "Customer" means a consumer who has a
			 customer relationship with a licensee.
(12) "Customer relationship" means a
			 continuing relationship between a consumer and a licensee under which the
			 licensee provides one (1) or more insurance products or services to the
			 consumer that are to be used primarily for personal, family, or household
			 purposes.
(13)
(a) "Designed to call attention" means that
			 the notice:
1. Uses a plain-language
			 heading;
2. Uses a typeface and
			 type size that are easy to read;
3.
			 Provides wide margins and ample line spacing;
4. Uses boldface or italics for key words;
			 and
5. Is in a form that combines
			 the licensee's notice with other information and uses distinctive type size,
			 style, and graphic devices, such as shading or sidebars.
(b) If a licensee provides a notice on an
			 Internet Web page, "designed to call attention" means that the notice uses text
			 or visual cues to encourage scrolling down the page to view the entire notice,
			 if necessary, and ensures that other elements on the Web site do not distract
			 attention from the notice, and the licensee either:
1. Places the notice on a screen that
			 consumers frequently access, including a page on which transactions are
			 conducted; or
2. Places a link on a
			 screen that consumers frequently access, including a page on which transactions
			 are conducted, that connects directly to the notice and is labeled
			 appropriately to convey the importance, nature, and relevance of the
			 notice.
(14)
			 "Financial institution":
(a) Means any
			 institution engaging in activities that are financial in nature or incidental
			 to financial activities as described in Section 4(k) of the Bank Holding
			 Company Act of 1956 at 12
			 U.S.C. 1843(k).
(b) Does not mean:
1. Any person or entity with respect to any
			 financial activity that is subject to the jurisdiction of the Commodity Futures
			 Trading Commission under 7
			 U.S.C. 1 to
			 27f of the Commodity Exchange
			 Act;
2. The federal Agricultural
			 Mortgage Corporation or any entity charged and operating under
			 12 U.S.C.
			 2001-2279cc of the Farm Credit Act of 1971;
			 or
3. Institutions chartered by
			 U.S. Congress specifically to engage in securitizations, secondary market
			 sales, including sales of servicing rights, or similar transactions related to
			 a transaction of a consumer, as long as the institutions do not sell or
			 transfer nonpublic personal information to a nonaffiliated third
			 party.
(15)
			 "Financial product or service" means:
(a) Any
			 product or service that a financial holding company could offer by engaging in
			 an activity that is financial in nature or incidental to a financial activity
			 described in Section 4(k) of the Bank Holding Company Act of 1956 at
			 12 U.S.C.
			 1843(k); and
(b) A financial institution's evaluation or
			 brokerage of information that the financial institution collects in connection
			 with a request or an application from a consumer for a financial product or
			 service.
(16) "Former
			 customer" means an individual with whom a licensee no longer has a continuing
			 relationship.
(17) "Health care"
			 means preventive, diagnostic, therapeutic, rehabilitative, maintenance, or
			 palliative care, services, procedures, tests, or counseling that:
(a) Relates to the physical, mental, or
			 behavioral condition of an individual;
(b) Affects the structure or function of the
			 human body or any part of the human body, including the banking of blood,
			 sperm, organs, or any other tissue; or
(c) Prescribing, dispensing, or furnishing to
			 an individual drugs or biologicals, or medical devices or health care equipment
			 and supplies.
(18)
			 "Health care provider" is defined by
			 KRS
			 304.17A-005(23).
(19) "Health information" means any
			 information or data except age or gender, whether oral or recorded in any form
			 or medium, created by, or derived from a health care provider or the consumer
			 that relates to:
(a) The past, present, or
			 future physical, mental, or behavioral health or condition of an
			 individual;
(b) The provision of
			 health care to an individual; or
(c) Payment for the provision of health care
			 to an individual.
(20)
			 "Insurance product or service" means:
(a) Any
			 product or service that is offered by a licensee, pursuant to KRS Chapter 304:
			 and
(b) A licensee's evaluation,
			 brokerage, or distribution of information that the licensee collects in
			 connection with a request or an application from a consumer for an insurance
			 product or service.
(21)
			 "Joint agreement" means a written contract pursuant to which a licensee and one
			 (1) or more financial institutions jointly offer, endorse, or sponsor a
			 financial product or service.
(22)
			 "Licensee":
(a) Means all insurers holding a
			 certificate of authority, licensed producers, companies, or business entities
			 licensed or required to be licensed, or authorized or required to be
			 authorized, or registered or required to be registered pursuant to the Kentucky
			 Insurance Code, KRS Chapter 304.
(b) Does not mean registered service contract
			 makers as defined in
			 806 KAR 5:060.
(23) "Necessary to effect,
			 administer, or enforce a transaction" means that the disclosure is:
(a) Required;
(b) Is one (1) of the lawful or appropriate
			 methods, to enforce the licensee's rights or the rights of other persons
			 engaged in carrying out the financial transaction or providing the product or
			 service; or
(c) Is a usual,
			 appropriate, or acceptable method:
1. To carry
			 out the transaction, the product, or the service business of which the
			 transaction is a part, and record, service, or maintain the consumer's account
			 in the ordinary course of providing the insurance product or service;
2. To administer or service benefits or
			 claims relating to the transaction, product, or service business of which it is
			 a part;
3. To provide a
			 confirmation, statement, or other record of the transaction, or information on
			 the status or value of the insurance product or service to the consumer or the
			 consumer's agent or broker;
4. To
			 accrue or recognize incentives or bonuses associated with the transaction that
			 are provided by a licensee or any other party;
5. To underwrite insurance at the consumer's
			 request or for any of the following purposes as they relate to a consumer's
			 insurance:
a. Account
			 administration;
b.
			 Reporting;
c. Investigating or
			 preventing fraud or material misrepresentation;
d. Processing premium payments;
e. Processing insurance claims;
f. Administering insurance benefits, such as
			 utilization review activities;
g.
			 Participating in research projects; or
h. As otherwise required or specifically
			 permitted by federal or state law; or
6. In connection with:
a. The authorization, settlement, billing,
			 processing, clearing, transferring, reconciling, or collection of amounts
			 charged, debited, or otherwise paid using a debit, credit, or other payment
			 card, check or account number, or by other payment means;
b. The transfer of receivables, accounts, or
			 interests; or
c. The audit of
			 debit, credit, or other payment information.
(24) "Nonaffiliated third party":
(a) Means any person who is not:
1. A licensee's affiliate; or
2. Employed jointly by a licensee and a
			 company that is not the licensee's affiliate.
(b) Includes:
1. Any company that is an affiliate solely by
			 virtue of the direct or indirect ownership or control of the company by the
			 licensee or its affiliate in conducting merchant banking or investment banking
			 activities of the type described in
			 12 U.S.C.
			 1843(k)(4)(H) and (I) of the
			 federal Bank Holding Company Act; and
2. A company that is not the licensee's
			 affiliate that jointly employs a person who is also employed by the
			 licensee.
(25) "Nonpublic personal financial
			 information":
(a) Means:
1. Personally-identifiable financial
			 information; and
2. Any list,
			 description, or other grouping of consumers, and publicly-available information
			 pertaining to them that is derived using personally-identifying financial
			 information that is not publicly available.
(b) Includes any list of individuals' names
			 and street addresses that is derived in whole or in part using
			 personally-identifiable financial information that is not publicly available,
			 such as account numbers.
(c) Does
			 not mean:
1. Health information subject to
			 Section 18 of this administrative regulation;
2. Publicly-available information, except as
			 included on a list described in paragraph (a)2 or (b) of this subsection;
			 or
3. Any list, description, or
			 other grouping of consumers and publicly-available information pertaining to
			 them that is derived without using any personally-identifiable financial
			 information that is not:
a. Publicly
			 available, including any list of individuals' names and addresses that contains
			 only publicly-available information;
b. Derived in whole or in part using
			 personally-identifiable financial information that is not publicly available;
			 and
c. Disclosed in a manner that
			 indicates that any of the individuals on the list is a consumer of a financial
			 institution.
(26) "Nonpublic personal health information"
			 means health information:
(a) That identifies
			 an individual who is the subject of the information; or
(b) With a reasonable basis to believe that
			 the information may be used to identify an individual.
(27) "Opt out" means a direction by the
			 consumer that the licensee not disclose nonpublic personal financial
			 information about that consumer to a nonaffiliated third party, other than as
			 permitted by Sections 14, 15, and 16 of this administrative
			 regulation.
(28)
			 "Personally-identifiable financial information":
(a) Means information:
1. That a consumer provides to a licensee to
			 obtain an insurance product or service from the licensee;
2. About a consumer resulting from a
			 transaction involving an insurance product or service between a licensee and a
			 consumer; or
3. That the licensee
			 otherwise obtains about a consumer in connection with providing an insurance
			 product or service to a consumer.
(b) Includes:
1. Information a consumer provides to a
			 licensee on an application to obtain an insurance product or service;
2. Account balance information and payment
			 history;
3. That an individual is
			 or has been one (1) of the licensee's customers or has obtained an insurance
			 product or service from the licensee;
4. Any information about the licensee's
			 consumer if it is disclosed in a manner that indicates that the individual is
			 or has been the licensee's consumer;
5. Any information that a consumer provides
			 to a licensee or that the licensee or its agent otherwise obtains in connection
			 with collecting on a loan or servicing a loan;
6. Any information the licensee collects
			 through an Internet cookie, an information-collecting device from a Web server;
			 and
7. Information from a consumer
			 report.
(c) Does not
			 mean:
1. Health information subject to Section
			 18 of this administrative regulation;
2. A list of names and addresses of customers
			 of an entity that is not a financial institution; and
3. Information that does not identify a
			 consumer, such as aggregate information or blind data that does not contain
			 personal identifiers such as account numbers, names, or addresses.
(29)
			 "Publicly-available information" means any information that a licensee has a
			 reasonable basis to believe is lawfully made available to the general public
			 from:
(a) Federal, state, or local government
			 records;
(b) Widely-distributed
			 media; or
(c) Disclosures to the
			 general public that are required to be made by federal, state, or local
			 law.
(30) "Reasonable
			 basis" to believe that information is lawfully made available to the general
			 public means the licensee has taken steps to determine:
(a) That the information is the type that is
			 available to the general public; and
(b) Whether an individual may direct that the
			 information not be made available to the general public and, if so, that the
			 licensee's consumer has not done so.
(31) "Reasonably understandable" means a
			 notice:
(a) Presents the information in the
			 notice in clear, concise sentences, paragraphs, and sections;
(b) Uses short explanatory sentences or
			 bullet lists, if possible;
(c) Uses
			 definite, concrete, everyday words and active voice, if possible;
(d) Avoids multiple negatives;
(e) Avoids legal and highly technical
			 business terminology, if possible; and
(f) Avoids explanations that are imprecise
			 and readily subject to different interpretations.