Code of Vermont Rules › Agency 21 - DEPARTMENT OF FINANCIAL REGULATION › Sub-Agency 040 - DIVISION OF HEALTH CARE ADMINISTRATION › Chapter 019 - PRIVACY OF CONSUMER FINANCIAL AND HEALTH INFORMATION › Section 21 040 019 - PRIVACY OF CONSUMER FINANCIAL AND HEALTH INFORMATION

Current through June,
				2024
REGULATION IH-2001-01 (Revised)
ARTICLE I. GENERAL PROVISIONS
Section 1. Authority.
This regulation is promulgated pursuant to the authority
				  granted by
				  10,
				  15,
				  3381,
				  3541 - 3543, 3688, 3858, 4062, 4108, 4113,
				  4201, 4362, 4373, 4464, 4480, 4481, 4515a, 4587, 4690, Chapter 129, 4812, 4836,
				  4902, 4990, 5104, 5111, 6015, 8005, 8014, and 8084, and 1972, Act No. 72 (Adj.
				  Sess.), §
											1.
Section 2. Purpose; Scope; Compliance.
A. Purpose. This regulation governs the
				treatment of nonpublic personal financial information and nonpublic personal
				health information about individuals by all licensees under part 3 of Title 8
				V.S.A. This regulation:
(1) Requires a
				licensee to provide notice to individuals about its privacy policies and
				practices;
(2) Describes the
				conditions under which a licensee may disclose nonpublic personal financial
				information and nonpublic personal health information about individuals to
				nonaffiliated third parties; and
(3) Requires licensees to obtain consumer
				consent prior to disclosing that information, subject to the exceptions in
				sections 14,
				15,
				16, and 17 of this regulation and subject to
				the federal Fair Credit Reporting Act and Vermont Fair Credit Reporting
				Act.
B. Scope.
(1) This regulation applies to:
(a) Nonpublic personal financial information
				about individuals who obtain or are claimants or beneficiaries of products or
				services from licensees primarily for personal, family, or household purposes;
				and
(b) All nonpublic personal
				health information.
(2)
				This regulation does not apply to information about companies or individuals
				who obtain financial products or services for business, commercial, or
				agricultural purposes.
C.
				Compliance.
(1) A licensee subject to this
				regulation, regardless of its jurisdiction of domicile, shall comply with the
				provisions of this regulation for transactions with Vermont
				consumers.
(2) For a consumer who
				is not a Vermont resident, a licensee domiciled in this State shall be deemed
				to be in compliance with Title V of the Gramm-Leach-Bliley Act in this State
				with respect to that consumer if the licensee is in compliance with a law or
				regulation enacted in the state of the consumer's domicile that meets the
				requirements of Title V of the Gramm-Leach-Bliley Act (PL
				106-102).
Section 3. Rule of Construction.
The examples in this regulation and the sample clauses in
				  Appendix A are guidance concerning this regulation's application in ordinary
				  circumstances but are not exclusive. The facts and circumstances of each
				  individual situation will determine whether compliance with an example or use
				  of a sample clause constitutes compliance with this regulation.
Section 4. Definitions.
As used in this regulation, unless the context requires
				  otherwise:
A. "Affiliate" has the same
				meaning as in
				3681.
B. "Clear and conspicuous" means that a
				notice is reasonably understandable and designed to call attention to the
				nature and significance of the information in the notice.
(1) Examples.
(a) Reasonably understandable. A licensee
				makes its notice reasonably understandable if it:
i. Presents the information in the notice in
				clear, concise sentences, paragraphs, and sections;
ii. Uses short explanatory sentences or
				bullet lists whenever possible;
iii. Uses definite, concrete, everyday words
				and active voice whenever possible;
iv. Avoids multiple negatives;
v. Avoids legal and highly technical business
				terminology whenever possible;
vi.
				Avoids explanations that are imprecise and readily subject to different
				interpretations; and
vii. Avoids
				contradictory, confusing, and misleading language.
(b) Designed to call attention. A licensee
				designs its notice to call attention to the nature and significance of the
				information in it if the licensee:
i. Uses a
				plain-language heading to call attention to the notice;
ii. Uses a typeface and type size that are
				easy to read;
iii. Provides wide
				margins and ample line spacing;
iv.
				Uses boldface or italics for key words; and
v. In a form that combines the licensee's
				notice with other information, uses distinctive type size, style, and graphic
				devices, such as shading or sidebars.
(c) Notices on websites. If a licensee
				provides a notice on a web page, the licensee designs its notice to call
				attention to the nature and significance of the information in it if the
				licensee:
i. Uses text or visual cues to
				encourage scrolling down the page if necessary to view the entire notice and
				ensure that other elements on the website (such as text, graphics, hyperlinks,
				or sound) do not distract attention from the notice; and
ii. Places the notice on a screen that
				consumers frequently access, such as a page on which transactions are conducted
				or that connects directly to the notice and is labeled appropriately to convey
				the importance, nature, and relevance of the notice.
C. "Collect" means to
				obtain information that the financial institution organizes or can retrieve by
				the name of an individual or by identifying number, symbol, or other
				identifying particular assigned to the individual, irrespective of the source
				of the underlying information.
D.
				"Commissioner" means the commissioner of the Department of Financial
				Regulation.
E. "Company" means any
				corporation, limited liability company, business trust, general or limited
				partnership, association, sole proprietorship or similar
				organization.
F.
(1) "Consumer" means an individual who seeks
				to obtain, obtains or has obtained a financial product or service from a
				financial institution that is to be used primarily for personal, family, or
				household purposes, or that individual's legal representative.
(2) Examples.
(a) An individual who provides nonpublic
				personal information to a licensee in connection with obtaining or seeking to
				obtain financial, investment, or economic advisory services relating to an
				insurance product or service is a consumer regardless of whether the licensee
				establishes an ongoing advisory relationship.
(b) An applicant for insurance prior to the
				inception of insurance coverage is a licensee's consumer.
(c) An individual who is a consumer of
				another financial institution is not a licensee's consumer solely because the
				licensee is acting as agent for, or provides processing or other services to,
				that financial institution.
(d) An
				individual is a licensee's consumer if the licensee discloses nonpublic
				personal financial information about the individual to a nonaffiliated third
				party and one of the following exist:
i. The
				individual is a beneficiary of a life insurance policy underwritten by the
				licensee;
ii. The individual is a
				claimant under an insurance policy issued by the licensee;
iii. The individual is an insured or an
				annuitant under an insurance policy or an annuity, respectively, issued by the
				licensee; or
iv. The individual is
				a mortgagor of a mortgage covered under a mortgage insurance policy.
(e) Provided that the licensee
				provides the initial, annual, and revised notices under sections
				5,
				6, and 9 to the plan sponsor, group or blanket
				insurance policyholder, group annuity contract holder, o r workers'
				compensation plan participant, and further provided that the licensee does not
				disclose to a nonaffiliated third party nonpublic personal financial
				information about such an individual other than as permitted under sections
				14,
				15, and 16, an individual is not a consumer
				of the licensee solely because he or she is:
i. A participant in or beneficiary of an
				employee benefit plan that the licensee administers or sponsors or for which
				the licensee acts as a trustee, insurer, or fiduciary;
ii. Covered under a group or blanket
				insurance policy or group annuity contract issued by the licensee; or
iii. A claimant covered by a workers'
				compensation plan.
(f)
				The individuals described in subdivisions (e)(i) through (iii) of this
				subsection F are consumers of a licensee if the licensee does not meet all the
				conditions of subdivision (e).
(g)
				In no event shall the individuals, solely by virtue of the status described in
				subdivisions (e)(i) through (iii) of this subsection F, be deemed to be
				customers for purposes of this regulation.
(h) An individual is not a licensee's
				consumer solely because he or she is a beneficiary of a trust for which the
				licensee is a trustee.
(i) An
				individual is not a licensee's consumer solely because he or she has designated
				the licensee as trustee for a trust.
G. "Consumer reporting agency" has the same
				meaning as in section
				603 of the federal Fair Credit Reporting Act
				(15 U.S.C. §
											1681 a(f)) and shall include any "credit
				reporting agency" within the meaning of
				2480 a(4).
H. "Control" has the same meaning as in
				3681.
I. "Customer" means a consumer who has a
				customer relationship with a licensee.
J. "Customer relationship" means a continuing
				relationship between a consumer and a licensee under which the licensee
				provides one or more insurance products or services to the consumer that are to
				be used primarily for personal, family, or household purposes.
(1) Examples.
(a) A consumer has a continuing relationship
				with a licensee if:
i. The consumer is a
				current policyholder of an insurance product issued by or through the licensee;
				or
ii. The consumer obtains
				financial, investment, or economic advisory services relating to an insurance
				product or service from the licensee for a fee.
(b) A consumer does not have a continuing
				relationship with a licensee if:
i. The
				consumer applies for but does not purchase insurance from the
				licensee;
ii. The licensee sells
				the consumer travel insurance in an isolated transaction;
iii. The consumer is no longer a current
				policyholder of an insurance product or no longer obtains insurance services
				with or through the licensee;
iv.
				The consumer is a beneficiary or claimant under a policy and has submitted a
				claim under a policy choosing a settlement option involving an ongoing
				relationship with the licensee;
v.
				The consumer is a beneficiary or claimant under a policy and has submitted a
				claim under that policy choosing a lump sum settlement option;
vi. The consumer's policy is lapsed, expired,
				or otherwise inactive or dormant under the licensee's business practices, and
				the licensee has not communicated with the consumer about the relationship for
				a period of 12 consecutive months, other than annual privacy notices, material
				required by law or regulation, communication at the direction of a state or
				federal authority, or promotional materials;
vii. The consumer is an insured or annuitant
				under an insurance policy or annuity, respectively, but is not the policyholder
				or owner of the insurance policy or annuity; or
viii. The consumer's last known address
				according to the licensee's records is invalid. For purposes of this
				regulation, an address of record is invalid if mail sent to that address by the
				licensee has been returned by the postal authorities as undeliverable and if
				subsequent attempts by the licensee to obtain a current valid address for the
				consumer have been unsuccessful.
K. "Financial institution" means any
				institution the business of which is engaging in activities that are financial
				in nature or incidental to such financial activities as described in section
				4 of the Bank Holding Company Act of 1956 (12
				U.S.C. §
											1843).
(1) Financial institution does not include:
(a) Any person or entity with respect to any
				financial activity that is subject to the jurisdiction of the Commodity Futures
				Trading Commission under the Commodity Exchange Act (7 U.S.C. §
													1 et seq.);
(b) The Federal Agricultural Mortgage
				Corporation or any entity charged and operating under the Farm Credit Act of
				1971 (12 U.S.C. §
													2001 et seq.); or
(c) Any institution chartered by Congress
				specifically to engage in securitizations, secondary market sales (including
				sales of servicing rights), or similar transactions related to a transaction of
				a consumer, as long as the institution does not sell or transfer nonpublic
				personal information to a nonaffiliated third party.
L. "Financial product or service"
				means any product or service that a financial holding company could offer by
				engaging in an activity that is financial in nature or incidental to such a
				financial activity under section
				4 of the Bank Holding Company Act of 1956 (12
				U.S.C. §
											1843).
(1)
				Financial service includes a financial institution's evaluation or brokerage of
				information that the financial institution collects in connection with a
				request or an application from a consumer for a financial product or
				service.
M. "Health care"
				means:
(1) Preventive, diagnostic,
				therapeutic, rehabilitative, maintenance or palliative care, services,
				procedures, tests or counseling that:
(a)
				Relates to the physical, mental or behavioral condition of an individual;
				or
(b) Affects the structure or
				function of the human body or any part of the human body, including the banking
				of blood, sperm, organs or any other tissue; or
(c) Prescribing, dispensing, or furnishing to
				an individual drugs or biologicals, medical devices, or health care equipment
				and supplies.
N. "Health care provider" means a physician
				or other health care practitioner licensed, accredited or certified to perform
				specified health services consistent with state law, or a health care
				facility.
O. "Health information"
				means any information or data except age or gender, whether oral or recorded in
				any form or medium, created by or derived from a health care provider or the
				consumer that relates to:
(1) The past,
				present or future physical, mental or behavioral health or condition of an
				individual;
(2) The provision of
				health care to an individual; or
(3) Payment for the provision of health care
				to an individual.
P.
				"Insurance product or service" means any product or service that is offered by
				a licensee pursuant to Part 3 of Title 8 V.S.A.
(1) Insurance service includes a licensee's
				evaluation, brokerage, or distribution of information that the licensee
				collects in connection with a request or an application from a consumer for an
				insurance product or service.
Q. "Licensee" means any licensed insurer,
				producer, or other person licensed or required to be licensed, authorized or
				required to be authorized, or registered or required to be registered pursuant
				to Part 3 of Title 8 V.S.A., except for a person registered under
				4248.
(1)
				"Licensee" also means an unauthorized insurer that accepts business placed
				through a licensed surplus lines broker in this State, but only in regard to
				the surplus lines insurance placed pursuant to Chapter 138 of Title 8
				V.S.A.
(2) A licensee is not
				subject to the notice and opt-in requirements for nonpublic personal financial
				information set forth in Articles 1, II, III and IV if the licensee is an
				employee, agent, or other representative of another licensee ("the principal")
				and:
(a) The principal otherwise complies
				with and provides the notices required by this regulation; and
(b) The licensee does not disclose any
				nonpublic personal financial information to any person other than the principal
				or its affiliates except in a manner permitted by this regulation.
(3) A surplus lines broker or
				surplus lines insurer shall be deemed to be in compliance with the notice and
				opt- in requirements for nonpublic personal financial information set forth in
				Articles I, II, III and IV provided that:
(a)
				The broker or insurer does not disclose nonpublic personal information of a
				consumer or customer to nonaffiliated third parties for any purpose, including
				joint servicing or marketing under section
				14, except as permitted by section
				15 or
				16; and
(b) The broker or insurer delivers a notice
				to the consumer at the time a customer relationship is established on which the
				following is printed in 16-point type:
PRIVACY NOTICE
"Neither the U.S. brokers that handled this insurance nor the
				  insurers that have underwritten this insurance will disclose nonpublic personal
				  information concerning the buyer to nonaffiliates of the brokers or insurers
				  except as permitted by law."
R. "Nonaffiliated third party" means any
				person except a licensee's affiliate or a person employed jointly by a licensee
				and any company that is not the licensee's affiliate (but nonaffiliated third
				party includes the other company that jointly employs the person).
(1) "Nonaffiliated third party" includes any
				company that is an affiliate solely by virtue of the direct or indirect
				ownership or control of the company by the licensee or its affiliate in
				conducting merchant banking or investment banking activities of the type
				described in section
				4 of the federal Bank Holding Company Act and
				12603 or insurance company investment
				activities of the type described in section
				4 of the federal Bank Holding Company Act (12
				U.S.C. §
												1843).
S. "Nonpublic personal health information"
				means health information:
T.
				"Nonpublic personal financial information" means personally identifiable
				financial information and any list, description, or other grouping of consumers
				(and publicly available information pertaining to them) that is derived using
				any personally identifiable financial information that is not publicly
				available.
(1) "Nonpublic personal financial
				information" does not include:
(a) Health
				information;
(b) Publicly available
				information, except as included on a list described in subdivision (1)(c) of
				this subsection
				1 T; or
(c) Any list, description or other grouping
				of consumers (and publicly available information pertaining to them) that is
				derived without using any personally identifiable financial information that is
				not publicly available.
(2) Examples.
(a) Nonpublic personal financial information
				includes any list of individuals' names and street addresses that is derived in
				whole or in part using personally identifiable financial information that is
				not publicly available, such as account numbers.
(b) Nonpublic personal financial information
				does not include any list of individuals' names and addresses that contains
				only publicly available information, is not derived in whole or in part using
				personally identifiable financial information that is not publicly available,
				and is not disclosed in a manner that indicates that any of the individuals on
				the list is a consumer of a financial institution.
U. "Nonpublic personal health
				information" means health information that identifies an individual who is the
				subject of the information or with respect to which there is a reasonable basis
				to believe that the information could be used to identify an
				individual.
V. "Opt in" or "Opt-in"
				means the written or, if the consumer agrees, electronic authorization of the
				consumer allowing a licensee to disclose nonpublic personal financial
				information to a nonaffiliated third party, other than as permitted under
				sections 14,
				15, or 16.
W. "Personally identifiable financial
				information" means any information that a consumer provides to a licensee to
				obtain an insurance product or service from the licensee, that is about a
				consumer a n d results from a transaction involving an insurance product or
				service between a licensee and a consumer, or that the licensee otherwise
				obtains about a consumer in connection with providing an insurance product or
				service to that consumer.
(1) Examples.
(a) Information included. Personally
				identifiable financial information includes:
i. Information a consumer provides to a
				licensee on an application to obtain an insurance product or service;
ii. Account balance information and payment
				history;
iii. The fact that an
				individual is or has been one of the licensee's customers or has obtained an
				insurance product or service from the licensee;
iv. Any information about the licensee's
				consumer if it is disclosed in a manner that indicates that the individual is
				or has been the licensee's consumer;
v. Any information that a consumer provides
				to a licensee or that the licensee or its agent otherwise obtains in connection
				with collecting on a loan or servicing a loan;
vi. Any information the licensee collects
				through an Internet cookie (an information-collecting device from a web
				server); and
vii. Any information
				from a consumer report.
(b) Information not included. Personally
				identifiable financial information does not include:
i. Health information;
ii. A list of names and addresses of
				customers of an entity that is not a financial institution; or
iii. Information that does not identify a
				consumer, such as aggregate information or blind data that does not contain
				personal identifiers such as account numbers, names, or addresses.
X. "Publicly
				available information" means any information that a licensee has a reasonable
				basis to believe is lawfully made available to the general public from federal,
				state, or local government records, widely distributed media, or disclosures to
				the general public that are required to be made by federal, state, or local
				law.
(1) Reasonable basis. A licensee has a
				reasonable basis to believe that information is lawfully made available to the
				general public if the licensee has taken steps to determine:
(a) That the information is of the type that
				is available to the general public; and
(b) Whether an individual can direct that the
				information not be made available to the general public and, if so, that the
				licensee's consumer has not done so.
(2) Examples.
(a) Government records. Publicly available
				information in government records includes information in government real
				estate records and security interest filings.
(b) Widely distributed media. Publicly
				available information from widely distributed media includes information from a
				telephone book, television or radio program, newspaper, or website that is
				available to the general public on an unrestricted basis. A website is not
				restricted merely because an Internet service provider or site operator
				requires a fee or password, so long as access is available to the general
				public.
(c) Reasonable basis.
i. A licensee has a reasonable basis to
				believe that mortgage information is lawfully made available to the general
				public if the licensee has determined that the information is of the type
				included on the public record in the jurisdiction where the mortgage would be
				recorded.
ii. A licensee has a
				reasonable basis to believe that an individual's telephone number is lawfully
				made available to the general public if the licensee has located the telephone
				number in the telephone book or the consumer has informed the licensee that the
				telephone number is not unlisted.