NATIONAL INSURANCE CRIME BUREAU - Laserfiche WebLink

16 Part 5: Regulations and Statutes 1 . Compliance with Privacy Regulations and Rules Participating Organizations and Authorized Users of ISO ClaimSearch® and the ISO ClaimSearch Information may access and shall use the database and information exclusively for purposes of insurance claim processing and investigating, as well as fraud detection and prevention. The Gramm- Leach-Bliley Act of 1999 (P.L. 106–102, 15 U.S.C., Section 6801 et seq) and the National Association of Insurance Commissioners’ Privacy of Consumer Financial and Health Information Model Regulation (“NAIC Model Rule”) and Insurance Information and Privacy Protection Model Act (“NAIC Model Act”) permit the use of the database for fraud-fighting and claims administration purposes. The Gramm-Leach-Bliley Act and the NAIC Model Act govern the privacy, confidentiality, and non- disclosure of personal information. Title V of the Gramm-Leach-Bliley Act protects the confidentiality of nonpublic personal information. Title V also contains exceptions that protect essential insurer business functions. Those exceptions—found in Sections 502(e)(1), (3), (4), (6), and (8)—permit insurers to exchange information with ISO and with each other for purposes of claims processing and fraud detection and prevention without application of the Act’s consumer notice or opt-out requirements. The NAIC Model Rule contains similar exceptions. The NAIC Model Act establishes standards for the collection, use, and disclosure of information that insurance institutions, agents, and support organizations collect in connection with insurance transac- tions. Section 13 of the NAIC Model Act specifically permits insurers to disclose personal information— without the individual’s authorization—to other insurers and insurance support organizations for purposes of claims investigation. To the extent adopted by individual states without modification, the National Association of Insurance Commissioners (NAIC) Model Regulation on Privacy of Consumer Financial Health Information and the NAIC Insurance Information and Privacy Protection Model Act govern the use and disclosure of non public personal information and specifically authorize the use and disclosure of such information as made available in the ISO ClaimSearch database for insurance claims processing and fraud detection and prevention purposes. In connection with services that Insurance Services Office, Inc. (ISO) makes available to covered entities through the ISO ClaimSearch database, ISO’s cybersecurity program complies with the requirements of the New York Department of Financial Service’s Cybersecurity Regulation (23 NYCRR Part 500) currently in effect concerning data protection and the security of information systems and databases. ISO will conduct its operations consistent with the United States Department of Health and Human Services (HHS) medical privacy rule implementing the Health Insurance Portability and Accountability Act (HIPAA) of 1996, the HIPAA Security Rule, the Health Information Technology for Economic and Clinical Health (HITECH) Act, and the Final HIPAA Omnibus Rule. Property/casualty (including workers’ com pensation) insurers are not “covered entities” as defined in the medical information privacy rule. Property/casualty insurer disclosures to and use of ISO ClaimSearch are not subject to the rule. However, a small minority of ISO Participating Organizations are covered entities and participate in their role as a covered entity, thus are subject to the terms of the HIPAA rule. ISO will ensure that Docusign Envelope ID: 329281D2-142C-8B83-837A-7CD218C257C4