NATIONAL INSURANCE CRIME BUREAU - Laserfiche WebLink

27 Part 11: Questions and Answers Q: What is the purpose of the 2019 ISO ClaimSearch® Privacy and Security Policies Statement? A: The 2019 policies update our earlier policy document distributed in 2015. The changes refer to updates regarding the safeguarding of ISO ClaimSearch information, information disclosure policies for ISO personnel, and ISO ClaimSearch Participating Organizations. The major concern in all of ISO’s privacy and security policies and procedures is the protection of insurers’ data and individuals’ personal information. ISO operates in full compliance with applicable laws, such as the Gramm-Leach-Bliley Act, the NAIC Insurance Information and Privacy Protection Model Act (which several states have adopted), and the HIPAA medical record privacy and Health Information Technology for Economic and Clinical Health (HITECH) rules. Q: What can Participating Organizations do to keep data safe and ensure the protection of individuals’ personal information? A: Participating Organizations must ensure that information from the system is used only for the adjustment of claims and that their Authorized Users access the information appropriately. Q: What should a user do if he or she discovers data is being used inappropriately? A: The user should follow the Participating Organization’s internal reporting process and contact ISO ClaimSearch Customer Support. Q: Did HIPAA’s Final Omnibus Rule of 2013 affect ISO ClaimSearch Participating Organizations? A: The majority of ISO ClaimSearch Participating Organizations are from the property/casualty industry. Property/casualty insurers are not considered covered entities under the HIPAA and HITECH Acts. Since claims reported to the Participating Organization and subsequently to ISO ClaimSearch are excepted benefits, the HIPAA and HITECH rules do not apply. Specific protections are in place for information reported to the system from Participating Organizations that are considered covered entities, such as health and disability insurers. The Final Omnibus Rule did not alter the procedures regarding excepted benefits (see the HIPAA section, Part 9, of the document). Q: What entities, other than ISO ClaimSearch Participating Organizations, can get access to ISO ClaimSearch reports? A: Law enforcement, state insurance fraud bureaus, and the National Insurance Crime Bureau (NICB) can gain access to ISO ClaimSearch reports for claims investigation, provided Participating Organizations agree to allow them access to their data. In the absence of authorization by the companies, access is permitted to specific claims information through the legal process. Citizens can gain access to reports on themselves for verification purposes through a Citizen Inquiry process. Q: Can ISO change or remove reports submitted by Participating Organizations? A: The data in ISO ClaimSearch is owned by the submitting companies. ISO ClaimSearch is a data custodian and will not change, modify, or delete any ISO ClaimSearch report without the express request or consent of the Participating Organization. Q: Does ISO ClaimSearch purge data from the database on any schedule or time frame? A: ISO ClaimSearch was established in 1997 from the merger of The Index System, the Property Insurance Loss Register, and the auto database operated by the NICB. At that time, the claims reflected receipt dates back to 1992. Since the beginning of ISO ClaimSearch development in 1997, we have not automatically purged the database of any reports except for removals requested by Participating Organizations. Docusign Envelope ID: 329281D2-142C-8B83-837A-7CD218C257C4