21-053 Code Vt. R. 21-020-053-X
Current through August, 2024
This regulation is promulgated pursuant to the authority granted by 8 V.S.A. §§ 10, 15, 3381, 3541 et seq., 3688, 3829, 3858, 4062, 4108, 4113, 4201, 4362, 4373, 4464, 4480, 4481, 4515a, 4587, 4690, Chapter 129, 4812, 4836, 4902, 4990, 5104, 5111, 6015, 8005, 8014, 8053, and 1972, Act No. 72 (Adj. Sess.), § 1.
The examples in this regulation and the sample clauses in Appendix A of this regulation are not exclusive. The examples in this regulation and the sample clauses in the Appendix of this regulation provide guidance concerning the rule's application in ordinary circumstances. The facts and circumstances of each individual situation, however, will determine whether compliance with an example or use of a sample clause, to the extent applicable, constitutes compliance with this regulation.
As used in this regulation, unless the context requires otherwise:
PRIVACY NOTICE
"Neither the U.S. brokers that handled this insurance nor the insurers that have underwritten this insurance will disclose nonpublic personal information concerning the buyer to nonaffiliates of the brokers or insurers except as permitted by law."
Sections 15 or 16 of this regulation, in the ordinary course of business to carry out the activity covered by the exception under which the licensee received the information.
A request for authorization and an authorization form may be delivered to a consumer or a customer as part of an opt in notice pursuant to Section 10, provided that the request and the authorization form are clear and conspicuous. An authorization form is not required to be delivered to the consumer or customer or included in any other notices unless the licensee intends to disclose protected health information pursuant to Section 17A.
Irrespective of whether a licensee is subject to the federal Health Insurance Portability and Accountability Act privacy rule as promulgated by the U.S. Department of Health and Human Services, 45 C.F.R. Parts 160 and 164, (the "federal rule"), if a licensee complies with all requirements of the federal rule and its effective date provision, the licensee shall be deemed to be in compliance with the provisions of this Article V; provided, however, a licensee shall be prohibited from making disclosures under the provisions of 45 C.F.R § 164.514(e)(2) without the consumer's prior written consent.
Nothing in this article shall preempt or supercede state law related to medical records, health or insurance information privacy.
In addition to any other sanctions available to the commissioner under Vermont law for violations of this rule, any violation of this rule shall be deemed to be an unfair method of competition or an unfair or deceptive act or practice in the conduct of the business of insurance in this State for the purposes of Chapter 129 of title 8 V.S.A.
If any section or portion of a section of this regulation or its applicability to any person or circumstance is held invalid by a court, the remainder of the regulation or the applicability of the provision to other persons or circumstances shall not be affected.
Appendix A Sample Clauses
Licensees, including a group of financial holding company affiliates that use a common privacy notice, may use the following sample clauses, if the clause is accurate for each institution that uses the notice. (Note that disclosure of certain information, such as assets, income and information from a consumer reporting agency, may give rise to obligations under the federal Fair Credit Reporting Act and Vermont Fair Credit Reporting Act, such as a requirement to permit a consumer to opt in to disclosures to affiliates or designation as a consumer reporting agency if disclosures are made to nonaffiliated third parties.)
A-1-Categories of information a licensee collects (all institutions)
A licensee may use this clause, as applicable, to meet the requirement of Section 7A(1) to describe the categories of nonpublic personal information the licensee collects.
Sample Clause A-1:
We collect nonpublic personal information about you from the following sources:
. Information we receive from you on applications or other forms;
. Information about your transactions with us, our affiliates or others; and
. Information we receive from a consumer reporting agency.
A-2-Categories of information a licensee discloses (institutions that disclose outside of the exceptions)
A licensee may use one of these clauses, as applicable, to meet the requirement of Section 7A(2) to describe the categories of nonpublic personal financial information the licensee discloses. The licensee may use these clauses if it discloses nonpublic personal financial information other than as permitted by the exceptions in Sections 14, 15 and 16. Sample Clause A-2, Alternative 1: We may disclose the following kinds of nonpublic personal financial information about you:
. Information we receive from you on applications or other forms, such as [provide illustrative examples, such as "your name, address, social security number, assets, income, and beneficiaries"];
. Information about your transactions with us, our affiliates or others, such as [provide illustrative examples, such as "your policy coverage, premiums, and payment history"]; and
. Information we receive from a consumer reporting agency, such as [provide illustrative examples, such as "your creditworthiness and credit history"].
Sample Clause A-2, Alternative 2:
We may disclose all of the information that we collect, as described [describe location in the notice, such as "above" or "below"].
A-3-Categories of information a licensee discloses and parties to whom the licensee discloses (institutions that do not disclose outside of the exceptions)
A licensee may use this clause, as applicable, to meet the requirements of Sections 7A(2), (3), and (4) to describe the categories of nonpublic personal information about customers and former customers that the licensee discloses and the categories of affiliates and nonaffiliated third parties to whom the licensee discloses. A licensee may use this clause if the licensee does not disclose nonpublic personal financial information to any party, other than as permitted by the exceptions in Sections 15 and 16.
Sample Clause A-3:
We do not disclose any nonpublic personal financial information about our customers or former customers to anyone, except as permitted by law.
A-4-Categories of parties to whom a licensee discloses (institutions that disclose outside of the exceptions)
A licensee may use this clause, as applicable, to meet the requirement of Section 7A(3) to describe the categories of affiliates and nonaffiliated third parties to whom the licensee discloses nonpublic personal information. This clause may be used if the licensee discloses nonpublic personal financial information other than as permitted by the exceptions in Sections 14, 15 and 16, as well as when permitted by the exceptions in Sections 15 and 16. Sample Clause A-4:
We may disclose nonpublic personal information about you to the following types of third parties:
. Financial service providers, such as [provide illustrative examples, such as "life insurers, automobile insurers, mortgage bankers, securities broker-dealers, and insurance agents"];
. Non-financial companies, such as [provide illustrative examples, such as "retailers, direct marketers, airlines, and publishers"]; and
. Others, such as [provide illustrative examples, such as "non-profit organizations"]. We may also disclose nonpublic personal information about you to third parties as permitted by law.
A-5-Service provider/joint marketing exception
A licensee may use one of these clauses, as applicable, to meet the requirements of Section 7A(5) related to the exception for service providers and joint marketing in Section 14. If a licensee discloses nonpublic personal financial information under this exception, the licensee shall describe the categories of nonpublic personal financial information the licensee discloses and the categories of third parties with which the licensee has contracted. Sample Clause A-5, Alternative 1: We may disclose the following information to companies that perform services on our behalf:
. Information we receive from you on applications or other forms, such as [provide illustrative examples, such as "your name, address, social security number, assets, income, and beneficiaries"];
. Information about your transactions with us, our affiliates or others, such as [provide illustrative examples, such as "your policy coverage, premium, and payment history"]; and
. Information we receive from a consumer reporting agency, such as [provide illustrative examples, such as "your creditworthiness and credit history"].
Sample Clause A-5, Alternative 2:
We may disclose all of the information we collect, as described [describe location in the notice, such as "above" or "below"] to companies that perform services on our behalf.
Sample Clause A-5, Alternative 3:
We may disclose the following information to other financial institutions with which we have joint marketing agreements:
. The following information we receive from you: "your name and contact information";
. Information about your transactions with us or our affiliates, such as [provide illustrative examples of transaction and experience information, such as "your policy coverage, premium, and payment history"].
A-6-Explanation of opt in (institutions that disclose to a nonaffiliated third party outside of the exceptions)
A licensee may use this clause, as applicable, to meet the requirement of Section 7A(6) to provide an explanation of the consumer's right to authorize the disclosure of nonpublic personal financial information to nonaffiliated third parties, including the method(s) by which the consumer may exercise those rights. The licensee may use this clause if the licensee discloses nonpublic personal financial information to nonaffiliated third parties other than as permitted by the exceptions in Sections 14, 15 and 16.
Sample Clause A-6:
We will not disclose nonpublic personal financial information about you to nonaffiliated third parties (other than as permitted by law) unless you authorize us to make that disclosure. Your authorization must be in writing or, if you agree, in electronic form. If you wish to authorize us to disclose your nonpublic personal financial information to nonaffiliated third parties, you may [describe the means to opt in, such as "complete and sign the enclosed, postage prepaid card and mail it to us."].
A-7-Confidentiality and security (all institutions)
A licensee may use this clause, as applicable, to meet the requirement of Section 7A(8) to describe its policies and practices with respect to protecting the confidentiality and security of nonpublic personal information.
Sample Clause A-7:
We restrict access to nonpublic personal information about you to [provide an appropriate description, such as "those employees who need to know that information to provide products or services to you"]. We maintain physical, electronic, and procedural safeguards that comply with state and federal law to guard your nonpublic personal information. 8 V.S.A. §§ 10, 15, 3381, 3541 et seq., 3688, 3829, 3858, 4062, 4108, 4113, 4201, 4362, 4373, 4464, 4480, 4481, 4515a, 4587, 4690, Chapter 129, 4812, 4836, 4902, 4990, 5104, 5111, 6015, 8005, 8014, 8053
21-053 Code Vt. R. 21-020-053-X