License insurance company data to AI: who sets the rules
The short answer
License insurance company data to AI: GLBA sends enforcement to your state insurance regulator. NAIC Model 672 requires authorization before health data leaves. Mercor lists insurance. No price published for insurance data. State rules decide what applies.
This page reports what the texts and buyer pages say. It is not legal advice.
Which companies list insurance?
Mercor's data page names "Finance & Insurance" among eight sectors. Its data types are statements, underwriting files and claims (self-reported).
micro1's page lists six areas, none named insurance. See does industry matter for the side-by-side.
Who enforces privacy rules against an insurance company?
15 U.S.C. 6805(a) lists the agencies that enforce the federal privacy subtitle. Paragraph (6) covers "any person engaged in providing insurance." The applicable State insurance authority of the State in which the person is domiciled enforces it.
So an insurer's regulator is usually a state department of insurance. Which state, and what its rules say, depends on where the company is domiciled.
What does the NAIC model say about health information?
The NAIC publishes Model 672, the Privacy of Consumer Financial and Health Information Regulation. It is only a model. A state adopts its own version, or none.
Section 18A of the model says a licensee shall not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained. Section 18B lists insurance functions that need no authorization. They include claims administration, underwriting, fraud detection and actuarial research.
Section 19 says an authorization must:
- Be written or electronic.
- Describe the information, the recipients and the purpose.
- Carry a signature and date.
- State how long it lasts and how to revoke it.
- Last no more than 24 months.
I read the 2017 edition of the model text. Whether your state adopted it, and in what form, is a question for counsel.
What about financial information?
The federal side uses notice and opt-out. My health and financial data page reads Regulation P, and the do-not-license list sets it beside HIPAA and FERPA.
What can an insurer or agency gather first?
List these three things:
- Which states you are licensed in.
- Which systems hold policyholder records.
- Which privacy notices policyholders received.
The rights check asks whether financial or health privacy rules apply and lists what to settle with counsel.
Talk to a privacy or commercial lawyer in your state before you sign.
micro1 may pay us a referral fee if a company we introduce goes ahead with it. How we are paid
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
