# License insurance company data to AI: who sets the rules

> Want to sell insurance company data to AI? A license answers to state regulators under GLBA. The NAIC model asks for authorization before health data leaves.

By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/sell-insurance-company-data-to-ai  
Published: 2026-07-08  
Updated: 2026-10-14

## The short answer

License insurance company data to AI: GLBA sends enforcement to your state insurance regulator. NAIC Model 672 requires authorization before health data leaves. Mercor lists insurance. No price published for insurance data. State rules decide what applies.

This page reports what the texts and buyer pages say. It is not legal advice.

## Which companies list insurance?

[Mercor's data page](https://www.mercor.com/data/) names "Finance & Insurance" among eight sectors. Its data types are statements, underwriting files and claims (self-reported).

micro1's page lists six areas, none named insurance. See [does industry matter](/answers/does-industry-matter-for-selling-company-data) for the side-by-side.

## Who enforces privacy rules against an insurance company?

[15 U.S.C. 6805(a)](https://www.law.cornell.edu/uscode/text/15/6805) lists the agencies that enforce the federal privacy subtitle. Paragraph (6) covers "any person engaged in providing insurance." The applicable State insurance authority of the State in which the person is domiciled enforces it.

So an insurer's regulator is usually a state department of insurance. Which state, and what its rules say, depends on where the company is domiciled.

## What does the NAIC model say about health information?

The NAIC publishes [Model 672](https://content.naic.org/sites/default/files/model-law-672.pdf), the Privacy of Consumer Financial and Health Information Regulation. It is only a model. A state adopts its own version, or none.

Section 18A of the model says a licensee shall not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained. Section 18B lists insurance functions that need no authorization. They include claims administration, underwriting, fraud detection and actuarial research.

Section 19 says an authorization must:

- Be written or electronic.
- Describe the information, the recipients and the purpose.
- Carry a signature and date.
- State how long it lasts and how to revoke it.
- Last no more than 24 months.

I read the 2017 edition of the model text. Whether your state adopted it, and in what form, is a question for counsel.

## What about financial information?

The federal side uses notice and opt-out. My [health and financial data page](/answers/can-i-sell-health-or-financial-client-data-to-ai) reads Regulation P, and the [do-not-license list](/answers/what-data-can-i-not-sell-to-ai) sets it beside HIPAA and FERPA.

## What can an insurer or agency gather first?

List these three things:

- Which states you are licensed in.
- Which systems hold policyholder records.
- Which privacy notices policyholders received.

The [rights check](/rights-check) asks whether financial or health privacy rules apply and lists what to settle with counsel.

Talk to a privacy or commercial lawyer in your state before you sign.

micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure)

Figure: comparison of Three layers of insurance privacy text: GLBA (Federal duty), State regulator (Enforces for insurers), NAIC Model 672 (emphasized: Authorization for health data, Authorization). NAIC Model 672 is filled because it asks for an authorization before a licensee discloses health information.

_Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._

## Sources

- [Mercor's data page](https://www.mercor.com/data/)
- [15 U.S.C. 6805(a)](https://www.law.cornell.edu/uscode/text/15/6805)
- [Model 672](https://content.naic.org/sites/default/files/model-law-672.pdf)