Oregon Underwriting Questions and Insurance Information Privacy

Oregon rules on underwriting questions and personal information

You have already studied the sources of underwriting information: the application, the medical examination, the producer’s report, the Medical Information Bureau and investigative consumer reports. Oregon adds two sets of rules on top of that general framework. The first limits which questions an application may ask and how HIV testing is handled. The second governs how the personal information gathered during underwriting may be collected, used and disclosed.

Both apply to producers personally, not only to insurers.

Medical and lifestyle questions

Oregon’s underwriting rules in OAR 836-050-0230 to 836-050-0255 apply to every transaction of life and health insurance in the state, individual and group, and to insurers, insurance producers and insurance-support organizations alike.

Sexual orientation prohibited (OAR 836-050-0240)

• No question on a life or health application, and no investigation connected with an application, may be directed toward determining the applicant’s sexual orientation
• Sexual orientation may not be used in underwriting or in determining insurability
• Insurers must direct insurance-support organizations not to investigate, directly or indirectly, the sexual orientation of an applicant or a beneficiary
• Testing for, or asking medical questions about, HIV infection is prohibited unless it is done together with testing for, or asking about, other health conditions. HIV testing alone is permitted only where the applicant has already answered that they have tested positive or been diagnosed

Medical and lifestyle questions (OAR 836-050-0245)

This rule sets out what a medical or lifestyle question on an application may and may not do.

• No question may be designed to establish the applicant’s sexual orientation
• Questions about HIV infection, including AIDS or ARC, must be factual and designed to establish whether the condition exists. An insurer may ask “Have you been diagnosed or treated for…?” but may not ask “Do you believe you may have…?” or “Have you had any indications of…?”
• HIV questions may be asked only if questions about other high-risk medical conditions are also asked, and they must be presented, asked and used in the same manner as those other questions
• Questions about symptoms that could reveal a medical condition are allowed if they are not used to establish sexual orientation and the applicant can give a detailed explanation for any “yes” answer. These questions must cover a finite period before the application, not more than ten years. The ten-year limit does not apply to questions about a prior diagnosis, treatment or testing
• Questions about having, or having been diagnosed with or advised to seek treatment for, a sexually transmitted disease are permitted
• Marital status, living arrangements, occupation, gender, medical history, beneficiary designation, and zip code or other territory may not be used to establish, or help establish, sexual orientation
• Territorial rates are allowed only when they rest on sound actuarial principles and actual or reasonably anticipated experience
• No adverse underwriting decision may be based on the fact that an applicant sought counseling from a health care professional about HIV-related concerns. This protection does not extend to seeking treatment or diagnosis

Sidenote

Know this...

The beneficiary designation is on the list for a reason. An underwriter may not treat the choice of a same-sex beneficiary, or a shared address, as evidence of anything.

Testing for HIV infection (OAR 836-050-0250 and 836-050-0255)

• A test may be performed only with the applicant’s informed, signed consent on a form the Director has approved. The consent identifies the specific tests and names the person to whom a final positive result is reported: a named physician, the county health department, or the applicant directly
• The applicant must be told the test is used to determine insurability and must receive an informational brochure at or before consent
• A signed consent is valid for six months
• An insurer may rate or deny coverage on a test result only if the result was confirmed by the full protocol: two positive ELISA tests confirmed by a Western Blot test, or another series the state epidemiologist finds no less accurate
• An application may ask whether the applicant has tested positive. It may not ask only whether the applicant has taken an HIV test, regardless of outcome
• An insurer may report only a nonspecific abnormality to the Medical Information Bureau, and only after a confirmed positive result, never after a preliminary test alone

Use and disclosure of insurance information

Oregon’s Insurance Information and Privacy Protection law, ORS 746.600 to 746.690, establishes standards for how insurers, producers and insurance-support organizations collect, use and disclose personal information gathered in insurance transactions. In the case of life insurance it protects Oregon residents, meaning anyone whose last known mailing address in the insurer’s records is in Oregon.

Its stated purposes (ORS 746.605) are to limit the disclosure of personal information, let people find out what has been collected about them and dispute its accuracy, keep the collection of information fair and minimally intrusive, and let applicants learn the reasons for an adverse underwriting decision.

Pretext interviews (ORS 746.615)

A pretext interview is one in which the interviewer pretends to be someone else, pretends to represent someone they do not, or misrepresents the purpose of the interview. Pretext interviews may not be used to obtain personal information in connection with an insurance transaction. The only exception is a claim investigation where there is a reasonable basis to suspect criminal activity, fraud, or material misrepresentation or nondisclosure, and even then not with a person who has a privileged relationship with the subject.

Notice of information practices (ORS 746.620)

A licensee must give a clear and conspicuous written notice of its personal information practices to a consumer who becomes a customer, generally no later than the date the customer relationship begins, and, with limited exceptions, at least annually after that while the relationship continues. The notice describes the categories of information collected and disclosed, who it is disclosed to, how it is protected, and the individual’s rights of access and correction.

A producer does not have to send a separate notice when the insurer the producer represents sends one and the producer discloses information only to that insurer or its affiliates.

Disclosure authorization forms (ORS 746.630)

When an insurer or producer asks an applicant to sign a form authorizing others to release information to it (for example, doctors and hospitals), the form must be clear and conspicuous and state:

• Who the information is about
• The categories of information to be disclosed
• The parties to whom it may be disclosed and the purpose
• How long the authorization lasts, that it may be revoked at any time, and how to revoke it

It must be signed and dated, and in Oregon an authorization is not valid for more than 24 months.

Sidenote

Know this...

Some national materials describe an application authorization as good for up to 30 months. For an insurance transaction subject to Oregon law, the limit is 24 months under ORS 746.630(2).

Investigative consumer reports (ORS 746.635)

Before an insurer or producer prepares or requests an investigative consumer report in connection with an application, renewal, reinstatement or change in benefits, the individual must be told that they may ask to be personally interviewed for the report, and that they are entitled to a copy of it on request.

Access and correction (ORS 746.640 and 746.645)

• An individual may make a written request for access to recorded personal information about them. Within 30 business days the insurer, producer or support organization must tell them what it holds, let them see and copy it, identify who it was disclosed to in the prior two years, and explain how to request a correction
• Medical information supplied by a health care provider may be given to the individual directly or through a health care provider the individual designates
• Within 30 business days of a written request to correct, amend or delete information, the holder must either make the change or explain why it refuses, and tell the individual of the right to file a statement of disagreement

Adverse underwriting decisions (ORS 746.650 and 746.660)

An adverse underwriting decision includes declining coverage, terminating coverage, and a producer’s refusal to apply for coverage with an insurer the producer represents when the applicant asks for it. When one is made, the insurer or producer responsible must:

• Give the specific reasons in writing, or tell the applicant they may request them in writing, and
• Give a summary of the applicant’s rights of access and correction

If the applicant makes a written request within 90 business days, the specific reasons, the items of information supporting them, and the institutional sources must be provided within 21 business days.

An adverse decision may not be based on the mere fact of a previous adverse underwriting decision, or solely on information from an insurance-support organization whose primary source is other insurers. The underwriter may act on the further information such a lead turns up.

Limits on disclosure (ORS 746.665)

Personal or privileged information collected in an insurance transaction may not be disclosed except under conditions the statute lists. The main ones are:

• With the individual’s written authorization
• To a person performing an insurance or business function for the licensee, who agrees not to disclose it further
• To another insurer or support organization to detect or prevent fraud or material misrepresentation, or to perform its function in the transaction
• To a health care provider to verify coverage or inform the individual of a medical problem
• To an insurance regulator, to law enforcement where fraud or illegal activity is suspected, or in response to a valid court or administrative order
• For actuarial or research studies in which no individual can be identified

Credit history notices (OAR 836-080-0430)

Oregon also requires an insurer or producer to tell a consumer before checking the consumer’s credit history or insurance score, and to offer a written statement explaining how credit information is used. These notice rules are written for personal insurance, which Oregon law defines as private passenger auto, homeowners and renters, personal dwelling, personal liability and theft, and personal inland marine coverage (ORS 746.600(33)). They do not apply to the underwriting of a life policy. A life application that uses a consumer report is governed by the investigative consumer report and adverse underwriting decision rules above and by the federal Fair Credit Reporting Act.

Lesson summary

• Oregon prohibits any application question or investigation aimed at an applicant’s sexual orientation, and bars using marital status, living arrangements, occupation, gender, medical history, beneficiary designation or zip code as a proxy for it (OAR 836-050-0240, 836-050-0245).
• HIV questions must be factual and asked alongside questions about other high-risk conditions. Symptom questions may look back no more than ten years, except for prior diagnosis, treatment or testing.
• HIV testing requires signed, informed consent on an approved form, valid for six months. Coverage may be rated or denied only on a result confirmed by the full test protocol (OAR 836-050-0250).
• Pretext interviews are prohibited except in suspected-fraud claim investigations (ORS 746.615).
• Licensees give a privacy notice when a customer relationship begins and, with limited exceptions, at least annually (ORS 746.620).
• A disclosure authorization must meet content requirements and is valid for no more than 24 months (ORS 746.630).
• Access and correction requests are answered within 30 business days (ORS 746.640, 746.645).
• Reasons for an adverse underwriting decision must be given in writing or on written request. A request made within 90 business days is answered within 21 business days (ORS 746.650). A prior adverse decision alone may not be the basis for a new one (ORS 746.660).