791. The purpose of this article is to ... to establish a regulatory mechanism to enable natural persons to ascertain what information is being or has been collected about them in connection with insurance transactions and to have access to such information for the purpose of verifying or disputing its accuracy; to limit the disclosure of information collected in connection with insurance transactions; and to enable insurance applicants and policyholders to obtain the reasons for any adverse underwriting decision.791.01. (a) The obligations imposed by this article shall apply to those insurance institutions, agents or insurance-support organizations which, on or after October 1, 1981: (1) In the case of life or disability insurance: (A) Collect, receive or maintain information in connection with insurance transactions which pertains to natural persons who are residents of this state, or (B) Engage in insurance transactions with applicants, individuals or policyholders who are residents of this state. . . . (b) The rights granted by this article shall extend to: (1) In the case of life or disability insurance, the following persons who are residents of this state: (A) Natural persons who are the subject of information collected, received or maintained in connection with insurance transactions. (B) Applicants, individuals or policyholders who engage in or seek to engage in insurance transactions. . . .
791.02. As used in this act: (a) (1) "Adverse underwriting decision" means any of the following actions with respect to insurance transactions involving insurance coverage that is individually underwritten: (A) A declination of insurance coverage. (B) A termination of insurance coverage. (C) Failure of an agent to apply for insurance coverage with a specific insurance institution that the agent represents and that is requested by an applicant. . . . (E) In the case of a life, health, or disability insurance coverage, an offer to insure at higher than standard rates. (2) Notwithstanding paragraph (1), any of the following actions shall not be considered adverse underwriting decisions but the insurance institution or agent responsible for their occurrence shall nevertheless provide the applicant or policyholder with the specific reason or reasons for their occurrence: (A) The termination of an individual policy form on a class or statewide basis. (B) A declination of insurance coverage solely because coverage is not available on a class or statewide basis. (C) The rescission of a policy. . . . (k) . . ."Insurance institution" shall not include agents, insurance-support organizations, or health care service plans regulated pursuant to the Knox-Keene Health Care Service Plan Act, (l) "Insurance-support organization" means: (1) Any person who regularly engages, in whole or in part, in the business of assembling or collecting information about natural persons for the primary purpose of providing the information to an insurance institution or agent for insurance transactions, including either of the following: (A) The furnishing of consumer reports or investigative consumer reports to an insurance institution or agent for use in connection with an insurance transaction. (B) The collection of personal information from insurance institutions, agents, or other insurance-support organizations for the purpose of detecting or preventing fraud, material misrepresentation or material nondisclosure in connection with insurance underwriting or insurance claim activity. (2) Notwithstanding paragraph (1), the following persons shall not be considered "insurance-support organizations": agents, governmental institutions, insurance institutions, medical care institutions, medical professionals, and peer review committees. (m) "Insurance transaction" means any transaction involving insurance primarily for personal, family, or household needs rather than business or professional needs that entails either of the following: (1) The determination of an individual's eligibility for an insurance coverage, benefit, or payment. (2) The servicing of an insurance application, policy, contract, or certificate. . . . (o) "Medical care institution" means any facility or institution that is licensed to provide health care services to natural persons, including but not limited to, hospitals, skilled nursing facilities, home health agencies, medical clinics, rehabilitation agencies, and public health agencies. (p) "Medical professional" means any person licensed or certified to provide health care services to natural persons, including but not limited to, a physician, dentist, nurse, optometrist, physical or occupational therapist, psychiatric social worker, clinical dietitian, clinical psychologist, chiropractor, pharmacist, or speech therapist. (q) "Medical record information" means personal information that is both of the following: (1) Relates to an individual's physical or mental condition, medical history or medical treatment. (2) Is obtained from a medical professional or medical care institution, from the individual, or from the individual's spouse, parent, or legal guardian. . . . (s) "Personal information" means any individually identifiable information gathered in connection with an insurance transaction from which judgments can be made about an individual's character, habits, avocations, finances, occupation, general reputation, credit, health, or any other personal characteristics. "Personal information" includes an individual's name and address and "medical record information" but does not include "privileged information." . . . (v) "Privileged information" means any individually identifiable information that both: (1) Relates to a claim for insurance benefits or a civil or criminal proceeding involving an individual. (2) Is collected in connection with or in reasonable anticipation of a claim for insurance benefits or civil or criminal proceeding involving an individual. However, information otherwise meeting the requirements of this division shall nevertheless be considered "personal information" under this act if it is disclosed in violation of Section 791.13. . . . (x) "Termination of insurance coverage" or "termination of an insurance policy" means either a cancellation or nonrenewal of an insurance policy, in whole or in part, for any reason other than the failure to pay a premium as required by the policy. . . .
791.08. (a) If any individual, after proper identification, submits a written request to an insurance institution, agent or insurance-support organization for access to recorded personal information about the individual which is reasonably described by the individual and reasonably locatable and retrievable by the insurance institution, agent or insurance-support organization, the insurance institution, agent or insurance-support organization shall within 30 business days from the date such request is received: (1) Inform the individual of the nature and substance of such recorded personal information in writing, by telephone or by other oral communication, whichever the insurance institution, agent or insurance-support organization prefers; (2) Permit the individual to see and copy, in person, such recorded personal information pertaining to him or her or to obtain a copy of such recorded personal information by mail, whichever the individual prefers, unless such recorded personal information is in coded form, in which case an accurate translation in plain language shall be provided in writing; (3) Disclose to the individual the identity, if recorded, of those persons to whom the insurance institution, agent or insurance-support organization has disclosed such personal information within two years prior to such request, and if the identity is not recorded, the names of those insurance institutions, agents, insurance-support organizations or other persons to whom such information is normally disclosed; and (4) Provide the individual with a summary of the procedures by which he or she may request correction, amendment or deletion of recorded personal information. (b) Any personal information provided pursuant to subdivision (a) above shall identify the source of the information if such source is an institutional source. (c) Medical record information supplied by a medical care institution or medical professional and requested under subdivision (a), together with the identity of the medical professional or medical care institution which provided such information, shall be supplied either directly to the individual or to a medical professional designated by the individual and licensed to provide medical care with respect to the condition to which the information relates, whichever the individual prefers. Mental health record information shall be supplied directly to the individual, pursuant to this section, only with the approval of the qualified professional person with treatment responsibility for the condition to which the information relates. If it elects to disclose the information to a medical professional designated by the individual, the insurance institution, agent or insurance-support organization shall notify the individual, at the time of the disclosure, that it has provided the information to the medical professional. (d) Except for personal information provided under Section 791.10, an insurance institution, agent or insurance-support organization may charge a reasonable fee to cover the costs incurred in providing a copy of recorded personal information to individuals. . . . (f) The rights granted to individuals in this section shall extend to all natural persons to the extent information about them is collected and maintained by an insurance institution, agent or insurance-support organization in connection with an insurance transaction. The rights granted to all natural persons by this subdivision shall not extend to information about them that relates to and is collected in connection with or in reasonable anticipation of a claim or civil or criminal proceeding involving them. . . .
791.09. (a) Within 30 business days from the date of receipt of a written request from an individual to correct, amend or delete any recorded personal information about the individual within its possession, an insurance institution, agent or insurance-support organization shall either: (1) Correct, amend or delete the portion of the recorded personal information in dispute; or (2) Notify the individual of: (A) Its refusal to make such correction, amendment or deletion. (B) The reasons for the refusal. (C) The individual's right to file a statement as provided in subdivision (c). (b) If the insurance institution, agent or insurance-support organization corrects, amends or deletes recorded personal information in accordance with paragraph (1) of subdivision (a), the insurance institution, agent or insurance-support organization shall so notify the individual in writing and furnish the correction, amendment or fact of deletion to: (1) Any person specifically designated by the individual who may have, within the preceding two years, received such recorded personal information. (2) Any insurance-support organization whose primary source of personal information is insurance institutions if the insurance-support organization has systematically received such recorded personal information from the insurance institution within the preceding seven years; provided, however, that the correction, amendment or fact of deletion need not be furnished if the insurance-support organization no longer maintains recorded personal information about the individual. (3) Any insurance-support organization that furnished the personal information that has been corrected, amended or deleted. (c) Whenever an individual disagrees with an insurance institution's, agent's or insurance-support organization's refusal to correct, amend or delete recorded personal information, the individual shall be permitted to file with the insurance institution, agent or insurance-support organization: (1) A concise statement setting forth what the individual thinks is the correct, relevant or fair information. (2) A concise statement of the reasons why the individual disagrees with the insurance institution's, agent's or insurance-support organization's refusal to correct, amend or delete recorded personal information. (d) In the event an individual files either statement as described in subdivision (c), the insurance institution, agent or support organization shall: (1) File the statement with the disputed personal information and provide a means by which anyone reviewing the disputed personal information will be made aware of the individual's statement and have access to it. (2) In any subsequent disclosure by the insurance institution, agent or support organization of the recorded personal information that is the subject of disagreement, clearly identify the matter or matters in dispute and provide the individual's statement along with the recorded personal information being disclosed. (3) Furnish the statement to the persons and in the manner specified in subdivision (b). (e) The rights granted to individuals in this section shall extend to all natural persons to the extent information about them is collected and maintained by an insurance institution, agent or insurance-support organization in connection with an insurance transaction. The rights granted to all natural persons by this subdivision shall not extend to information about them that relates to and is collected in connection with or in reasonable anticipation of a claim or civil or criminal proceeding involving them. (f) For purposes of this section, the term "insurance-support organization" does not include "consumer reporting agency".
791.10. (a) In the event of an adverse underwriting decision the insurance institution or agent responsible for the decision shall: (1) Either provide the applicant, policyholder or individual proposed for coverage with the specific reason or reasons for the adverse underwriting decision in writing or advise such person that upon written request he or she may receive the specific reason or reasons in writing. (2) Provide the applicant, policyholder or individual proposed for coverage with a summary of the rights established under subdivision (b) and Sections 791.08 and 791.09. (b) Upon receipt of a written request within 90 business days from the date of the mailing of notice or other communication of an adverse underwriting decision to an applicant, policyholder or individual proposed for coverage, the insurance institution or agent shall furnish to such person within 21 business days from the date of receipt of such written request: (1) The specific reason or reasons for the adverse underwriting decision, in writing, if such information was not initially furnished in writing pursuant to paragraph (1) of subdivision (a). (2) The specific items of personal and privileged information that support those reasons; provided, however: (A) The insurance institution or agent shall not be required to furnish specific items of privileged information if it has a reasonable suspicion, based upon specific information available for review by the commissioner, that the applicant, policyholder or individual proposed for coverage has engaged in criminal activity, fraud, material misrepresentation or material nondisclosure. (B) Specific items of medical record information supplied by a medical care institution or medical professional shall be disclosed either directly to the individual about whom the information relates or to a medical professional designated by the individual and licensed to provide medical care with respect to the condition to which the information relates, whichever the individual prefers. Mental health record information shall be supplied directly to the individual, pursuant to this subdivision, only with the approval of the qualified professional person with treatment responsibility for the condition to which the information relates. (3) The names and addresses of the institutional sources that supplied the specific items of information given pursuant to paragraph (2) of subdivision (b); provided, however, that the identity of any medical professional or medical care institution shall be disclosed either directly to the individual or to the designated medical professional, whichever the individual prefers. . . . (d) When an adverse underwriting decision results solely from an oral request or inquiry, the explanation of reasons and summary of rights required by subdivision (a) may be given orally to the extent that such information is available. . . .
791.15. (a) Whenever the commissioner has reason to believe that an insurance institution, agent or insurance-support organization has been or is engaged in conduct in this state which violates this article, or if the commissioner believes that an insurance-support organization has been or is engaged in conduct outside this state which has an effect on a person residing in this state and which violates this article, the commissioner shall issue and serve upon such insurance institution, agent or insurance-support organization a statement of charges and notice of hearing to be held at a time and place fixed in the notice. The date for such hearing shall be not less than 30 days after the date of service. (b) At the time and place fixed for such hearing the insurance institution, agent or insurance-support organization charged shall have an opportunity to answer the charges against it and present evidence on its behalf. Upon good cause shown, the commissioner shall permit any adversely affected person to intervene, appear and be heard at such hearing by counsel or in person. (c) At any hearing conducted pursuant to this section the commissioner may administer oaths, examine and cross-examine witnesses and receive oral and documentary evidence. The commissioner shall have the power to subpoena witnesses, compel their attendance and require the production of books, papers, records, correspondence and other documents which are relevant to the hearing. A stenographic record of the hearing shall be made upon the request of any party or at the discretion of the commissioner. If no stenographic record is made and if judicial review is sought, the commissioner shall prepare a statement of the evidence for use on review. Hearings conducted under this section shall be governed by the same rules of evidence and procedure applicable to administrative proceedings conducted under the laws of this state. (d) Statements of charges, notice, orders and other processes of the commissioner under this article may be served by anyone duly authorized to act on behalf of the commissioner. Service of process may be completed in the manner provided by law for service of process in civil actions or by registered mail. A copy of the statement of charges, notice, order or other process shall be provided to the person or persons whose rights under this article have been allegedly violated. A verified return setting forth the manner of service, or return postcard receipt in the case of registered mail, shall be sufficient proof of service. . . .
791.18. (a) Any person subject to an order of the commissioner under Section 779.17 or Section 791.20 or any person whose rights under this article were allegedly violated may obtain a review of any order or report of the commissioner by filing in a court of competent jurisdiction, within 30 days from the date of the service of such order or report, pursuant to Section 1094.5 of the Code of Civil Procedure. The court shall have jurisdiction to make and enter a decree modifying, affirming or reversing any order or report of the commissioner, in whole or in part. (b) An order or report issued by the commissioner under Section 791.17 shall become final: (1) Upon the expiration of the time allowed for the filing of a petition for review, if no such petition has been duly filed; except that the commissioner may modify or set aside an order or report to the extent provided in subdivision (c) of Section 791.17; or (2) Upon a final decision of the court if the court directs that the order or report of the commissioner be affirmed or the petition for review dismissed. (c) No order or report of the commissioner under this article or order of a court to enforce the same shall in any way relieve or absolve any person affected by such order or report from any liability under any law of this state.
791.19. Any person who violates a cease and desist order of the commissioner under Section 791.17 may, after notice and hearing and upon order of the commissioner, be subject to one or more of the following penalties, at the discretion of the commissioner: (a) A monetary fine of not more than ten thousand dollars ($10,000) for each violation; or (b) A monetary fine of not more than fifty thousand dollars ($50,000) if the commissioner finds that violations have occurred with such frequency as to constitute a general business practice; or (c) Suspension or revocation of an insurance institution's or agent's license if the insurance institution or agent knew or reasonably should have known it was in violation of this article.
791.20. (a) If any insurance institution, agent or insurance-support organization fails to comply with Section 791.08, 791.09 or 791.10 with respect to the rights granted under those sections, any person whose rights are violated may apply to any court of competent jurisdiction, for appropriate equitable relief. (b) An insurance institution, agent or insurance-support organization which discloses information in violation of Section 791.13 shall be liable for damages sustained by the individual about whom the information relates. However no individual shall be entitled to a monetary award which exceeds the actual damages sustained by the individual as a result of a violation of Section 791.13. (c) In any action brought pursuant to this section, the court may award the cost of the action and reasonable attorney's fees to the prevailing party. (d) An action under this section shall be brought within two years from the date the alleged violation is or should have been discovered. (e) Except as specifically provided in this section, there shall be no remedy or recovery available to individuals, in law or in equity, for occurrences constituting a violation of any provision of this act.
791.21. No cause of action in the nature of defamation, invasion of privacy or negligence shall arise against any person for disclosing personal or privileged information in accordance with this chapter, nor shall such a cause of action arise against any person for furnishing personal or privileged information to an insurance institution, agent or insurance-support organization; provided, however, this section shall provide no immunity for disclosing or furnishing false information with malice or willful intent to injure any person.
791.22. Any person who knowingly and willfully obtains information about an individual from an insurance institution, agent or insurance-support organization under false pretenses shall be fined not more than ten thousand dollars ($10,000) or imprisoned for not more than one year, or both.
791.23. The rights granted under Sections 791.08, 791.09 and 791.13 shall take effect on October 1, 1981, regardless of the date of the collection or receipt of the information which is the subject of such sections. Nothing contained in subdivisions (k) and (l) of Section 791.13, or in any other provision of this article, shall in any way affect the provisions of Section 770.1.
791.26. Where an authorization from the individual was granted to a nonprofit hospital service plan prior to October 1, 1981, such authorization shall be deemed to be in compliance with this article.
791.27. A disability insurer that provides coverage for hospital, medical, or surgical expenses shall not release any information to an employer that would directly or indirectly indicate to the employer that an employee is receiving or has received services from a health care provider covered by the plan unless authorized to do so by the employee. An insurer that has, pursuant to an agreement, assumed the responsibility to pay compensation pursuant to Article 3 (commencing with Section 3750) of Chapter 4 of Part 1 of Division 4 of the Labor Code, shall not be considered an employer for the purposes of this section. Nothing in this section prohibits a disability insurer from releasing relevant information described in this section for the purposes set forth in Chapter 12 (commencing with Section 1871) of Part 2 of Division 1.