The Office of General Counsel issued the following opinion on March 6, 2001 representing the position of the New York State Insurance Department.

Re: Disclosure of Nonpublic Personal Financial Information (N.Y. Comp. Codes R. & Reg. tit. 11, §420.0 - 420.24 (2001) (Reg. 169):

Emergency Regulation 169 (11 NYCRR 420) has been revised since this opinion was issued. Please see opinion number # 01-04-26 issued on April 30, 2000, entitled Notices Under N.Y. Comp. Codes R. & Regs. tit. 11 § 420.3 (Reg. 169), for a discussion that reflects the Department's interpretation of the revised provision regarding when notices must be sent to beneficiaries and claimants.

Question Presented:

Pursuant to N.Y. Comp. Codes R. & Regs. tit. 11, §420.0 - 420.24 (2001) (Reg. 169), what are a licensee's responsibilities insofar as providing notice to third party beneficiaries, group plan participants, or third party claimants, if nonpublic personal financial information is shared with third party business partners who are necessary to sell, service or administer a product or service?

Conclusion:

As more fully explained below, a licensee may disclose nonpublic personal financial information in certain situations without having to provide notices. N.Y. Comp. Codes R. & Reg. tit. 11, §§ 420.3, 420.13, 420.14, 420.15 (2001).

Facts:

XYZ Insurance Company asked whether it could share nonpublic personal financial information with a third party business partner to sell, service or administer a product or service.

Analysis:

This response is based upon the provisions of N.Y. Comp. Codes R. & Reg. tit. 11, § 420.0 - 420.24 (2001) (Reg. 169) which has been promulgated as an emergency measure. The final adoption of the regulation may contain revisions.

The term "consumer" is defined in N.Y. Comp. Codes R. & Reg. tit. 11, § 420.3(e)(1) (2001) as:

(A)n individual who, in this State, seeks to obtain, obtains or has obtained an insurance product or service, directly or through a legal representative, from a licensee that is to be used primarily for personal, family or household purposes, and about whom the licensee has nonpublic personal information.

N.Y. Comp. Codes R. & Reg. tit. 11, § 420.3(e)(2)(iv) (2001) provides, as examples of a consumer, that:

An individual is a licensee's consumer if:

(a) (I) The individual is a beneficiary of a life insurance policy

underwritten by the licensee;

(11) the individual is a claimant under an insurance policy issued by the licensee;

(111) the individual is an insured or an annuitant under an insurance policy or annuity, respectively, issued by the licensee; or

(IV) the individual is a mortgagor of a mortgage covered under a mortgage insurance policy issued by the licensee; and

(b) The licensee discloses nonpublic personal financial information about the individual to a nonaffiliated third party other than as permitted under sections 420.13, 420.14, or 420.15 of this Part.

Thus, provided that the licensee does not disclose nonpublic personal financial information about the individual to a nonaffiliated third party, other than as permitted under one of the enumerated sections, the individuals described above are not "consumers" and consequently, the notice requirements are not applicable

Insofar as the group situation is concerned, N.Y. Comp. Codes R. & Reg. tit. 11, 420.3(e)(2)(v) and (vi) (2001) provide:

(v) Provided that the licensee provides the initial, annual and revised notices under sections 420.4, 420.5 and 420.8 of this Part to the plan sponsor, workers’ compensation plan participant, group or blanket insurance policyholder or group annuity contract holder, and further provided that the licensee does not disclose to a non affiliated third party nonpublic personal information about such an individual other than as permitted under sections 420.13, 420.14 or 420.15 of this Part, an individual is not the licensee’s consumer solely because he or she is:

(a) a participant or a beneficiary of an employee benefit plan that the licensee administers or sponsors or for which the licensee acts as a trustee, insurer or fiduciary;

(b) covered under a group or blanket insurance or group annuity contract issued by the licensee; or

(c) a beneficiary in a workers’ compensation plan.

(vi) (a) The individual described in (a), (b) and (c) of subparagraph (v) of this paragraph are consumers of a licensee if the licensee does not meet all of the conditions of subparagraph (v).

Thus, provided that the insurer does not disclose to non-affiliates, other than pursuant to one of the exceptions in N.Y. Comp. Codes R. & Regs. tit. 11, § 420.13, 420.14 or 420.15 (2001), it only has to provide the initial, annual and revised notices to the plan sponsor, workers’ compensation plan participant, group or blanket insurance policyholder or group annuity contract holder.

However, it should be noted that pursuant to N.Y. Comp. Codes R. & Regs. tit. 11, § 420.3(i)(2)(i)(c) (2001) there is a continuing relationship with a licensee if:

The consumer is a beneficiary or claimant under a policy and has submitted a claim under a policy choosing a settlement option involving an ongoing relationship with the licensee;

In this circumstance, the individual is the licensee’s customer and, unless one of the exceptions in N.Y. Comp. Codes R & Regs. tit. 11, § 420.13, 420.14 0r 420.15 (2001) applies, the required notices must be given to the beneficiary or claimant.

With respect to how the provisions requiring authorization for disclosure of nonpublic personal health information would apply to third party beneficiaries, group plan participants of third party claimants, N.Y. Comp. Codes R. & Regs. tit. 11, § 420.17(a) (2001) requires a licensee to obtain an authorization from a consumer or customer before disclosing such individual’s nonpublic personal health information, unless one of the exceptions in N.Y. Comp. Codes R. & Regs. tit. 11, § 420.17(b) (2001) is applicable.

For further information, you may contact Associate Attorney Joan Siegel at the New York City office.