The Office of General Counsel issued the following informal opinion on February 28, 2001, representing the position of New York State Insurance Department.

RE: Regulation 169 and Group Credit Life Insurance (N.Y. Comp. Codes R. & Regs. tit. 11, §§ 420.0–420.24 (2001) (Regulation 169))

Questions Presented:

1. Pursuant to N.Y. Comp. Codes R. & Regs. tit. 11, §§ 420.0–420.24 (2001) (Reg. 169), with respect to nonpublic personal financial information, what notice requirements are imposed on an insurer that issues a group credit life insurance policy to an auto dealer as the group policyholder?

2. Pursuant to N.Y. Comp. Codes R. & Regs. tit. 11, §§ 420.0–420.24 (2001) (Reg. 169), with respect to nonpublic personal financial information, what notice requirements are imposed on an auto dealer who is the insurer’s duly appointed agent and who is also the group credit life insurance policyholder?

3. Pursuant to N.Y. Comp. Codes R. & Regs. tit. 11, §§ 420.0–420.24 (2001) (Reg. 169), with respect to nonpublic personal health information, what requirements are imposed on an insurer and its agents?

Conclusion:

1. Provided that the conditions contained in N.Y. Comp. Codes R. & Regs. tit. 11, § 420.3 (e)(2)(v)(b) (2001) (Reg. 169) are met, the insurer need only provide the initial, annual and revised notices to the group policyholder, in this case the auto dealer/agent.

2. The auto dealer/agent’s obligations with respect to meeting the notice and opt out requirements are contained in N.Y. Comp. Codes R. & Regs. tit. 11, § 420.3 (p)(2)(i) and (ii)(c) (2001) (Reg. 169).

3. The requirements for obtaining an authorization for disclosure of nonpublic personal health information are contained in N.Y. Comp. Codes R. & Regs. tit. 11, § 420.17 (2001) (Reg. 169).

Facts:

An insurer issues a policy of group credit life or accident and health insurance to an automobile dealer who is both the insurer’s agent and the group policyholder. The individuals covered under the policy are issued certificates of coverage. Neither the insurer nor the agent will ever use "non-public personal information" concerning the individual for any purpose not covered by one of the exceptions contained in N.Y. Comp. Codes R. & Regs. tit. 11, § 420.13, 420.14 or 420.15 (2001) (Reg. 169).

Analysis:

N.Y. Comp. Codes R. & Regs. tit. 11, § 420.3 (e)(2)(v)(b) and (vi) (2001) (Reg. 169) provide that:

(v) Provided that the licensee provides the initial, annual and revised notices under sections 420.4, 420.5 and 420.8 of this Part to the plan sponsor, workers’ compensation plan participant, group or blanket insurance policyholder or group annuity contractholder, and further provided that the licensee does not disclose to a nonaffiliated third party nonpublic personal information about such an individual other than as permitted under sections 420.13, 420.14 or 420.15 of this Part, an individual is not the licensee’s consumer solely because he or she is:

(b) covered under a group or blanket insurance or group annuity contract issued by the licensee; or

(vi) (a) The individuals described in (a), (b) and (c) of subparagraph (v) of this paragraph are consumers of a licensee if the licensee does not meet all of the conditions of subparagraph (v).

Thus, provided that the insurer does not disclose to non-affiliates, other than pursuant to one of the exceptions in N.Y. Comp. Codes R. & Regs. tit. 11, § 420.13, 420.14 or 420.15 (2001), it only has to provide the initial, annual and revised notices to the group insurance policyholder, in this instance the auto dealer/agent.

With respect to the auto dealer/agent’s responsibilities under the regulation, N.Y. Comp. Codes R. & Regs. tit. 11, § 420.3 (p)(2)(i) and (ii)(c) (2001) (Reg. 169) provide that:

(i) A licensee is not subject to the notice and opt out requirements for nonpublic personal financial information set forth in sections 420.4 through 420.9 of this Part if the licensee is an employee, agent, sublicensee, or other representative of another licensee ("the principal") and:

(a) The principal otherwise complies with, and provides the notices required by, the provisions of this Part; and

(b) The licensee does not disclose any nonpublic personal information of a consumer or customer to any person other than the principal from or through which such consumer or customer seeks to obtain or has obtained a product or service, or its affiliates in a manner permitted by this Part.

(ii) Examples of employee, agent or other representative of a principal:

(c) An insurance agent of an insurer;

Thus, provided that the insurer provides the required notices and the auto dealer/agent does not disclose nonpublic personal information, other that as permitted by the regulation, the auto dealer/agent is not subject to the notice and opt out requirements.

The provisions requiring authorization for disclosure of nonpublic personal health information would apply to group plan participants. N.Y. Comp. Codes R. & Regs. tit. 11, § 420.17(a) (2001) requires a licensee to obtain an authorization from a consumer or customer before disclosing such individual’s nonpublic personal health information, unless one of the exceptions in N.Y. Comp. Codes R. & Regs. tit. 11, § 420.17(b) (2001) is applicable. Thus, if the insurer or the agent were to disclose the certificateholder's nonpublic personal health information, other than under one of the exceptions in N.Y. Comp. Codes R. & Regs. tit. 11, § 420.17(b) (2001), the certificateholder's authorization would be required.

For further information you may contact Associate Attorney Joan Siegel at the New York City Office.