Current through Register Vol. 63, No. 12, December 1, 2024
(1) This rule governs the notice to be given
by a licensee to an individual that informs the individual about a licensee's
treatment of personal information concerning the individual when the licensee
and the individual are engaging in a transaction of health insurance. A
licensee shall provide a clear and conspicuous notice of information practices
to individuals in connection with a transaction of health insurance under the
circumstances and at the times as follows:
(a) In the case of an application for health
insurance, a notice shall be provided no later than:
(A) At the time of delivery of the health
insurance policy or certificate, when personal information is collected only
from the applicant or from public records; or
(B) At the time the collection of personal
information is initiated, when personal information is collected from a source
other than the applicant or public records.
(b) In the case of a health insurance policy
renewal, a notice shall be provided no later than the policy renewal date,
except that a notice shall not be required in connection with a policy renewal
if:
(A) Personal information is collected only
from the policyholder or from public records; or
(B) A notice meeting the requirements of this
rule has been given within the previous 24 months.
(c) In the case of a policy reinstatement or
change in health insurance benefits by an insurer, a notice shall be provided
no later than the time a request for the policy reinstatement or change in
insurance benefits is received by the insurer, except that a notice shall not
be required if personal information is collected only from the policyholder or
from public records.
(2)
The notice required by section (1) of this rule shall be in writing or, if the
individual agrees, in an electronic format and shall include all of the
following items:
(a) Whether personal
information may be collected from persons other than the individual or
individuals proposed for coverage.
(b) The types of personal information that
may be collected and the types of sources and investigative techniques that may
be used to collect the information.
(c) The types of disclosures identified in
OAR 836-080-0670 or
836-080-0675 and the
circumstances under which the disclosures may be made without prior
authorization. The only circumstances that need be described, however, are
those that occur with such frequency as to indicate a general business
practice.
(d) A description of the
rights established under OAR
836-080-0695 and
836-080-0700 and the manner in
which the rights may be exercised.
(e) That information obtained from a report
prepared by an insurance-support organization may be retained by the
insurance-support organization and disclosed to other persons.
(3) In lieu of the notice required
in section (2) of this rule, an insurer or insurance producer may provide an
abbreviated notice in writing or, if the individual agrees, in electronic
format, informing the individual that:
(a)
Personal information may be collected from persons other than the individual or
individuals proposed for coverage;
(b) Personal information collected under
subsection (a) of this section as well as other personal or privileged
information subsequently collected by the licensee may be disclosed in certain
circumstances to third parties without authorization;
(c) A right of access and correction exists
with respect to all personal information collected; and
(d) The notice required in section (2) of
this rule will be furnished to the individual upon request.
Stat. Auth.: ORS
731.244 &
746.608
Stats. Implemented: ORS
746.600 &
746.607
