Or. Admin. Code § 836-080-0615

Current through Register Vol. 63, No. 11, November 1, 2024

Section 836-080-0615 - Personal Information Notice

(1) This rule governs the notice to be given by a licensee to an individual that informs the individual about a licensee's treatment of personal information concerning the individual when the licensee and the individual are engaging in a transaction of health insurance. A licensee shall provide a clear and conspicuous notice of information practices to individuals in connection with a transaction of health insurance under the circumstances and at the times as follows:

(a) In the case of an application for health insurance, a notice shall be provided no later than:

(A) At the time of delivery of the health insurance policy or certificate, when personal information is collected only from the applicant or from public records; or

(B) At the time the collection of personal information is initiated, when personal information is collected from a source other than the applicant or public records.

(b) In the case of a health insurance policy renewal, a notice shall be provided no later than the policy renewal date, except that a notice shall not be required in connection with a policy renewal if:

(A) Personal information is collected only from the policyholder or from public records; or

(B) A notice meeting the requirements of this rule has been given within the previous 24 months.

(c) In the case of a policy reinstatement or change in health insurance benefits by an insurer, a notice shall be provided no later than the time a request for the policy reinstatement or change in insurance benefits is received by the insurer, except that a notice shall not be required if personal information is collected only from the policyholder or from public records.

(2) The notice required by section (1) of this rule shall be in writing or, if the individual agrees, in an electronic format and shall include all of the following items:

(a) Whether personal information may be collected from persons other than the individual or individuals proposed for coverage.

(b) The types of personal information that may be collected and the types of sources and investigative techniques that may be used to collect the information.

(c) The types of disclosures identified in OAR 836-080-0670 or 836-080-0675 and the circumstances under which the disclosures may be made without prior authorization. The only circumstances that need be described, however, are those that occur with such frequency as to indicate a general business practice.

(d) A description of the rights established under OAR 836-080-0695 and 836-080-0700 and the manner in which the rights may be exercised.

(e) That information obtained from a report prepared by an insurance-support organization may be retained by the insurance-support organization and disclosed to other persons.

(3) In lieu of the notice required in section (2) of this rule, an insurer or insurance producer may provide an abbreviated notice in writing or, if the individual agrees, in electronic format, informing the individual that:

(a) Personal information may be collected from persons other than the individual or individuals proposed for coverage;

(b) Personal information collected under subsection (a) of this section as well as other personal or privileged information subsequently collected by the licensee may be disclosed in certain circumstances to third parties without authorization;

(c) A right of access and correction exists with respect to all personal information collected; and

(d) The notice required in section (2) of this rule will be furnished to the individual upon request.

Or. Admin. Code § 836-080-0615

ID 4-2005, f. & cert. ef. 4-1-05

Stat. Auth.: ORS 731.244 & 746.608

Stats. Implemented: ORS 746.600 & 746.607