APPLICATION, UNDERWRITING, DELIVERY · 6 MIN READ

Underwriting Sources, Consumer Reports, and Privacy Law

Underwriters build a risk picture from layered sources. The application itself is primary. The Medical Information Bureau (MIB) is a member-owned clearinghouse of coded medical-history data that flags discrepancies across insurers' applications — it is a consumer reporting agency under the federal Fair Credit Reporting Act (FCRA), so applicants may obtain their file (one free disclosure per year plus after any adverse action), dispute entries, and have MIB reinvestigate within 30 days (extendable to 45). If a dispute remains unresolved, the applicant may add a brief consumer statement to the file, but cannot compel deletion of accurate, verifiable data. An Attending Physician Statement (APS) is ordered when the application or exam reveals conditions needing detail from the treating doctor. Paramedical exams (basic vitals and fluids collected by a nurse or technician) or full medical exams are triggered by age and face amount, and the insurer pays for exams it requires. Inspection reports and investigative consumer reports gather lifestyle and character information from interviews; the FCRA requires disclosure to the applicant before an investigative report is made. When any consumer report contributes to a decline or other adverse action, the FCRA requires an adverse-action notice identifying the reporting agency and the applicant's rights. Tobacco classification illustrates lab-driven underwriting: cotinine testing detects nicotine from any source — cigarettes, smokeless tobacco, patches, gum, or vaping — so recent nicotine use of any kind typically lands the applicant in the tobacco class, with non-tobacco status commonly requiring around 12 months of abstinence. Federal privacy and financial-crime rules wrap the process. HIPAA requires a signed authorization before medical records are released to the insurer. The Gramm-Leach-Bliley Act (GLBA) requires privacy notices explaining information-sharing practices, delivered at the start of the relationship and annually. Under the USA PATRIOT Act and Bank Secrecy Act rules, insurers issuing covered products — permanent life, annuities, and anything with cash value — must run written anti-money-laundering programs with a compliance officer, producer training, and independent testing; the insurer can delegate the training work but never the regulatory accountability, and producers serve as front-line observers of red flags like overfunding or rapid surrender.