FEDERAL REGULATION · 5 MIN READ

FCRA and FACTA in Insurance Underwriting

The Fair Credit Reporting Act governs how insurers obtain and use consumer reports, and insurance underwriting is a permissible purpose under 15 USC 1681b. The compliance obligations begin when the insurer takes adverse action - declining coverage, or issuing at other than the preferred rate - based in whole or in part on a consumer report. The adverse action notice under 1681m(a) must identify the consumer reporting agency (name, address, toll-free number), state that the CRA did not make the decision and cannot explain it, and inform the consumer of the right to a free file disclosure within 60 days and the right to dispute accuracy or completeness. When a credit-based insurance score is used, 1681g(g) requires disclosure of the score, the range of possible scores, up to four key factors that adversely affected it, the date created, and the furnishing CRA. Accuracy and identity-theft machinery is heavily tested. CRAs must reinvestigate consumer disputes within 30 days (1681i). After a valid identity-theft report, a CRA must block the fraudulent information within 4 business days and notify the furnisher (1681c-2, added by the FACT Act). Furnishers owe their own accuracy duties (1681s-2(a)) and dispute-investigation duties (1681s-2(b)). The Red Flags Rule requires covered entities to maintain identity-theft detection programs, and the Disposal Rule governs destruction of consumer report information. Civil liability splits between willful noncompliance (1681n) and negligent noncompliance (1681o). FACTA also built a medical-information firewall at 15 USC 1681b(g): CRAs generally may not furnish reports containing medical information for insurance transactions unless the consumer affirmatively consents in writing or the information is relevant to the transaction - typically true for life, disability, or health underwriting but rarely for auto or homeowners. Medical data must be coded so specific conditions cannot be inferred without consent. For P&C insurers the practical rule is: no medical information in underwriting without express consumer consent.