The rulebook has two layers:
The California Insurance Code is statute, so it changes only through legislation.
The California Code of Regulations, Title 10, chapter 5, holds regulations adopted by the Insurance Commissioner. For the Unfair Practices article, §790.10 calls for notice and a public hearing before rules are adopted. A regulation cannot rewrite the Code.
The Commissioner is elected by the people, for no more than two four-year terms (Ins. Code §12900), and must enforce the Insurance Code and the other laws regulating insurance (§12921).
Health coverage has two state regulators. Under §740, an entity that provides coverage for medical, dental, hospital and similar expenses is presumed subject to the Department of Insurance (CDI) unless it shows that another agency licenses it, by giving the Commissioner that agency's certificate or license. Per the CDI outline:
- CDI is the primary regulator of issuers of most PPO and EPO plans and other disability insurers.
- The Department of Managed Health Care (DMHC) is the primary regulator of all HMO and POS plans, and some PPO and EPO plans.
A company does not fall under DMHC simply because of the kind of expense it covers.
Unfair Practices Act (§§790-790.15): §790.03 lists unfair methods of competition and unfair or deceptive acts, such as misrepresenting policy terms or benefits, false or misleading advertising, and misstating an insurer's financial condition. Penalties (§790.035): up to $5,000 per act, or up to $10,000 per act if willful, fixed by the Commissioner. The process (§790.05): an order to show cause, a hearing at least 30 days after service, then an order to pay the penalty and to cease and desist. Only the Commissioner may enforce the Unfair Practices Act (CDI outline), so a client's lawsuit does not impose these penalties.
Privacy:
Federal Gramm-Leach-Bliley Act (GLBA): consumers may opt out of sharing with nonaffiliated third parties (15 U.S.C. §6802).
California Financial Information Privacy Act goes further: a financial institution generally may not share nonpublic personal information with nonaffiliated third parties without the consumer's explicit prior consent (Fin. Code §4052.5).
Insurance Information and Privacy Protection Act (§791.13): disclosure of personal information from an insurance transaction is barred unless a listed exception applies; silence is not permission. An authorization given to a non-insurance requester must be dated one year or less before the disclosure. Disclosure to an insurance regulatory authority is allowed without an authorization.
Two words and two delivery rules:
'Shall' is mandatory and 'may' is permissive, unless the context shows otherwise (§16).
Unless the Code says otherwise, a notice may be mailed postage prepaid to the person's residence or principal place of business in California, and the mailer's affidavit is prima facie evidence of mailing (§38).
Records covered by §38.6 may be sent electronically only after the person opts in, and the licensee must disclose that opting in is voluntary and that the person may opt out at any time. An email address on file is not consent.