Four more privacy rules, each with a narrow job. Learn what each one covers and the exam questions sort themselves out.
HIPAA (federal) protects health information held by "covered entities": health plans, health care clearinghouses, and health care providers who transmit health information electronically in covered transactions. The definition of health plan excludes "excepted benefits," a list that includes liability insurance, workers' compensation and auto medical payments. So an insurer's auto liability policies are outside HIPAA.
California privacy regulations (10 CCR §§2689.4–2689.22): a licensee must give a customer a clear and conspicuous initial privacy notice no later than when it establishes the customer relationship (§2689.5). A reasonable time afterward is allowed only in limited cases, such as when the customer did not choose the relationship because a policy was assigned from another licensee. The notice does not depend on the customer asking for it.
Two California consumer laws:
California Consumer Privacy Act of 2018 (CCPA), effective January 1, 2020: a consumer may request that a business delete personal information it collected from the consumer.
Shine the Light law (Civil Code §1798.83): a customer may ask for the categories of personal information a business disclosed, and the names and addresses of the third parties that received it, for their direct marketing during the preceding calendar year.