Florida Administrative Code

(1)(a) Conditions for disclosure. Except as otherwise authorized in these rules, a licensee may not, directly or through any affiliate, disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party unless: 1. The licensee has provided to th…

(1)(a) Information the licensee receives under an exception. If a licensee receives nonpublic personal financial information from a nonaffiliated financial institution under an exception in Rule 69O-128.015 or 69O-128.016, F.A.C., the licensee's disclosure and use of that informa…

(1) General prohibition on disclosure of account numbers. A licensee shall not, directly or through an affiliate, disclose, other than to a consumer reporting agency, a policy number or similar form of access number or access code for a consumer's policy or transaction account to…

(1) General rule. (a) The opt out requirements in Rules 69O-128.008 and 69O-128.011, F.A.C., do not apply when a licensee provides nonpublic personal financial information to a nonaffiliated third party to perform services for the licensee or functions on the licensee's behalf, i…

(1) Exceptions for processing transactions at consumer's request. The requirements for initial notice in paragraph 69O-128.005(1)(b), F.A.C., the opt out in Rules 69O-128.008 and 69O-128.011, F.A.C., and service providers and joint marketing in Rule 69O-128.014, F.A.C., do not ap…

(1) Exceptions to opt out requirements. The requirements for initial notice to consumers in paragraph 69O-128.005(1)(b), F.A.C., the opt out in Rules 69O-128.008 and 69O-128.011, F.A.C., and service providers and joint marketing in Rule 69O-128.014, F.A.C., do not apply when a li…

(1) Except as provided in subsections (2) and (3) of this rule, a licensee shall not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer whose nonpublic personal health information is sought…

(1) A valid authorization to disclose nonpublic personal health information pursuant to this Part shall be in written or electronic form and shall contain all of the following: (a) The identity of the consumer or customer who is the subject of the nonpublic personal health inform…

A request for authorization and an authorization form may be delivered to a consumer or a customer as part of an opt-out notice pursuant to Rule 69O-128.010, F.A.C., provided that the request and the authorization form are clear and conspicuous. An authorization form is not requi…

(1) If the Office determines that a health insurer or health maintenance organization licensed by the Office is in compliance with, or is actively undertaking compliance with, the consumer privacy protection rules adopted by the United States Department of Health and Human Servic…

Nothing in this part shall preempt or supersede existing state law related to medical records, health or insurance information privacy. Rulemaking Authority 624.308, 626.9651 FS. Law Implemented 624.307(1), 626.9651 FS. History-New 12-16-01, Formerly 4-128.021.

Nothing in these rules shall be construed to modify, limit or supersede the operation of the federal Fair Credit Reporting Act (15 U.S.C. 1681 et seq.), and no inference shall be drawn on the basis of the provisions of these rules regarding whether information is transaction or e…

(1) A licensee shall not unfairly discriminate against any consumer or customer because that consumer or customer has opted out from the disclosure of his or her nonpublic personal financial information pursuant to the provisions of these rules. (2) A licensee shall not unfairly …

Rulemaking Authority 624.308, 626.9651 FS. Law Implemented 624.307(1), 626.9651 FS. History-New 12-16-01, Formerly 4-128.024, Repealed 4-27-26.

Rulemaking Authority 624.308(1) FS. Law Implemented 624.23, 624.307(1) FS. History-New 10-21-02, Formerly 4-128.025, Repealed 7-30-17.

(1) These rules establish standards for developing and implementing administrative, technical and physical safeguards to protect the security, confidentiality, and integrity of customer information, pursuant to Sections 501, 505(b), and 507 of the Gramm-Leach-Bliley Act, codified…

For purposes of this part, the following definitions apply: (1) "Customer" means a customer of the licensee as the term customer is defined in subsection 69O-128.002(8), F.A.C. (2) "Customer information" means nonpublic personal information as defined in subsection 69O-128.002(18…

(1) Each licensee shall implement a comprehensive written information security program that includes administrative, technical, and physical safeguards for the protection of customer information. (2) The administrative, technical, and physical safeguards included in the informati…

A licensee's information security program shall be designed to: (1) Ensure the security and confidentiality of customer information; (2) Protect against any anticipated threats or hazards to the security or integrity of the information; and, (3) Protect against unauthorized acces…

The following actions and procedures are examples of methods of implementation of the requirements of Rules 69O-128.032 and 69O-128.033, F.A.C. These examples are non-exclusive illustrations of actions and procedures that licensees may follow to implement Rules 69O-128.032 and 69…

Rulemaking Authority 624.308(1), 626.9651 FS. Law Implemented 624.307(1), 626.9651 FS. History-New 12-8-02, Formerly 4-128.035, Repealed 4-27-26.

All foreign or alien entities seeking a certificate of authority shall comply with the requirements of sections 624.404, 624.413, and related Florida Statutes. Each applicant shall comply with the instructions contained in the Uniform Certificate of Authority Expansion Applicatio…

Applications submitted as an insurer under Florida's Surplus Lines Law, pursuant to section 626.913, Florida Statutes, shall contain all of the following forms. (1) Applicants shall comply with the directions on, or otherwise submit, the following applicable forms: (a) Form OIR-C…

(1) All domestic captive insurers filing an application for licensure, pursuant to chapter 628, Part V, F.S., shall submit the following forms, and otherwise comply with the requirements therein: (a) Form OIR-C1-1000, "Application for Permit Captive Insurer," incorporated by refe…

(1) All domestic insurers filing an Application for Permit Domestic Stock or Mutual Insurer (OIR-C1-100), filed pursuant to chapter 628, F.S., for the following: domestic property and casualty insurers, title insurers, and life and health insurers, pursuant to section 628.051, F.…

(1) Any insurer which is organized under the laws of any other state for the purpose of writing insurance may apply for a certificate of authority as a domestic insurer in this state and shall comply with all of the requirements relative to the organization and licensing of a dom…

(1) All viatical settlement providers filing an application for licensure, pursuant to chapter 626, Part X, F.S., shall submit the following forms, and otherwise comply with the requirements therein: (a) Form OIR-C1-1227, "Application for License Viatical Settlement Provider," in…

(1) All life expectancy providers filing an application for registration, pursuant to section 626.99175, F.S., shall submit the following forms, and otherwise comply with the requirements therein: (a) Form OIR-C1-1663, "Application for Registration Life Expectancy Provider," inco…

(1) Applicants for a certificate of authority as a commercial self-insurance fund pursuant to section 624.462, F.S., shall comply with the directions on, or otherwise submit, the following applicable forms: (a) Form OIR-C1-845, "Application for Certificate of Authority Commercial…

Rulemaking Authority 624.308 FS. Law Implemented 624.307(1), 624.34, 624.401, 624.404, 624.413, 624.422, 624.462, 624.466, 624.501, 626.913, 628.6011, 628.051, 628.061 FS. History-New 2-26-92 Amended 9-19-00, Formerly 4-136.012, Repealed 1-7-24.

(1) Any advisory organization seeking to conduct operations in this state shall submit Form OIR-B1-PCR3, "Filing requirements Advisory Organization," effective 7/23, hereby incorporated by reference in Rule 69O-136.100, F.A.C. (2) After receipt by the Office of Form OIR-B1-PCR3 a…

(1) An application for a person applying for a license as a rating organization consists of the following: (a) Form OIR-C1-PCR1, "Application for License Rating Organization," incorporated by reference in Rule 69O-136.100, F.A.C.; (b) Form OIR-C1-1416, "Uniform Certificate of Aut…

(1) This rule applies to all authorized insurers, as defined in section 624.09, F.S. (2) Any insurer seeking to add or delete a line of insurance on an existing certificate of authority, file a name change, redomesticate (between foreign jurisdictions only), change its statutory …

(1) No insurer shall issue insurance policies or otherwise transact insurance, as that term is defined in Section 624.10, F.S., involving risks resident or located in this state unless the insurer has a current certificate of authority issued by the Office. (2) No insurer shall f…

(1) The below are to be used in determination of eligibility to operate as an Alien Insurer pursuant to section 624.402(8) F.S. Applicants shall comply with the directions on, or otherwise submit, the following applicable forms: (a) Form OIR-C1-2176, incorporated by reference in …

(1) All entities seeking registration as a purchasing group shall comply with the requirements of section 627.948, F.S., and shall (1) All entities seeking registration as a purchasing group shall comply with the requirements of section 627.948, F.S., and shall comply with the di…

(1) All foreign entities seeking licensure as a risk retention group shall comply with the requirements of section 627.944, F.S., as applicable, and shall comply with the directions on, or otherwise submit, Form OIR-C1-513, incorporated by reference in Rule 69O-136.100, F.A.C. (2…

(1) A purchasing group which obtains liability insurance from an insurer not admitted in this state or a risk retention group shall inform each of the members of such group which have a risk resident or located in this state that such risk is not protected by an insurance insolve…

Rulemaking Authority 624.308 FS. Law Implemented 624.307(1), 624.316(2)(b), 624.321(1)(a), 624.34, 624.401, 624.404, 624.407, 624.413, 624.422, 624.501, 626.9891, 628.161, 628.907 FS. History-New 12-3-00, Formerly 4-136.034, Repealed 1-7-24.

(1) An application for a person applying for a certificate of authority as a health maintenance organization consists of the following: (a) Form OIR-C1-942, "Application for Certificate of Authority Health Maintenance Organization," incorporated by reference in Rule 69O-136.100, …

(1) An application for a person applying for a certificate of authority as a multiple-employer welfare arrangement consists of the following: (a) Form OIR-C1-983, incorporated by reference in Rule 69O-136.100, F.A.C.; (b) The biographical information package as defined in subsect…

(1) Application for Certificate of Authority. (a) An application for a person applying for a certificate of authority for a continuing care provider consists of the following: 1. Form OIR-C1-473, incorporated by reference in Rule 69O-136.100, F.A.C. 2. Form OIR-C1-144, "Service o…

(1) An application for a person applying for a certificate of authority as a prepaid health clinic consists of the following: (a) Form OIR-C1-483, "Application for Certificate of Authority Prepaid Health Clinic," incorporated by reference in Rule 69O-136.100, F.A.C.; (b) The biog…

(1) A person applying for a Certificate of Authority to operate as an insurance administrator, including an applicant seeking to register as a pharmacy benefit manager, shall submit the following: (a) Form OIR-C1-1075, "Application for Certificate of Authority of an Insurance Adm…

(1) Any person engaging in the business of issuing donor annuity agreements must submit Form OIR-C1-1208, "Notification to the Office of Insurance Regulation as a Qualifying Issuer of Donor Annuity Agreements Pursuant to section 627.481, F.S.," incorporated by reference in Rule 6…

(1) A person applying for a certificate of authority as a prepaid limited service organization shall submit the following if applicable: (a) Form OIR-C1-1119, "Application for Certificate of Authority Prepaid Limited Health Service Organization," incorporated by reference in Rule…

(1) A person applying for a certificate of authority as a discount plan organization shall submit the following if applicable: (a) Form OIR-C1-1606, "Application for License Discount Plan Organization (DPO)," incorporated by reference in Rule 69O-136.100, F.A.C.; (b) Form OIR-C1-…