Title 38.2, Title 38.2. Insurance

A. An insurance institution or agent shall provide a notice of insurance information practices to all applicants or policyholders in connection with insurance transactions as provided in this section: 1. In the case of an application for insurance a notice shall be provided no la…

A. An insurance institution or agent shall provide clear and conspicuous notice of financial information collection and disclosure practices in connection with insurance transactions as required by subsection B of this section: 1. To an applicant before any financial information …

An insurance institution or agent shall clearly specify those questions designed to obtain information solely for marketing or research purposes from an individual in connection with an insurance transaction.

Notwithstanding any other provision of law of this Commonwealth, no insurance institution, agent, or insurance-support organization shall utilize as its disclosure authorization form in connection with insurance transactions involving insurance policies or contracts issued after …

A. No insurance institution, agent, or insurance-support organization may prepare or request an investigative consumer report about an individual in connection with an insurance transaction involving an application for insurance, a policy renewal, a policy reinstatement or a chan…

A. If any individual, after proper identification, submits a written request to an insurance institution, agent, or insurance-support organization for access to recorded personal information about the individual that is reasonably described by the individual and reasonably able t…

A. Within thirty business days from the date of receipt of a written request from an individual to correct, amend, or delete any recorded personal information about the individual within its possession, an insurance institution, agent, or insurance-support organization shall eith…

A. In the event of an adverse underwriting decision, including those that involve policies referred to in subdivision 1 of subsection E of § 38.2-2114 and in subdivision 3 of subsection F of § 38.2-2212, the insurance institution or agent responsible for the decision shall give a…

No insurance institution, agent, or insurance-support organization may seek information in connection with an insurance transaction concerning: (i) any previous adverse underwriting decision experienced by an individual, or (ii) any previous insurance coverage obtained by an indi…

A. No insurance institution or agent may base an adverse underwriting decision in whole or in part: 1. On the fact of a previous adverse underwriting decision or on the fact that an individual previously obtained insurance coverage through a residual market mechanism. However, an…

A. Except as otherwise provided in § 38.2-613, no insurance institution, agent, or insurance-support organization may, directly or through an affiliate, disclose to a nonaffiliated third party financial information about an individual collected or received in connection with an i…

Nothing in this article shall be construed to modify, limit, or supersede the operation of the federal Fair Credit Reporting Act (15 U.S.C. § 1681 et seq.), and no inference shall be drawn on the basis of the provisions of this article regarding whether information is transaction…

A. An insurance institution, agent, or insurance-support organization shall not disclose any medical-record information or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure is with the written author…

Pursuant to the authority granted by §§ 38.2-223 and 38.2-3100.1, the Commission shall promulgate such regulations as may be necessary or appropriate to ensure that applicants for life or accident and sickness insurance coverage or for modifications to existing coverage are notif…

If a duly appointed agent of an insurer proposes to place a policy of motor vehicle insurance as defined in § 38.2-2212 with another insurer or proposes to submit an application to the Virginia Automobile Insurance Plan solely because of a moratorium on such agent's selling, soli…

A. The Commission shall have the power to examine and investigate the affairs of any insurance institution or agent doing business in the Commonwealth to determine whether the insurance institution or agent has been or is engaged in any conduct in violation of this article. B. Th…

A. Whenever the Commission has reason to believe that an insurance institution, agent or insurance-support organization has been or is engaged in conduct in the Commonwealth that violates this article, or whenever the Commission has reason to believe that an insurance-support org…

For the purpose of this article, an insurance-support organization transacting business outside the Commonwealth that has an effect on a person residing in the Commonwealth and which is alleged to violate this article shall be deemed to have appointed the clerk of the Commission …

A. If any insurance institution, agent, or insurance-support organization fails to comply with §§ 38.2-608, 38.2-609, or § 38.2-610, any person whose rights granted under those sections are violated may apply to a court of competent jurisdiction for appropriate equitable relief. …

No cause of action in the nature of defamation, invasion of privacy, or negligence shall arise against any person for disclosing personal or privileged information in accordance with this article, nor shall such a cause of action arise against any person for furnishing personal o…

Any person who knowingly and willfully obtains information about an individual from an insurance institution, agent or insurance-support organization under false pretenses shall be fined not more than $10,000 or punished by confinement in jail for not more than 12 months, or both…

As used in this article: "Authorized person" means a person known to and authorized by the licensee and determined to be necessary and appropriate to have access to the nonpublic information held by the licensee and its information systems. "Consumer" means an individual, includi…

Nothing in this article shall be construed to create or imply a private cause of action for violation of its provisions, nor shall it be construed to curtail a private cause of action which would otherwise exist in the absence of this article.

A. Commensurate with the size and complexity of the licensee; the nature and scope of the licensee's activities, including its use of third-party service providers; and the sensitivity of the nonpublic information used by the licensee or in the licensee's possession, custody, or …

A. If a licensee learns that a cybersecurity event has or may have occurred, the licensee or an investigator shall conduct a prompt investigation. B. During the investigation, the licensee or an investigator shall, at a minimum, determine as much of the following information as p…

A. If a licensee has determined that a cybersecurity event has actually occurred, such licensee shall notify the Commissioner, in accordance with requirements prescribed by the Commission, as promptly as possible but in no event later than three business days from such determinat…

A. A licensee that maintains consumers' nonpublic information shall notify the consumer of any cybersecurity event without unreasonable delay after making a determination or receiving notice the cybersecurity event has occurred, if consumers' nonpublic information was accessed an…

A. The Commissioner may examine and investigate the affairs of any licensee to determine whether a licensee has been or is engaged in any conduct in violation of this article. This power is in addition to the powers that the Commissioner has under Article 4 of Chapter 13 (38.2-13…

A. Any documents, materials, or other information in the control or possession of the Bureau that are furnished by a licensee or an employee or agent thereof acting on behalf of licensee pursuant to subsection H of § 38.2-623 or subdivisions B 2, 3, 4, 5, 8, 10, and 11 § 38.2-625…

A. The following exceptions shall apply to this article: 1. A licensee subject to HIPAA that has established and maintains an information security program pursuant to such statutes, rules, regulations, or procedures established thereunder shall be considered to meet the requireme…