Skip to main content
Back To Top Top Back To Top
The Legislative Service Commission staff updates the Revised Code on an ongoing basis, as it completes its act review of enacted legislation. Updates may be slower during some times of the year, depending on the volume of enacted legislation.

Chapter 3904 | Insurance Information Practices

 
 
 
Section
Section 3904.01 | Insurance information practices definitions.
 

As used in sections 3904.01 to 3904.22 of the Revised Code:

(A)(1) "Adverse underwriting decision" means any of the following actions with respect to insurance transactions involving life, health, or disability insurance coverage that is individually underwritten:

(a) A declination of insurance coverage;

(b) A termination of insurance coverage;

(c) Failure of an agent to apply for insurance coverage with a specific insurance institution that the agent represents and that is requested by an applicant;

(d) An offer to insure at higher than standard rates.

(2) Notwithstanding division (A)(1) of this section, none of the following actions is an adverse underwriting decision, but the insurance institution or agent responsible for their occurrence shall nevertheless provide the applicant or policyholder with the specific reason or reasons for their occurrence:

(a) The termination of an individual policy form on a class or statewide basis;

(b) A declination of insurance coverage solely because the coverage is not available on a class or statewide basis;

(c) The rescission of a policy.

(B) "Affiliate" or "affiliated" means a person that directly, or indirectly through one or more intermediaries, controls, is controlled by, or is under common control with another person.

(C) "Agent" means a person licensed under Chapter 3905. of the Revised Code to negotiate or solicit applications for a policy or contract of life, health, or disability insurance.

(D) "Applicant" means any person that seeks to contract for life, health, or disability insurance coverage other than a person seeking group insurance that is not individually underwritten.

(E) "Consumer report" means any written, oral, or other communication of information bearing on a natural person's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living that is used or expected to be used in connection with a life, health, or disability insurance transaction.

(F) "Consumer reporting agency" means any person that does all of the following:

(1) Regularly engages, in whole or in part, in the practice of assembling or preparing consumer reports for a monetary fee;

(2) Obtains information primarily from sources other than insurance institutions;

(3) Furnishes consumer reports to other persons.

(G) "Control," including the terms "controlled by" or "under common control with," means the possession, direct or indirect, of the power to direct or cause the direction of the management and policies of a person, whether through the ownership of voting securities, by contract other than a commercial contract for goods or nonmanagement services, or otherwise, unless the power is the result of an official position with or corporate office held by the person.

(H) "Declination of insurance coverage" means a denial, in whole or in part, by an insurance institution or agent of requested insurance coverage.

(I) "Individual" means any natural person who in connection with life, health, or disability insurance:

(1) Is a past, present, or proposed principal insured or certificate holder;

(2) Is a past, present, or proposed policy owner;

(3) Is a past or present applicant;

(4) Is a past or present claimant;

(5) Derived, derives, or is proposed to derive insurance coverage under an insurance policy or certificate subject to sections 3904.01 to 3904.22 of the Revised Code.

(J) "Institutional source" means any person or governmental entity that provides information about an individual to an agent, insurance institution, or insurance support organization, other than any of the following:

(1) An agent;

(2) The individual who is the subject of the information;

(3) A natural person acting in a personal capacity rather than in a business or professional capacity.

(K) "Insurance institution" means any corporation, association, partnership, fraternal benefit society, or other person engaged in the business of life, health, or disability insurance, including health insuring corporations. "Insurance institution" does not include agents or insurance support organizations.

(L)(1) "Insurance support organization" means any person that regularly engages, in whole or in part, in the practice of assembling or collecting information about natural persons for the primary purpose of providing the information to an insurance institution or agent for insurance transactions, including both of the following:

(a) The furnishing of consumer reports or investigative consumer reports to an insurance institution or agent for use in connection with an insurance transaction;

(b) The collection of personal information from insurance institutions, agents, or other insurance support organizations for the purpose of detecting or preventing fraud, material misrepresentation, or material nondisclosure in connection with insurance underwriting or insurance claim activity.

(2) Notwithstanding division (L)(1) of this section, agents, government institutions, insurance institutions, medical care institutions, and medical professionals are not "insurance support organizations" for purposes of sections 3904.01 to 3904.22 of the Revised Code.

(M) "Insurance transaction" means any transaction involving life, health, or disability insurance primarily for personal, family, or household needs rather than business or professional needs and entailing either the determination of an individual's eligibility for a life, health, or disability insurance coverage, benefit, or payment, or the servicing of a life, health, or disability insurance application, policy, contract, or certificate.

(N) "Investigative consumer report" means a consumer report or portion thereof in which information about a natural person's character, general reputation, personal characteristics, or mode of living is obtained through personal interviews with the person's neighbors, friends, associates, acquaintances, or others who may have knowledge concerning such items of information.

(O) "Medical care institution" means any facility or institution that is licensed to provide health care services to natural persons, including home-health agencies, hospitals, medical clinics, public health agencies, rehabilitation agencies, and skilled nursing facilities.

(P) "Medical professional" means any person licensed or certified to provide health care services to natural persons, including a chiropractor, clinical dietitian, clinical psychologist, dentist, nurse, occupational therapist, optometrist, pharmacist, physical therapist, physician, podiatrist, psychiatric social worker, and speech therapist.

(Q) "Medical record information" means personal information that relates to an individual's physical or mental condition, medical history, or medical treatment and that is obtained from a medical professional or medical care institution, from the individual, or from the individual's spouse, parent, or legal guardian.

(R) "Personal information" means any individually identifiable information gathered in connection with an insurance transaction from which judgments can be made about an individual's character, habits, avocations, finances, occupation, general reputation, credit, health, or any other personal characteristics. "Personal information" includes an individual's name and address and medical record information but does not include privileged information.

(S) "Policyholder" means any person that is a present owner of individual life, health, or disability insurance, or a present certificate holder under group life, health, or disability insurance that is individually underwritten.

(T) "Pretext interview" means an interview whereby a person, in an attempt to obtain information about a natural person, performs one or more of the following acts:

(1) Pretends to be someone the interviewer is not;

(2) Pretends to represent a person the interviewer is not in fact representing;

(3) Misrepresents the true purpose of the interview;

(4) Refuses to identify self upon request.

(U) "Privileged information" means any individually identifiable information that relates to a claim for life, health, or disability insurance benefits or a civil or criminal proceeding involving an individual, and that is collected in connection with, or in reasonable anticipation of, a claim for life, health, or disability insurance benefits or civil or criminal proceeding involving an individual. However, information otherwise meeting the requirements of this division shall nevertheless be considered personal information if it is disclosed in violation of section 3904.13 of the Revised Code.

(V) "Termination of insurance coverage" or "termination of an insurance policy" means either a cancellation or nonrenewal of a life, health, or disability insurance policy, in whole or in part, for any reason other than the failure to pay a premium as required by the policy.

(W) "Unauthorized insurer" means an insurance institution that has not been granted a certificate of authority by the superintendent of insurance to transact the business of life, health, or disability insurance in this state.

Section 3904.02 | Applicability of chapter.
 

(A) The obligations of sections 3904.01 to 3904.22 of the Revised Code apply to those insurance institutions, agents, or insurance support organizations that, on or after the effective date of these sections, do either of the following:

(1) Collect, receive, or maintain information in connection with insurance transactions that pertains to natural persons who are residents of this state;

(2) Engage in insurance transactions with applicants, individuals, or policyholders who are residents of this state.

(B) The rights granted by sections 3904.01 to 3904.22 of the Revised Code extend to both of the following persons who are residents of this state:

(1) Natural persons who are the subject of information collected, received, or maintained in connection with insurance transactions;

(2) Applicants, individuals, or policyholders who engage in or seek to engage in insurance transactions.

(C) For purposes of this section, a person is considered a resident of this state if the person's last known mailing address, as shown in the records of the insurance institution, agent, or insurance support organization, is located in this state.

Section 3904.03 | Pretext interviews.
 

No insurance institution, agent, or insurance support organization shall use or authorize the use of pretext interviews to obtain information in connection with an insurance transaction. However, a pretext interview may be undertaken to obtain information from a person or institution that does not have a generally or statutorily recognized privileged relationship with the person about whom the information relates for the purpose of investigating a claim where, based upon specific information available for review by the superintendent of insurance, there is a reasonable basis for suspecting criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with the claim.

Section 3904.04 | Institution or agent to provide notice of information practices to applicants and policyholders.
 

(A) An insurance institution or agent shall provide a notice of information practices to all applicants or policyholders in connection with insurance transactions as provided below:

(1) In the case of an application for insurance, a notice shall be provided no later than one of the following times:

(a) At the time of the delivery of the insurance policy or certificate when personal information is collected only from the applicant or from public records;

(b) At the time the collection of personal information is initiated when personal information is collected from a source other than the applicant or public records.

(2) In the case of a policy renewal, a notice shall be provided no later than the policy renewal date, except that no notice shall be required in connection with a policy renewal if either of the following apply:

(a) Personal information is collected only from the policyholder or from public records;

(b) A notice meeting the requirements of this section has been given within the previous twenty-four months.

(3) In the case of a policy reinstatement or change in insurance benefits, a notice shall be provided no later than the time a request for a policy reinstatement or change in insurance benefits is received by the insurance institution, except that no notice shall be required if personal information is collected only from the policyholder or from public records.

(B) The notice required by division (A) of this section shall be in writing and shall state all of the following:

(1) Whether personal information may be collected from persons other than the individual or individuals proposed for coverage;

(2) The types of personal information that may be collected and the types of sources and investigative techniques that may be used to collect such information;

(3) The types of disclosures identified in divisions (B), (C), (D), (E), (F), (I), (K), (L), and (N) of section 3904.13 of the Revised Code and the circumstances under which such disclosures may be made without prior authorization. However, only those circumstances need be described that occur with such frequency as to indicate a general business practice;

(4) A description of the rights established under sections 3904.08 and 3904.09 of the Revised Code and the manner in which such rights may be exercised;

(5) That information obtained from a report prepared by an insurance support organization may be retained by the insurance support organization and disclosed to other persons.

(C) In lieu of the notice prescribed in division (B) of this section, the insurance institution or agent may provide an abbreviated notice informing the applicant or policyholder of all of the following:

(1) Personal information may be collected from persons other than the individual or individuals proposed for coverage;

(2) Such information as well as other personal or privileged information subsequently collected by the insurance institution or agent may in certain circumstances be disclosed to third parties without authorization;

(3) A right of access and correction exists with respect to all personal information collected;

(4) The notice prescribed in division (B) of this section will be furnished to the applicant or policyholder upon request.

(D) The obligations imposed by this section upon an insurance institution or agent may be satisfied by another insurance institution or agent authorized to act on its behalf.

Section 3904.05 | Marketing or research questions.
 

An insurance institution or agent shall clearly specify those questions designed to obtain information solely for marketing or research purposes from an individual in connection with an insurance transaction.

Section 3904.06 | Disclosure authorization form.
 

No insurance institution, agent, or insurance support organization shall use as its disclosure authorization form in connection with insurance transactions a form or statement that authorizes the disclosure of personal or privileged information about an individual to the insurance institution, agent, or insurance support organization, unless the form or statement:

(A) Is written in plain language;

(B) Is dated;

(C) Specifies the types of persons authorized to disclose information about the individual;

(D) Specifies the nature of the information authorized to be disclosed;

(E) Names the insurance institution or agent and identifies by generic reference representatives of the insurance institution to whom the individual is authorizing information to be disclosed;

(F) Specifies the purposes for which the information is collected;

(G) Specifies the length of time such authorization shall remain valid, which shall be no longer than:

(1) In the case of authorizations signed for the purpose of collecting information in connection with an application for an insurance policy, a policy reinstatement, or a request for change in policy benefits, thirty months from the date the authorization is signed;

(2) In the case of authorizations signed for the purpose of collecting information in connection with a claim for benefits under an insurance policy:

(a) The term of coverage of the policy if the claim is for a health insurance benefit;

(b) The duration of the claim if the claim is not for a health insurance benefit.

(H) Advises the individual or a person authorized to act on behalf of the individual that the individual or the individual's authorized representative is entitled to receive a copy of the authorization form.

Section 3904.07 | Investigative consumer report.
 

(A) No insurance institution, agent, or insurance support organization may prepare or request an investigative consumer report about an individual in connection with an insurance transaction involving an application for insurance, a policy renewal, a policy reinstatement, or a change in insurance benefits unless the insurance institution or agent informs the individual that he may request to be interviewed in connection with the preparation of the investigative consumer report, and that upon a request under section 3904.08 of the Revised Code, he is entitled to receive a copy of the investigative consumer report.

(B) If an investigative consumer report is to be prepared by an insurance institution or agent, the insurance institution or agent shall institute reasonable procedures to conduct a personal interview requested by an individual.

(C) If an investigative consumer report is to be prepared by an insurance support organization, the insurance institution or agent desiring such report shall inform the insurance support organization whether a personal interview has been requested by the individual. The insurance support organization shall institute reasonable procedures to conduct such interviews, if requested.

Section 3904.08 | Written request for access to recorded personal information.
 

(A) If any individual, after proper identification, submits a written request to an insurance institution, agent, or insurance support organization for access to recorded personal information about the individual that is reasonably described by the individual and reasonably locatable and retrievable by the insurance institution, agent, or insurance support organization, the insurance institution, agent, or insurance support organization, within thirty business days from the date such request is received, shall do all of the following:

(1) Inform the individual of the nature and substance of such recorded personal information in writing, by telephone, or by other oral communication, whichever the insurance institution, agent, or insurance support organization prefers;

(2) Permit the individual to obtain a copy of such recorded information in a manner agreed upon by the individual and insurance institution, agent, or insurance support organization, unless such recorded personal information is in coded form, in which case an accurate translation in plain language shall be provided in writing;

(3) Disclose to the individual the identity, if recorded, of those persons to whom the insurance institution, agent, or insurance support organization has disclosed such personal information within two years prior to such request, and if the identity is not recorded, the names of those insurance institutions, agents, insurance support organizations, or other persons to whom such information is normally disclosed;

(4) Provide the individual with a summary of the procedures by which the individual may request correction, amendment, or deletion of recorded personal information.

(B) Any personal information provided pursuant to division (A) of this section shall identify the source of the information if such source is an institutional source.

(C) Medical record information supplied by a medical care institution or medical professional and requested under division (A) of this section, together with the identity of the medical professional or medical care institution that provided such information, shall be supplied either directly to the individual or to a medical professional designated by the individual and licensed to provide medical care with respect to the condition to which the information relates, whichever the insurance institution, agent, or insurance support organization prefers. If it elects to disclose the information to a medical professional designated by the individual, the insurance institution, agent, or insurance support organization shall notify the individual, at the time of the disclosure, that it has provided the information to the medical professional.

(D) Except for personal information provided under section 3904.10 of the Revised Code, an insurance institution, agent, or insurance support organization may charge a reasonable fee to cover the costs incurred in providing a copy of recorded personal information to individuals.

(E) The obligations imposed by this section upon an insurance institution or agent may be satisfied by another insurance institution or agent authorized to act on its behalf. With respect to the copying and disclosure of recorded personal information pursuant to a request under division (A) of this section, an insurance institution, agent, or insurance support organization may make arrangements with an insurance support organization or a consumer reporting agency to copy and disclose recorded personal information on its behalf.

(F) The rights granted to individuals in this section extend to all natural persons to the extent information about them is collected and maintained by an insurance institution, agent, or insurance support organization in connection with an insurance transaction. The rights granted to all natural persons by this division do not extend to information about them that relates to and is collected in connection with or in reasonable anticipation of a claim or civil or criminal proceeding involving them.

(G) This section does not apply to a consumer reporting agency.

Last updated September 18, 2023 at 9:08 AM

Section 3904.09 | Correction, amendment or deletion of information.
 

(A) Within thirty business days from the date of receipt of a written request from an individual to correct, amend, or delete any recorded personal information about the individual within its possession, an insurance institution, agent, or insurance support organization shall do one of the following:

(1) Correct, amend, or delete the portion of the recorded personal information in dispute;

(2) Notify the individual of all of the following:

(a) Its refusal to make such correction, amendment or deletion;

(b) The reasons for the refusal;

(c) The individual's right to file a statement as provided under division (C) of this section.

(B) If the insurance institution, agent, or insurance support organization corrects, amends, or deletes recorded personal information under division (A)(1) of this section, the insurance institution, agent, or insurance support organization shall so notify the individual in writing and furnish the correction, amendment, or fact of deletion to all of the following:

(1) Any person specifically designated by the individual that may have, within the preceding two years, received such recorded personal information;

(2) Any insurance support organization whose primary source of personal information is insurance institutions if the insurance support organization has systematically received such recorded personal information from the insurance institution within the preceding seven years. However, the correction, amendment, or fact of deletion need not be furnished if the insurance support organization no longer maintains recorded personal information about the individual.

(3) Any insurance support organization that furnished the personal information that has been corrected, amended, or deleted.

(C) Whenever an individual disagrees with an insurance institution's, agent's, or insurance support organization's refusal to correct, amend, or delete recorded personal information, the individual shall be permitted to file with the insurance institution, agent, or insurance support organization both of the following:

(1) A concise statement setting forth what the individual thinks is the correct, relevant, or fair information;

(2) A concise statement of the reasons why the individual disagrees with the insurance institution's, agent's, or insurance support organization's refusal to correct, amend, or delete recorded personal information.

(D) If an individual files either statement under division (C) of this section, the insurance institution, agent, or insurance support organizations shall do all of the following:

(1) File the statement with the disputed personal information and provide a means by which anyone reviewing the disputed personal information will be made aware of the individual's statement and have access to it;

(2) In any subsequent disclosure by the insurance institution, agent, or insurance support organization of the recorded personal information that is the subject of disagreement, clearly identify the matter or matters in dispute and provide the individual's statement along with the recorded personal information being disclosed;

(3) Furnish the statement to the persons described and in the manner specified in division (B) of this section.

(E) The rights granted to individuals in this section extend to all natural persons to the extent information about them is collected and maintained by an insurance institution, agent, or insurance support organization in connection with an insurance transaction. The rights granted to all natural persons by this division do not extend to information about them that relates to and is collected in connection with or in reasonable anticipation of a claim or civil or criminal proceeding involving them.

(F) This section does not apply to a consumer reporting agency.

Section 3904.10 | Written reason for adverse underwriting decision summary of rights.
 

(A) In the event of an adverse underwriting decision, the insurance institution or agent responsible for the decision shall provide the applicant, policyholder, or individual proposed for coverage with the specific reason or reasons for the adverse underwriting decision in writing, or advise such person that upon written request he may receive the specific reason or reasons in writing. The institution or agent shall also provide the applicant, policyholder, or individual with a summary of his rights under division (B) of this section and under sections 3904.08 and 3904.09 of the Revised Code.

(B) Upon receipt of a written request within ninety business days from the date of the mailing of notice or other communication of an adverse underwriting decision to an applicant, policyholder, or individual proposed for coverage, the insurance institution or agent within twenty-one business days from the date of receipt of such written request, shall furnish all of the following:

(1) The specific reason or reasons for the adverse underwriting decision, in writing, if such information was not initially furnished in writing pursuant to division (A) of this section;

(2) The specific items of personal and privileged information that support those reasons. However, the following conditions apply:

(a) The insurance institution or agent shall not be required to furnish specific items of privileged information if it has a reasonable suspicion, based upon specific information available for review by the superintendent of insurance, that the applicant, policyholder, or individual proposed for coverage has engaged in criminal activity, fraud, material misrepresentation, or material nondisclosure;

(b) Specific items of medical record information supplied by a medical care institution or medical professional shall be disclosed either directly to the individual about whom the information relates or to a medical professional designated by the individual and licensed to provide medical care with respect to the condition to which the information relates, whichever the insurance institution or agent prefers.

(3) The names and addresses of the institutional sources that supplied the specific items of information pursuant to division (B)(2) of this section. However, the identity of any medical professional or medical care institution shall be disclosed either directly to the individual or to the designated medical professional, whichever the insurance institution or agent prefers.

(C) The obligations imposed by this section upon an insurance institution or agent may be satisified by another insurance institution or agent authorized to act on its behalf.

(D) When an adverse underwriting decision results solely from an oral request or inquiry, the explanation of reasons and summary of rights required by division (A) of this section may be given orally.

Section 3904.11 | Inquiry concerning previous adverse underwriting decision.
 

No insurance institution, agent, or insurance support organization may seek information in connection with an insurance transaction concerning any previous adverse underwriting decision experienced by an individual, unless such inquiry also requests the reasons for any previous adverse underwriting decision.

Section 3904.12 | Prohibited bases for adverse underwriting decision.
 

No insurance institution or agent may base an adverse underwriting decision in whole or in part on either of the following:

(A) On the fact of a previous adverse underwriting decision. However, an insurance institution or agent may base an adverse underwriting decision on further information obtained from an insurance institution or agent responsible for a previous adverse underwriting decision.

(B) On personal information received from an insurance support organization whose primary source of information is insurance institutions. However, an insurance institution or agent may base an adverse underwriting decision on further personal information obtained as a result of information received from such insurance support organization.

Section 3904.13 | Disclosure of personal or privileged information.
 

No insurance institution, agent, or insurance support organization shall disclose any personal or privileged information about an individual collected or received in connection with an insurance transaction, unless the disclosure is made pursuant to any of the following:

(A) With the written authorization of the individual, provided:

(1) If such authorization is submitted by another insurance institution, agent, or insurance support organization, the authorization meets the requirements of section 3904.06 of the Revised Code;

(2) If such authorization is submitted by a person other than an insurance institution, agent, or insurance support organization, the authorization is dated, signed by the individual, and obtained one year or less prior to the date a disclosure is sought under this division.

(B) To a person other than an insurance institution, agent, or insurance support organization, provided such disclosure is reasonably necessary for the following reasons:

(1) To enable such person to perform a business, professional, or insurance function for the disclosing insurance institution, agent, or insurance support organization, and such person agrees not to disclose the information further without the individual's written authorization unless the further disclosure either:

(a) Would otherwise be permitted by this section if made by an insurance institution, agent, or insurance support organization;

(b) Is reasonably necessary for such person to perform the person's function for the disclosing insurance institution, agent, or insurance support organization.

(2) To enable such person to provide information to the disclosing insurance institution, agent, or insurance support organization for the purpose of either:

(a) Determining an individual's eligibility for an insurance benefit or payment;

(b) Detecting or preventing criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with an insurance transaction.

(C) To an insurance institution, agent, insurance support organization, or self-insurer, provided the information disclosed is limited to that which is reasonably necessary either:

(1) To detect or prevent criminal activity, fraud, material misrepresentation, or material nondisclosure in connection with insurance transactions;

(2) For either the disclosing or receiving insurance institution, agent, or insurance support organization to perform its function in connection with an insurance transaction involving the individual.

(D) To a medical care institution or medical professional for the purpose of verifying insurance coverage or benefits, informing an individual of a medical problem of which the individual may not be aware, or conducting an operations or services audit to verify the individuals treated by the medical professional or at the medical care institution. However, only such information may be disclosed as is reasonably necessary to accomplish any of the purposes set forth in this division.

(E) To an insurance regulatory authority;

(F) To a law enforcement or other governmental authority to protect the interests of the insurance institution, agent, or insurance support organization in preventing or prosecuting the perpetration of fraud upon it; or if the insurance institution, agent or insurance support organization reasonably believes that illegal activities have been conducted by the individual;

(G) As otherwise permitted or required by law;

(H) In response to a facially valid administrative or judicial order, including a search warrant or subpoena;

(I) Made for the purpose of conducting actuarial or research studies, provided the following conditions are met:

(1) No individual may be identified in any actuarial or research report;

(2) Materials allowing the individual to be identified are returned or destroyed as soon as they are no longer needed;

(3) The actuarial or research organization agrees not to disclose the information unless the disclosure would otherwise be permitted by this section if made by an insurance institution, agent, or insurance support organization.

(J) To a party or representative of a party to a proposed or consummated sale, transfer, merger, or consolidation of all or part of the business of the insurance institution, agent, or insurance support organization, provided the following conditions are met:

(1) Prior to the consummation of the sale, transfer, merger, or consolidation, only such information is disclosed as is reasonably necessary to enable the recipient to make business decisions about the purchase, transfer, merger, or consolidation;

(2) The recipient agrees not to disclose the information, unless the disclosure would otherwise be permitted by this section if made by an insurance institution, agent, or insurance support organization.

(K) To a person whose only use of such information will be in connection with the marketing of a product or service, provided the following conditions are met:

(1) No medical record information, privileged information, or personal information relating to an individual's character, personal habits, mode of living, or general reputation is disclosed, and no classification derived from such information is disclosed;

(2) The individual has been given an opportunity to indicate that the individual does not want personal information disclosed for marketing purposes and has given no indication that the individual does not want the information disclosed;

(3) The person receiving such information agrees not to use it except in connection with the marketing of a product or service.

(L) To an affiliate whose only use of the information will be in connection with an audit of the insurance institution or agent or the marketing of an insurance product or service, provided the affiliate agrees not to disclose the information for any other purpose or to unaffiliated persons;

(M) By a consumer reporting agency, provided the disclosure is to a person other than an insurance institution or agent;

(N) To a group policyholder for the purpose of reporting claims experience or conducting an audit of the insurance institution's or agent's operations or services, provided the information disclosed is reasonably necessary for the group policyholder to conduct the review or audit;

(O) To a group policyholder as provided in section 3901.89 of the Revised Code;

(P) To a professional peer review organization for the purpose of reviewing the service or conduct of a medical care institution or medical professional;

(Q) To a governmental authority for the purpose of determining the individual's eligibility for health benefits for which the governmental authority may be liable;

(R) To a certificate holder or policyholder for the purpose of providing information regarding the status of an insurance transaction;

(S) To a lienholder, mortgagee, assignee, lessor, or other person shown on the records of an insurance institution or agent as having a legal or beneficial interest in a policy of insurance, provided the following conditions are met:

(1) No medical record information is disclosed unless the disclosure would otherwise be permitted by this section;

(2) The information disclosed is limited to that which is reasonably necessary to permit such person to protect its interests in such policy.

Section 3904.14 | Obtaining information under false pretenses.
 

(A) No person shall knowingly obtain information under false pretenses about an individual from an insurance institution, agent, or insurance support organization.

(B) Whoever violates division (A) of this section is guilty of a felony of the fourth degree.

Section 3904.15 | Superintendent may examine and investigate conduct.
 

(A) The superintendent of insurance may examine and investigate into the affairs of every insurance institution or agent doing business in this state to determine whether the insurance institution or agent has been or is engaged in any conduct in violation of sections 3904.01 to 3904.22 of the Revised Code.

(B) The superintendent may examine and investigate into the affairs of every insurance support organization acting on behalf of an insurance institution or agent that either transacts business in this state or transacts business outside this state that has an effect on a person residing in this state to determine whether such insurance support organization has been or is engaged in any conduct in violation of sections 3904.01 to 3904.22 of the Revised Code.

Section 3904.16 | Superintendent to issue and serve statement of charges and notice of hearing.
 

(A) Whenever the superintendent of insurance has reason to believe that an insurance institution, agent, or insurance support organization has been or is engaged in conduct in this state that violates sections 3904.01 to 3904.22 of the Revised Code, or if the superintendent believes that an insurance support organization has been or is engaged in conduct outside this state that has an effect on a person residing in this state and that violates these sections, the superintendent shall issue and serve upon such insurance institution, agent, or insurance support organization a statement of charges and notice of hearing to be held at a time and place fixed in the notice. The date for such hearing shall be not less than thirty days after the date of service.

(B) At the time and place fixed for such hearing, the insurance institution, agent, or insurance support organization charged shall have an opportunity to answer the charges against it and present evidence on its behalf. Upon good cause shown, the superintendent shall permit any adversely affected person to intervene, appear, and be heard at such hearing by counsel or in person.

(C) At any hearing conducted pursuant to this section, the superintendent may administer oaths, examine, and cross-examine witnesses and receive oral and documentary evidence. The superintendent may subpoena witnesses, compel their attendance, and require the production of books, papers, records, correspondence and other documents that are relevant to the hearing. A stenographic record of the hearing shall be made upon the request of any party or at the discretion of the superintendent. If no stenographic record is made and if judicial review is sought, the superintendent shall prepare a statement of the evidence for use on the review. Hearings conducted under this section are governed by the same rules of evidence and procedure applicable to administrative proceedings conducted under Chapter 119. of the Revised Code.

(D) Statements of charges, notices, orders, and other processes of the superintendent under sections 3904.01 to 3904.22 of the Revised Code may be served by anyone authorized to act on behalf of the superintendent. Service of process may be completed in the manner provided by law for service of process in civil actions or by registered mail. A copy of the statement of charges, notice, order or other process shall be provided to the person or persons whose rights under these sections have been allegedly violated. A verified return setting forth the manner of service, or return postcard receipt in the case of registered mail, is sufficient proof of service.

Section 3904.17 | Organization transacting business outside state - superintendent of insurance to accept service of process.
 

For the purpose of sections 3904.01 to 3904.22 of the Revised Code, an insurance support organization transacting business outside this state that has an effect on a person residing in this state is deemed to have appointed the superintendent of insurance to accept service of process on its behalf, provided the superintendent causes a copy of such service to be mailed forthwith by registered mail to the insurance support organization at its last known principal place of business. The return postcard receipt for the mailing is sufficient proof that the copy of the service of process was properly mailed by the superintendent.

Section 3904.18 | Cease and desist order or report finding no violation - petition for review.
 

(A) If, after a hearing pursuant to section 3904.16 of the Revised Code, the superintendent of insurance determines that the insurance institution, agent, or insurance support organization charged has engaged in conduct or practices in violation of sections 3904.01 to 3904.22 of the Revised Code, the superintendent shall reduce his findings to writing and shall issue and cause to be served upon such insurance institution, agent, or insurance support organization a copy of such findings and an order requiring such insurance institution, agent, or insurance support organization to cease and desist from the conduct or practices constituting a violation of these sections.

(B) If, after a hearing pursuant to section 3904.16 of the Revised Code, the superintendent determines that the insurance institution, agent, or insurance support organization charged has not engaged in conduct or practices in violation of sections 3904.01 to 3904.22 of the Revised Code, the superintendent shall prepare a written report that sets forth findings of fact and conclusions of law. The report shall be served upon the insurance institution, agent, or insurance support organization charged and upon the person or persons, if any, whose rights under these sections were allegedly violated.

(C) Until the expiration of the time allowed under section 3904.20 of the Revised Code for filing a petition for review or until such petition is actually filed, whichever occurs first, the superintendent may modify or set aside any order or report issued under this section. After the expiration of the time allowed under section 3904.20 of the Revised Code for filing a petition for review, if no such petition has been filed, the superintendent may, after notice and opportunity for hearing, alter, modify, or set aside, in whole or in part, any order or report issued under this section whenever conditions of fact or law warrant such action or if the public interest so requires.

Section 3904.19 | Penalties for knowing violation or violation of cease and desist order.
 

(A) In any case where a hearing pursuant to section 3904.16 of the Revised Code results in the finding of a knowing violation of sections 3904.01 to 3904.22 of the Revised Code, the superintendent of insurance may, in addition to the issuance of a cease and desist order as prescribed in section 3904.18 of the Revised Code, order payment of a monetary penalty of not more than five hundred dollars for each violation but not to exceed ten thousand dollars in the aggregate for multiple violations.

(B) Any person who violates a cease and desist order of the superintendent under section 3904.18 of the Revised Code may, after notice and hearing and upon order of the superintendent, be subject to one or more of the following penalties, at the discretion of the superintendent:

(1) A monetary fine of not more than ten thousand dollars for each violation;

(2) A monetary fine of not more than fifty thousand dollars if the superintendent finds that violations have occurred with such frequency as to constitute a general business practice;

(3) Suspension or revocation of an insurance institution's or agent's license.

Section 3904.20 | Review of order or report of superintendent by court of common pleas.
 

(A) Any person subject to an order of the superintendent of insurance under section 3904.19 of the Revised Code, or any person whose rights under sections 3904.01 to 3904.22 of the Revised Code were allegedly violated, may obtain a review of any order or report of the superintendent by filing in the appropriate common pleas court, within thirty days from the date of the service of such order or report, a written petition requesting that the order or report of the superintendent be set aside. A copy of the petition shall be simultaneously served upon the superintendent, who shall forthwith certify and file in such court a transcript of the entire record of the proceeding giving rise to the order or report that is the subject of the petition. Upon filing of the petition and transcript, the court shall have jurisdiction to make and enter a decree modifying, affirming, or reversing any order or report of the superintendent, in whole or in part. The findings of the superintendent as to the facts supporting any order or report, if supported by clear and convincing evidence, are conclusive.

(B) To the extent an order or report of the superintendent is affirmed, the court shall issue its own order commanding obedience to the terms of the order or report of the superintendent. If any party affected by an order or report of the superintendent applies to the court for leave to produce additional evidence and shows to the satisfaction of the court that such additional evidence is material and that there are reasonable grounds for the failure to produce such evidence in prior proceedings, the court may order such additional evidence to be taken before the superintendent in such manner and upon such terms and conditions as the court may consider proper. The superintendent may modify his findings of fact or make new findings by reason of the additional evidence so taken and shall file such modified or new findings along with any recommendation, if any, for the modification or revocation of a previous order or report. If supported by clear and convincing evidence, the modified or new findings are conclusive as to the matters contained therein.

(C) An order or report issued by the superintendent under section 3904.18 or 3904.19 of the Revised Code shall become final upon one of the following:

(1) Upon the expiration of the time allowed for the filing of a petition for review, if no such petition has been filed. However, the superintendent may modify or set aside an order or report to the extent provided in division (C) of section 3904.18 of the Revised Code.

(2) Upon a final decision of the common pleas court, if the court directs that the order or report of the superintendent be affirmed or the petition for review dismissed.

(D) No order or report of the superintendent under sections 3904.01 to 3904.22 of the Revised Code, or order of a court to enforce the same, shall in any way relieve or absolve any person affected by such order or report from any liability under any law of this state.

Section 3904.21 | Action by person whose rights are violated.
 

(A) If any insurance institution, agent, or insurance support organization fails to comply with section 3904.08, 3904.09, or 3904.10 of the Revised Code with respect to the rights granted under such section, any person whose rights are violated may apply to the appropriate common pleas court, or any other court of competent jurisdiction, for appropriate equitable relief.

(B) An insurance institution, agent, or insurance support organization that discloses information in violation of section 3904.13 of the Revised Code is liable for damages sustained by the individual about whom the information relates. However, no individual shall be entitled to a monetary award that exceeds the actual damages sustained by the individual as a result of a violation of section 3904.13 of the Revised Code.

(C) In any action brought pursuant to this section, the court may award the cost of the action and reasonable attorney's fees to the prevailing party.

(D) An action under this section must be brought within two years from the date the alleged violation is or should have been discovered.

(E) Except as specifically provided in this section, there shall be no remedy or recovery available to individuals, in law or in equity, for occurrences constituting a violation of any provisions of sections 3904.01 to 3904.22 of the Revised Code.

Section 3904.22 | Authorized disclosures of personal or privileged information - immunity.
 

No cause of action in the nature of defamation, invasion of privacy, or negligence shall arise against any person for disclosing personal or privileged information in accordance with sections 3904.01 to 3904.22 of the Revised Code, nor shall such a cause of action arise against any person for furnishing personal or privileged information to an insurance institution, agent, or insurance support organization. However, this section provides no immunity for disclosing or furnishing false information with purpose to injure any person.