Privacy Law Library

Connecticut Insurance Information and Privacy Protection Act

CT IIPPA

Financial · Health

Based on the NAIC model, this act governs how insurers and agents collect, use and disclose personal and medical information: notices of information practices, limits on pretext interviews, access and correction rights, reasons for adverse underwriting decisions, and consent for most disclosures. It also bars anyone from selling individually identifiable medical record information.

Where
Connecticut
Citation
Conn. Gen. Stat. 38a-975 to 38a-999a (ch. 705)
Status
In force
In force since
1982-10-01
Enforced by
Connecticut Insurance Commissioner; individuals in court for certain violations
People can sue
Limited
Penalties
Commissioner penalties up to $2,000 per negligent violation (max $20,000 aggregate) and up to $5,000 per intentional violation (max $50,000 aggregate), plus cease and desist orders (38a-993). Individuals may sue for equitable relief over access, correction and adverse-decision rights and for actual damages from unlawful disclosures (38a-995); 38a-988a provides its own cause of action.
Applies to
  • Insurance institutions, agents and insurance-support organizations that collect, receive or maintain information in connection with insurance transactions involving Connecticut residents (38a-977)
  • The ban on selling medical record information (38a-988a) applies to any person, including health care professionals, pharmacies, drug companies, schools and universities

What a privacy notice must say

  • Provide applicants and policyholders a notice of insurance information practices at application or renewal.Conn. Gen. Stat. 38a-979
  • Give the specific reasons for an adverse underwriting decision.Conn. Gen. Stat. 38a-985

Rights it gives people

  • Correct, amend or delete recorded personal information on request or explain a refusal.Conn. Gen. Stat. 38a-984
  • On a written request, within 30 business days disclose recorded personal information about the individual and let them see and copy it.Conn. Gen. Stat. 38a-983

Practices it requires

  • Do not disclose personal or privileged information collected in an insurance transaction without written authorization unless a listed exception applies.Conn. Gen. Stat. 38a-988
  • No person may sell individually identifiable medical record information or disclose it for marketing without prior written consent.Conn. Gen. Stat. 38a-988a(a)
  • Do not use pretext interviews to obtain information, except in limited claim-fraud investigations.Conn. Gen. Stat. 38a-978

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Section 38a-999b (insurer information security and breach notice) was repealed effective 2021-10-01 and is superseded by 38a-38. | Effective date given is the applicability date in 38a-977 (Oct. 1, 1982); last amendment dates not reviewed.

Research reference, not legal advice.