Health IQ Insurance Services Inc., a life insurance brokerage that marketed discounted premiums to health-conscious consumers through a platform that assessed lifestyle and health data to identify applicants eligible for preferred rates, was charged with sharing the detailed personal health, fitness, and medical history information that applicants submitted during the insurance application process with third-party marketing partners — in violation of the company's privacy representations and without the clear disclosure and affirmative consent that its collection of such sensitive information required.DOCUMENTED
Health IQ's marketing proposition was specifically built around health data collection — the company promised that consumers who demonstrated healthy behaviors could access life insurance at lower premiums than the standard market offered, using a detailed health and lifestyle questionnaire to identify qualified applicants. This proposition required applicants to provide extensive personal information about their exercise habits, diet, medical history, medications, and health conditions as part of the application process. When this information was shared with marketing partners beyond the scope of what applicants had been told would happen to their data, the privacy violation was compounded by the sensitivity of the data involved.DOCUMENTED
- Health IQ collected detailed health questionnaires from life insurance applicants covering exercise routines, dietary practices, medical history, medications, and health conditions
- Privacy representations stated applicant data would be used only for insurance underwriting purposes and would not be shared with third parties for marketing
- Health IQ shared applicant data including health and fitness information with marketing partners who used it for targeted marketing unrelated to the insurance underwriting purpose
- Applicants who believed their sensitive health information was being used to qualify them for insurance discounts discovered it had been provided to companies outside the insurance relationship
- The consent order prohibits Health IQ from sharing applicant health and lifestyle data with any entity outside the insurance underwriting process without affirmative consent
The Health Data Collection Model
Health IQ's application process asked prospective insurance customers to complete a detailed lifestyle assessment covering their weekly exercise frequency and type, dietary practices and food choices, body mass index and health metrics, existing medical diagnoses, prescription medications, and family medical history. This information was more detailed than what a typical life insurance application requires — it was specifically designed to identify health and lifestyle characteristics associated with lower mortality risk, allowing Health IQ to negotiate preferred rates from underwriting insurance carriers.DOCUMENTED
The depth of the health questionnaire was justified to applicants as a tool that worked in their favor — providing the detail needed to demonstrate their health-consciousness and qualify for the lower premiums that Health IQ's value proposition promised. Applicants had a direct incentive to answer fully and honestly: the more comprehensively they described their healthy behaviors, the better their chances of qualifying for the advertised discounts. This incentive structure produced unusually complete and accurate health and lifestyle profiles that had significant commercial value beyond the insurance underwriting purpose.DOCUMENTED
The Third-Party Data Sharing
Health IQ shared applicant health and lifestyle data with marketing partners whose relationship to the applicants was not disclosed during the application process. The marketing partners used the data to target applicants with advertising for products and services ranging from fitness equipment and nutrition supplements to financial services and other insurance products. Applicants who began receiving targeted marketing after their Health IQ application — particularly marketing that appeared to reflect knowledge of their specific health interests and practices — discovered that their insurance application data had been used for commercial purposes beyond what they had been told.DOCUMENTED
The privacy policy misrepresentation was specific: Health IQ told applicants that their health and lifestyle information would be used for insurance qualification purposes and would not be shared with third parties for marketing. The sharing that actually occurred was inconsistent with this representation. Regulators found that the sharing arrangements were built into Health IQ's business model — the marketing partner revenue was a meaningful component of the company's commercial relationships — rather than being an inadvertent privacy failure.DOCUMENTED
Applicants who provided detailed information about their health conditions and exercise routines to qualify for insurance discounts found that same information being used to target them with marketing for fitness products, supplements, and financial services — commercial uses they had been told would not occur.
Life Insurance Applicant Privacy Rights
Life insurance applicants provide some of the most sensitive personal information they share with any private company — health history, medications, family medical history, and lifestyle details that reveal aspects of their health and personal circumstances that they share with very few people. The trust basis on which applicants provide this information includes an expectation that it will be used for the insurance evaluation purpose for which it was collected and will not be repurposed for commercial uses they did not agree to. When an insurance company or broker violates this trust by sharing applicant health data with marketing partners, it exploits the compelled disclosure that the underwriting process requires in a way that applicants have no practical ability to avoid if they want to obtain insurance coverage.REVIEWED
The consent order requires Health IQ to delete all applicant health and lifestyle data that was shared with marketing partners for non-underwriting purposes, to obtain affirmative consent before sharing any applicant health data with any entity outside the insurance underwriting process going forward, and to implement a data governance program that limits internal access to applicant health information to personnel involved in the underwriting process. Life insurance applicants should review the privacy practices of any insurance broker before completing a detailed health questionnaire, and should specifically ask whether their health data will be shared with any entity other than the underwriting insurer for purposes other than the insurance application itself.DOCUMENTED
Health Data and Insurance Applications
Life and health insurance applications require more detailed health information disclosure than almost any other consumer transaction, and applicants should understand their rights regarding how that information is used. Under the Fair Credit Reporting Act and state insurance regulations, insurers and their agents have specific obligations regarding the use, retention, and sharing of applicant health information. Before completing a health questionnaire as part of an insurance application, consumers should ask the agent or broker specifically what will be done with their health data, whether it will be shared with any entity other than the underwriting insurer, and whether they can opt out of any non-underwriting data use. Consumers who discover that their insurance application health data has been shared with third parties without their consent should file complaints with their state insurance department and consider consulting a privacy attorney about potential remedies under state privacy law.
Sources behind this report
Have documents relevant to this story? Reach us through our tips channel.