An insurer in North Carolina collects personal information from an applicant and later wants to disclose it to a third party. Which body of law governs the insurer's handling of that personal information?

Why C is correct

Under the North Carolina Insurance Information and Privacy Protection Act, G.S. 58-39-5 through 58-39-120, insurers must follow rules on collecting, using, and disclosing personal information, including giving individuals rights of access and correction. The Act is the state-level privacy framework for insurance transactions.

Why the other options are wrong

• A) Federal health privacy law governs health information in specific contexts but does not displace North Carolina's insurance privacy statute.
• B) The false pretenses statute is a criminal fraud provision, not a privacy framework.
• D) The guaranty association article protects policyholders against insurer insolvency and has nothing to do with information privacy.

Memory hook

Insurance privacy lives in Article 39.

Why B is correct

The Insurance Information and Privacy Protection Act, Article 39 of Chapter 58 (G.S. 58-39-5 through 58-39-120), governs how insurers collect, use, and disclose personal information. It imposes standards for information practices and gives individuals rights to learn what is on file, access the recorded information, and correct or dispute it — a privacy framework that applies to accident and health underwriting as much as to any other line.

Why the other options are wrong

• A) The Act exists to prevent exactly this: unrestricted disclosure of personal information to outside parties is not permitted once collected under its standards.
• C) The Act prescribes access, correction, and disclosure rules, not a mandatory 30-day file destruction regime.
• D) The Act regulates insurer information practices directly; it does not require prior Commissioner approval for the ordinary recording of underwriting information.

Memory hook

Article 39: collect by the rules, disclose by the rules, let them see and fix their file.

Why C is correct

Under the Insurance Information and Privacy Protection Act (G.S. 58-39-5 through 58-39-120, Article 39), insurers must follow statutory standards for notice, authorization, and disclosure when they collect, use, or share an individual's personal information. The Act balances the industry's legitimate underwriting needs with the individual's right to know and correct the information held about them.

Why the other options are wrong

• A is wrong because the Act imposes notice and authorization requirements even for disclosures to affiliates; information cannot simply be shared freely.
• B is wrong because the Act does not require the Commissioner's prior approval of each collection of information; it sets conduct standards for insurers instead.
• D is wrong because the Act covers personal information generally, including financial and underwriting information, not only health data.

Memory hook

Article 39: notice, authorization, disclosure - privacy is a process, not a permission slip.