Consumer Reports in Insurance Underwriting: FCRA Permissible Purpose and Adverse Action Notices

Research question

What does the Fair Credit Reporting Act require of an insurance agency that obtains a consumer report, and what must the agency do when it takes an adverse action based on that report?

The question matters for agency operations because underwriting support, renewal review, and account screening can all involve consumer report data. The Fair Credit Reporting Act, often called the FCRA, sets the rules for obtaining, using, safeguarding, and disposing of that data, and it imposes a specific notice duty when the data contributes to an unfavorable insurance decision. This paper reviews the primary statute and the Federal Trade Commission's guidance for insurers. It is not legal advice.

Method

This is a desk review of three sources:

1. The Federal Trade Commission's business guidance page, "Consumer Reports: What Insurers Need to Know," which describes insurer obligations under the FCRA. The page notes it was edited in January 2025 to reflect inflation-adjusted civil penalty maximums.
2. The FCRA itself, 15 U.S.C. 1681 et seq., with particular attention to the permissible purpose provision, the medical information provisions, the definition of adverse action, and the adverse action notice provision.
3. The FTC's guidance pages on the Disposal Rule and the Furnisher Rule, which the insurer guidance references.

The FTC page was read in full. The statutory citations it relies on were cross-checked at the section level. No consumer reports, underwriting files, or agency procedures were examined. No survey or statistical analysis was performed. Evidence checked September 18, 2026.

Evidence

Who the FCRA covers and what a consumer report is

The FTC states that an insurer that uses consumer reports to underwrite insurance policies or screen high-risk applicants must comply with the FCRA. The law is designed to protect the privacy of consumer report information, sometimes informally called credit reports, and to promote accuracy in the information that consumer reporting agencies supply.

The FTC describes the scope of the data broadly. A consumer report may include information about a person's credit history, medical conditions, driving record, criminal activity, or participation in dangerous sports. That breadth is why the permissible purpose requirement matters: the data is not limited to credit.

Source fact: If an agency obtains a consumer report for underwriting or screening, the FCRA applies to how the report is obtained, used, and destroyed.

Permissible purpose

The FTC states that an insurer must have a permissible purpose before obtaining a consumer report, and that the relevant purpose is generally that the report will be used in connection with the underwriting of insurance involving the consumer or with the consumer's permission. The guidance cites section 604 of the FCRA, which appears at 15 U.S.C. 1681b.

This is a condition on obtaining the report, and it is separate from what the agency may do with the report afterward. The permissible purpose should be identifiable and tied to an actual insurance transaction involving the consumer.

Source fact: Underwriting of insurance involving the consumer is a recognized permissible purpose, but the agency should be able to point to the transaction that supports it.

Medical information requires consent

The FTC states that if an insurer needs a consumer report that contains medical information, the insurer must get the applicant's permission before the consumer reporting agency can issue the report, citing section 604(g)(1)(A). The guidance adds that the insurer may share the medical information only to carry out the transaction for which the report was obtained, or as permitted by law, citing section 604(g)(4).

This is a higher bar than ordinary permissible purpose. The applicant's permission is required before the medical information is obtained, not after.

Source fact: Medical information in a consumer report carries a consent requirement that ordinary underwriting data does not.

Adverse action and the notice duty

The FTC states that when an adverse action is taken, and the decision is based partly or completely on information in a consumer report, section 615(a) of the FCRA requires the insurer to provide an adverse action notice to the consumer. The guidance gives examples of adverse action in insurance: insurance is denied, rates are increased, or a policy is terminated.

The notice must include, according to the FTC:

• the name, address, and telephone number of the consumer reporting agency that supplied the report, including the toll-free telephone number if the agency maintains files nationwide;
• a statement that the consumer reporting agency that supplied the report did not make the decision to take the adverse action and cannot give the specific reasons for it; and
• a notice of the individual's right to dispute the accuracy or completeness of the information the consumer reporting agency furnished, and the right to a free report from that agency within 60 days if the person asks.

The FTC emphasizes that the notice is required even if the consumer report was not the primary reason for the decision, and even if the report played only a small part. The guidance also explains that while the notice is not required to be in writing, many insurers provide it in writing and keep copies for two years to prove compliance.

The guidance defines adverse action to include an increase in the charge for existing insurance or another unfavorable change in the terms of existing insurance, such as the amount of coverage or the policy's terms, citing section 603(k)(1)(B)(i). The FTC's worked example involves an insurer that rechecks an existing policyholder's consumer report at renewal and raises the premium after seeing a decline in credit history; the guidance states that an adverse action notice is required in that situation.

Source fact: The adverse action notice is triggered by contribution, not causation. Partial reliance is enough.

Disposal of consumer report information

The FTC states that when an insurer finishes using a consumer report, it must securely dispose of the report and any information gathered from it, including burning, pulverizing, or shredding paper documents and disposing of electronic information so that it cannot be read or reconstructed. The referenced Disposal Rule is codified in part at 16 CFR 682.

Source fact: Disposal is an affirmative duty. Retention of report data beyond its use creates a continuing obligation to protect and eventually destroy it.

If the agency reports data to a consumer reporting agency

The FTC states that an insurer that reports information, such as a consumer's insurance claims, to a consumer reporting agency has obligations under the FCRA's Furnisher Rule. Those responsibilities include furnishing information that is accurate and complete and investigating consumer disputes about the accuracy of the information the agency provides. The FTC points readers to its separate furnisher guidance and to Regulation V.

Source fact: The FCRA can apply to an agency both as a user of reports and as a furnisher of data.

Consequences of non-compliance

The FTC states that non-compliance can lead to suits by the FTC, the Consumer Financial Protection Bureau, state governments, and in some cases consumers, and that the FCRA provides for maximum penalties of $4,983 per violation in FTC enforcement, citing FCRA sections 616, 617, and 621.

Findings

Finding 1: Permissible purpose is a gate. An agency should be able to identify the underwriting or consumer-permission basis for each report it obtains, because the FCRA conditions access on that purpose.

Finding 2: Medical data is treated more strictly. The applicant's permission is required before a report containing medical information is obtained.

Finding 3: The adverse action notice duty is broader than a denial. Rate increases and other unfavorable changes to existing coverage can trigger the notice, and partial reliance is enough.

Finding 4: The notice has required content. The consumer reporting agency's contact information, the statement that the agency did not make the decision, and the dispute and free-report rights must be communicated.

Finding 5: Duties do not end when the decision is made. Disposal obligations continue, and an agency that furnishes data takes on accuracy and dispute duties.

Interpretation: what this means for an insurance agency using a virtual assistant

The following is the author's interpretation, not statutory or agency text.

• A virtual assistant who orders consumer reports, screens applicants, or prepares adverse action letters is performing steps in a regulated process. The agency remains responsible for the permissible purpose and for the quality of the notices that leave the office.
• The highest-risk handoff is an adverse action that a support role prepares without a clear template. If the template omits the consumer reporting agency's contact information or the dispute rights, the notice may fail even if the decision was correct.
• Because partial reliance triggers the notice, the practical control is to record whether a consumer report was consulted at all, not merely whether it was decisive.
• Disposal is easy to overlook in a remote workflow. A virtual assistant who works from a home office needs a defined method for destroying report data, and the method should be documented.

Operational implications

These are proposed steps derived from the sources, not a legal checklist.

1. Document the permissible purpose for each report request and tie it to the insurance transaction or the consumer's permission.
2. Flag medical information and confirm the applicant's permission before a report containing it is obtained.
3. Use a compliant adverse action template that includes the consumer reporting agency's identification and contact details, the non-decision statement, and the dispute and free-report rights.
4. Record whether a consumer report was consulted on every adverse insurance decision, because partial reliance is enough to trigger the notice.
5. Define retention and disposal for report data and the information derived from it, including electronic copies in a remote workspace.
6. Train the review step so a second person checks the notice before it is sent when a decision is adverse.
7. Handle furnisher duties if the agency reports claims or other data to a consumer reporting agency, including dispute investigation.
8. Confirm with counsel. FCRA compliance is fact-specific and interacts with state law.

Limitations

• Not legal advice. This paper summarizes the statute and FTC guidance. It does not determine whether any particular agency, report, or notice complies.
• Guidance is a summary. The FTC page is plain-language guidance; the statute controls. Definitions and exceptions were reviewed at the section level but not exhaustively.
• State law may add requirements. State insurance and credit-reporting laws can impose additional duties. None were reviewed here.
• Penalty figures change. The $4,983 figure reflects the inflation-adjusted maximum the FTC page identified as of January 2025. Confirm the current amount.
• No facts. No agency file, underwriting decision, or notice was examined.

Practical conclusion

The FCRA framework for insurers rests on four controls an agency can build: access reports only for a recognized purpose, obtain consent before medical information is used, send a complete adverse action notice whenever a report contributed to an unfavorable decision, and dispose of report data securely. For an agency delegating underwriting support or screening to a virtual assistant, the practical response is a documented purpose, a controlled adverse action template, an explicit record of whether a report was consulted, and a disposal routine that works in a remote setting. Because the duties are fact-specific and layered with state law, the agency should confirm its process with qualified counsel.

Sources

1. Federal Trade Commission, Consumer Reports: What Insurers Need to Know. https://www.ftc.gov/business-guidance/resources/consumer-reports-what-insurers-need-know
2. Fair Credit Reporting Act, 15 U.S.C. 1681 et seq. (permissible purpose at section 604, 15 U.S.C. 1681b; definitions at section 603, 15 U.S.C. 1681a; adverse action notice at section 615, 15 U.S.C. 1681m). https://www.law.cornell.edu/uscode/text/15/1681
3. Federal Trade Commission, Disposal of Consumer Report Information (Disposal Rule, 16 CFR Part 682). https://www.ftc.gov/legal-library/browse/rules/disposal-consumer-report-information
4. Federal Trade Commission, Consumer Reports: What Information Furnishers Need to Know (Furnisher Rule and Regulation V). https://www.ftc.gov/business-guidance/resources/consumer-reports-what-information-furnishers-need-know