Overview: Federal law has fundamentally transformed health insurance underwriting — knowing what is permitted and what is forbidden protects agents and clients alike.

The Affordable Care Act (ACA)

The ACA's most significant underwriting provisions are:

Guaranteed issue: ACA-compliant individual and small-group plans must accept any eligible applicant during the open enrollment period or a qualifying special enrollment period, regardless of health status. There is no medical screening, no application denial based on pre-existing conditions.

No pre-existing condition exclusions: Coverage for all conditions must begin on day one. There is no look-back period, no waiting period for pre-existing conditions, no exclusion riders.

Modified community rating: As described above, premiums can only vary by age, location, tobacco, and family size. Health status is entirely removed from the pricing equation.

The ACA's protections apply to all non-grandfathered individual and small-group plans. Grandfathered plans (those continuously in effect since before March 23, 2010, without significant changes) and certain non-ACA products (short-term plans, supplemental policies, dental and vision) are exempt from these underwriting rules.

GINA: Genetic Information Nondiscrimination Act (2008)

GINA prohibits health insurers from using genetic information — including genetic test results for the individual or family members, family medical history, or requests for genetic services — to:

Deny coverage
Charge higher premiums
Apply pre-existing condition exclusions

Importantly, GINA applies to individuals who are genetically predisposed to a condition but have not yet developed it. Once a genetic predisposition manifests into an actual diagnosed illness, it becomes a pre-existing condition governed by ACA protections rather than GINA. GINA also prohibits insurers from requiring genetic testing as a condition of underwriting.

HIPAA: Health Insurance Portability and Accountability Act (1996)

Before the ACA, HIPAA was the primary federal protection against health-status discrimination in group plans. HIPAA prohibits group health plans from varying eligibility or charging different premiums to individual employees based on eight health-status factors: health status, medical condition, claims experience, receipt of health care, medical history, genetic information, evidence of insurability, and disability.

HIPAA also introduced creditable coverage rules, allowing individuals to carry over prior coverage to reduce or eliminate pre-existing condition waiting periods in new plans. The ACA has largely superseded HIPAA's allowance of pre-existing condition exclusions in compliant plans, but HIPAA remains relevant for grandfathered plans and certain non-ACA products.

Adverse Action and Disclosure Requirements

When an adverse underwriting decision is based on information from a consumer report (which includes prescription databases, MIB reports, credit histories, or driving records), the insurer must comply with the Fair Credit Reporting Act (FCRA) by providing an adverse action notice that includes:

The name, address, and toll-free phone number of the consumer reporting agency that supplied the report
A statement that the CRA did not make the decision and cannot explain the specific reasons for it
The applicant's right to a free copy of the report within 60 days
The applicant's right to dispute inaccurate information with the CRA

If a credit or insurance score was used, the notice must also disclose the actual score, its range, the date generated, and up to four key factors that negatively affected it.

The NAIC's model adverse underwriting decision laws also require insurers to provide the specific reasons for any adverse underwriting decision (denial, substandard rating, exclusion rider) in clear, plain language — not vague terms like "poor health history" — and to inform applicants of their right to request and review personal information maintained in the insurer's files.