Background
The Privacy Act of 1974 (5 U.S.C. § 522a) requires agencies to establish appropriate administrative, technical, and physical safeguards to ensure the security of records and to protect against any anticipated threats or hazards to their security that could result in substantial harm, embarrassment, inconvenience, or unfairness to any individual about whom information is maintained.
Questions have been raised whether an approved insurance provider (AIP) must obtain a Non-Disclosure Statement from contractors of affiliates who have access to protected information.