What kind of client data should be captured in a needs analysis to comply with privacy rules?

• A. Non-sensitive contact and demographic information, high-level health status, income, and dependents; avoid collecting PHI without consent.
• B. Full PHI including medical histories without consent.
• C. Only contact information without any health data.
• D. Personal financial data not used in underwriting.

Answer: (A)

In a privacy-compliant needs analysis, you focus on collecting information that is necessary to understand the client’s situation without exposing sensitive data. The best approach is to gather non-sensitive contact and demographic details, alongside a high-level view of health status and practical factors like income and dependents. This provides enough context to tailor coverage and affordability without delving into detailed medical histories. Protected health information, such as full medical histories or diagnoses, should not be collected without explicit, informed consent, because it’s sensitive data and subject to strict privacy protections. Relying only on basic contact information would fall short for meaningful guidance, and asking for personal financial data not used in underwriting adds unnecessary privacy risk. The key is data minimization and obtaining consent when anything sensitive is involved, so you can deliver appropriate recommendations while staying compliant with privacy rules.