Is ChatGPT safe for insurance agents? Start with what a claim file carries
Whether ChatGPT is safe for confidential information comes down to what a CSR pastes: notes from a first notice of loss, a first report of injury, a letter to an underwriter or a dec page an insured wants explained.
Every one of them has a few lines that point at a real person. An auto loss notice has the named insured, a date of birth, a driver’s license number, the VIN and the plate. A workers’ comp first report adds the employee’s Social Security number. The policy number and the claim number head everything, and premium by EFT adds a bank account number.
So when an agency asks whether ChatGPT is safe for insurance agents, the answer turns on those lines, because the coverage question you are putting to the AI never needed them. Nonimo takes them out on the agent’s own computer before the text is sent. Our guide to ChatGPT and your data covers what OpenAI holds on to from a conversation, and for how many days.
The workers’ comp injury report, once Nonimo has masked it
AI for insurance agencies works here with the client left out: the CSR highlights the notes, presses one key, and ChatGPT, Claude or Copilot drafts the email around bracketed placeholders.
Right there on the Mac or Windows machine, every client detail Nonimo can place turns into a placeholder, and the chat only ever gets that version. Nonimo then fills the real name and numbers back in on the agent’s screen.
In the example below, the employee’s name, birth date, SSN, phone number and email address all became placeholders, and the name got the same placeholder in the header and in the sentence, so the AI writes about one person.
The injury is still there in the text, since the adjuster has to read it: a strained back, urgent care, two weeks of light duty. The employee’s name and numbers stay on the agent’s computer. Our guide to PHI, PII and sensitive personal information explains which label fits a document before it goes to AI.
Before: what gets pasted
Write a first report of injury email to the carrier's workers' comp claims desk from these notes. Employee: John Doe DOB: 1968-02-30 SSN: 000-00-0017 Phone: 202-555-0172 Email: jdoe@example.com Date of injury: 09/21/2026 Lifting a pallet in the warehouse, John Doe strained his lower back. Seen at urgent care the same day and released to light duty for two weeks. Supervisor notified at the time.
After: what the AI receives
Write a first report of injury email to the carrier's workers' comp claims desk from these notes. Employee: [PERSON_1] DOB: [BIRTH_DATE_1] SSN: [REFERENCE_1] Phone: [PHONE_1] Email: [EMAIL_1] Date of injury: 09/21/2026 Lifting a pallet in the warehouse, [PERSON_1] strained his lower back. Seen at urgent care the same day and released to light duty for two weeks. Supervisor notified at the time.
The NAIC model law, your agency and the AI vendor
The NAIC’s Insurance Data Security Model Law, written in 2017 for states to enact in their own words, applies to every licensee: the agency and its producers, not only the carriers they place business with.
A licensee is anyone licensed under the state’s insurance laws. The model’s definition of nonpublic information reads like the top of a claim file: a consumer’s name or other identifier together with a Social Security number, a driver’s license number or an account number, plus health information from a provider or the consumer.
Section 4 asks each licensee for a written information security program, built on a risk assessment and sized to the agency. Carriers now ask about AI too, in the cyber insurance questionnaire an agent fills in with the client.
The model law defines a third-party service provider as a company that contracts with the licensee and is permitted access to nonpublic information through its services. An AI subscription the agency pays for, with a loss notice pasted in, is hard to read any other way. For a loss notice pasted before anyone masked it, our guide to the first hour covers state notice rules.
From the loss notice to the renewal: how each line is handled
Nonimo replaces what it is sure of quietly, and anything less certain in plain view, with a one-line reason and an undo.
On a made-up auto loss notice, the named insured, policy number, claim number, driver’s license number and plate all become placeholders. The date of loss, the car and the account of the fender bender at the red light come through untouched, so the note asking the adjuster about a rental still reads right.
Pricing, and which agency desks to set up first
Whether you’re looking at AI for insurance brokers on commercial accounts or for a personal lines agency, start with one desk, on Windows or on a Mac, and add the rest later.
Nonimo’s free plan stops at a set number of words each month. Leave an email address on our license page and a free license file comes back that removes the cap through January 31, 2027, with no account to set up. The download buttons sit up top on this page.
Begin with the people who write to carriers all day: whoever handles claims, and the commercial lines account managers. For the whole agency, IT can push a browser extension by policy, and it masks text in the browser with no key to press; our page for organizations has the details. Producers can keep the desktop app too.
The agency principal sees a dashboard that counts masked items by category, plus a monthly report, and neither ever shows the text. Writing the security program is still the agency’s job; Nonimo can go into it as a technical safeguard. We receive nothing from your clients’ files, and the originals never leave the agent’s computer.
- A free plan on Mac and Windows
- With a monthly word allowance
- The free license lifts it through January 31, 2027, no account needed
Questions from the agency
Is ChatGPT safe for insurance agents?
It depends on what goes into it. A renewal reminder needs no client details. A loss notice or a first report of injury does carry them, and the NAIC model law counts a name with an SSN, a driver's license number or health details as nonpublic information. Nonimo masks those identifiers on the agent's computer, so the AI still gets the job and never the client.
Does the NAIC data security model law apply to a small agency?
The model law exempts a licensee with fewer than ten employees, counting independent contractors, from Section 4, the written information security program. The sections on investigating a cybersecurity event and notifying the commissioner still apply. Your state's version can draw those lines differently, so the statute it actually enacted is the one to read.
Who regulates an insurance agency's data security, the FTC or the state?
The state, as a rule. Under 15 U.S.C. 6805(a)(6), part of the Gramm-Leach-Bliley Act, the privacy and safeguards duties of anyone providing insurance are enforced under state insurance law by the insurance authority of their home state. The FTC takes the financial institutions no one on that list covers. For an agency, the standard comes from the state insurance department, which is where the NAIC model law comes in.
Does Nonimo mask the policy number and the claim number?
Yes, when they sit behind their usual labels, and so do a driver's license number and a bank account number: all of them become placeholders before the note leaves the agent's computer.
Can Nonimo read our clients' claim files?
No. The masking runs on the agent's own Mac or PC, and nothing from a loss notice, an injury report or a carrier email gets to us: not a name, not a date of birth, not a line of the claim. Our privacy page lists everything the app does send, and there is no customer account to set up.