A blinded employee census is an employee census with the fields that directly identify people taken out: names, Social Security numbers, home addresses, often personal emails and phone numbers. It keeps what a group life or disability quote needs: a key for each employee, date of birth or age, sex, earnings, class, scheduled hours, work location and status. Brokers use one to market a group to several carriers without sending every bidder a full personnel file. Botminds' Group Census & RFP Intake Automation works the same way from the carrier's side: SSN columns are dropped on arrival and never stored, and the rest of the census is kept for a retention period the carrier sets.
Blinding is worth doing, but it is not anonymisation. The fields a quote needs are the fields that identify people in combination. The federal government's guide to personal data cites a study in which "97% of the names and addresses on a voting list were identifiable using only ZIP code and date of birth" (NIST Special Publication 800-122, 2010). A blinded census is still personal data, and the carrier that receives it is still responsible for it.
Census fields: what the quote needs, and what each reveals
| Field | Needed to quote? | Identifies on its own? | Under the NAIC data security model |
|---|---|---|---|
| Name | No | Yes | With an SSN, account number or similar element, it is nonpublic information |
| Social Security number | No | Yes | A listed element of nonpublic information |
| Home address, personal email, phone | No | Yes | Identifiers; not needed for rating |
| Employee ID or neutral key | Yes, as the row key | Only to the employer | A key that only the employer can map back |
| Date of birth | Yes, for the age band | With ZIP code, often | Age is excluded from the model’s health information |
| Sex | Yes, a rating factor | No | Gender is excluded from the model’s health information |
| Annual earnings | Yes, for benefits and covered payroll | Sometimes, for executives | Business data the carrier must protect |
| Work location or ZIP | Yes, for situs and locations | With birth date, often | Business data the carrier must protect |
| Leave or disability status | Yes, for actively-at-work questions | No | Can be health information: it relates to a health condition |
What is a blinded employee census?
It is a census prepared for quoting rather than for enrolment. At the quote stage a carrier needs to know the group: how many people, how old, how paid, in which classes and where. It does not need to know who they are. A blinded census answers the first question without the second, by removing the direct identifiers and, where the employer prefers, replacing its employee IDs with a neutral key that only the employer can map back to a person.
The idea matches the first principle of the NIST guide: "Organizations should minimize the use, collection, and retention of PII to what is strictly necessary to accomplish their business purpose and mission." Its reasoning applies directly to a broker's file sent to five carriers: "The likelihood of harm caused by a breach involving PII is greatly reduced if an organization minimizes the amount of PII it uses, collects, and stores."
What fields does a blinded census keep?
Everything that sets the price or the eligibility. Date of birth places each person in an age band. Sex is a rating factor for group life and disability. Earnings set benefit amounts and covered payroll. Class chooses the plan design, hours decide eligibility, work location decides situs and whether every site is on the file, and leave or disability status decides who is insured on day one. A key for each row lets the carrier ask about a specific employee and lets the employer answer.
Public employers' RFPs show what carriers ask for, and the lists contain no names. Bidders on the City of Providence's 2024 life insurance RFP asked for date of birth, gender, salary, status, coverage amount, retirement date and a key to the abbreviations, and nothing that names anyone (City of Providence, RFP questions and answers; the employee census template quotes the request and maps every field). That is a blinded census, field for field.
The same employee, two ways
A full census as exported: Name, SSN, home address and personal email from the HR system.
A blinded census for quoting: Removed. A stable employee ID or neutral key in their place.
A full census as exported: Full date of birth.
A blinded census for quoting: Full date of birth, or age at the effective date. A birth year alone breaks the age bands.
A full census as exported: Rate, pay basis and earnings, sometimes in several columns.
A blinded census for quoting: Annual earnings on one stated basis.
A full census as exported: Home address and work location.
A blinded census for quoting: Work location or work ZIP only.
A full census as exported: Often missing, or in another system.
A blinded census for quoting: Active, on leave, on disability, or not eligible, on the effective date.
Should a census include social security numbers?
Not for a quote. No group life or disability rate depends on an SSN, and the SSN is the element that turns a name into regulated nonpublic information under state insurance data-security laws based on the NAIC model. The model's definition covers information that can identify a consumer "in combination with any one or more of the following data elements", and the list begins with "Social Security number" (NAIC Insurance Data Security Model Law #668, section 3). A census without names or SSNs keeps the carrier's quote file out of the most sensitive category altogether.
Brokers still send them, because the employer's payroll export includes them. In Group Census & RFP Intake Automation's fictional sample case, the census mapper found the table under a merged title, mapped 12 columns to the carrier's rating layout and dropped the SSN column before anything else happened. Identifiers needed later, for enrolment or billing, come at installation, once the case is sold, not with every quote.
The census as the broker sent it, with the SSN column already gone
Can a blinded census still identify employees?
Yes, often, which is why a blinded census still needs protecting. NIST's guide lists date of birth, place of birth, "geographical indicators" and "employment information" among the information "linked or linkable" to a person, and the ZIP-and-birth-date study shows how little it takes. In a small group, a job class and a salary can be enough on their own: the one executive earning $236,000 is not anonymous to anyone who knows the company.
The figure below sorts fourteen common census columns into three groups. Only a third can be removed without losing the quote; the rest are needed and identifying at once, or needed and harmless.
Fourteen common census columns, sorted by what blinding can do with them
14 columns
- Identify directly, not needed: remove · 36%
- Needed and identifying in combination: protect · 36%
- Needed, rarely identifying · 28%
Small groups make the problem sharper. In a census of 600 employees, a 61-year-old woman earning $90,000 in an Ohio plant may be one of several; in a census of 12, she is one person, and everyone at the employer knows who. A broker blinding a small group's census should consider sending ages at the effective date rather than full birth dates, and earnings bands where the plan's benefit formula allows, accepting that both make the carrier's checks weaker: an age cannot be matched to a billing roster the way a birth date can.
Is employee census data protected health information?
Generally not, for a group life or disability quote. HIPAA's privacy rule protects health information held by covered entities: health plans, health care providers and clearinghouses. A carrier quoting group life or disability cover is not acting as a health plan, which HIPAA defines as a plan that "provides, or pays the cost of, medical care" (45 CFR 160.103). And the payroll and HR data a census is drawn from is outside the rule even when the employer is itself a covered entity: protected health information excludes information "In employment records held by a covered entity in its role as employer".
That does not make the census unregulated. The NAIC model defines health information in its own terms, as data "except age or gender" that relates to "The past, present or future physical, mental or behavioral health or condition" of a consumer. A census column showing who is on disability leave is arguably that. The safe course is to treat status fields as sensitive, keep them only for cases being quoted, and ask for them as codes rather than diagnoses.
Does HIPAA apply to group life insurance?
No. Group life insurance does not provide or pay for medical care, so it is outside HIPAA's definition of a health plan, and disability income cover is listed among the benefits "excepted in all circumstances" from the federal group health rules (45 CFR 146.145). Life and disability carriers are governed instead by state insurance privacy and data-security law. A group health quote is different: there the plan side is covered by HIPAA, and a census that carries claims information is a health matter.
A blinded census removes the names. It does not remove the obligation: the fields a quote needs are the ones that, together, still point to a person.
What the NAIC data security model law asks of a carrier holding a census
The NAIC's Insurance Data Security Model Law of 2017 is the template state legislatures have drawn on for insurer data-security statutes. It applies to every licensee, which includes carriers and the brokers who send them censuses. Its information security program requirements map directly onto census handling: guard nonpublic information against unauthorised access or use; set, and revisit, how long it is kept and how it is destroyed when no longer needed; encrypt it, or protect it as well, whenever it crosses an external network; and take care in choosing the service providers who handle it.
The model exempts licensees with fewer than ten employees, contractors included, from the program requirements, and it sets a 72-hour clock for notifying the commissioner of a cybersecurity event. Which states have enacted it, and with what changes, is tracked on the NAIC's adoption chart; how it works in detail is covered in the insurance data security model law and which states have adopted it.
How long can carriers keep census data?
As long as the carrier's written retention schedule says, and no longer than it needs to. The NAIC model does not set a number of years; it requires a schedule and a mechanism for destruction "when no longer needed". A census for a lost quote and a census for a sold case need different periods, because the second supports the policy, its rating and any later dispute. In Group Census & RFP Intake Automation, retention of the census and its change log is a carrier setting, with 5, 7 or 10 years offered; the fictional sample settings use 7.
Retention and roster matching are settings the carrier owns
Blind the census without breaking the quote
Blinding fails when it removes the key. A census whose employee IDs are replaced with a new random key for every bid cannot be matched to the current carrier's billing roster, so blank birth dates and placeholder salaries cannot be filled from it. The solution's roster matcher suggests a value only when two of three keys agree: employee ID, name and birth date. Remove the names and the ID becomes essential. The same key is how one message to the broker can list the seven rows where sex is blank and get seven answers back. How the remaining fields should be laid out is in the employee census template.
Blinding a census without breaking the quote
- Remove names, SSNs, home addresses, personal emails and phone numbers
None of them changes a rate.
- Keep the employer’s employee ID, or one stable key per person
The same key across the census, the billing roster and the broker’s answers.
- Keep full dates of birth
Birth years alone misplace people across five-year age bands.
- Give work location, not home address
Work ZIP decides locations and situs; home address decides nothing.
- Send status as codes, not reasons
On leave, on disability or not eligible, without diagnoses.
- Send the file encrypted and to named recipients
The NAIC model expects encryption of nonpublic information in transit.
- Agree how long each bidder keeps it
A lost quote does not need the census for years.
Questions people ask
What is the difference between a blinded and a de-identified census?
Blinded usually means the direct identifiers are removed. De-identified, in NIST's sense, means enough is removed or obscured that "there is no reasonable basis to believe that the information can be used to identify an individual". A census with full birth dates and work ZIPs rarely meets the second test.
Do brokers have to protect census data?
Yes, under state insurance data-security laws based on the NAIC model, which apply to licensees, a term that covers producers as well as insurers. A broker that sends a census to several carriers is sharing it with each, and each becomes responsible for its copy.
Is a census with only birth years anonymous?
It is less identifying, but it also prices worse: age bands are five years wide and a birth year cannot place someone born in the second half of a year correctly at a 1 January effective date. Full dates of birth with names removed is the usual compromise.
Should a census include employee home addresses?
No. Group life and disability rating uses the work location, which decides situs and whether every site in the RFP letter is on the file. Home addresses add identifying data without changing the price.
What happens if a census is breached?
Under the NAIC model, a licensee notifies its commissioner within 72 hours of determining that a cybersecurity event has occurred, where the state's thresholds are met, and state breach-notification laws may require notice to the employees. The obligations are set out in 72-hour breach notification requirements.