Insurance Data Security Act Signed into Law

guest · Aug 4, 2019

Delaware Signs Insurance Data Security Act into Law
August 1, 2019
https://www.whiteandwilliams.com/re...gns-Insurance-Data-Security-Act-into-Law.html

On July 31, 2019, Governor Carney signed the Delaware Insurance Data Security Act (formerly, HB 174) into law.
Based on the National Association Of Insurance Commissioners (NAIC) Insurance Data Security Model Law, the Delaware law establishes a regulatory framework requiring insurers licensed to do business in Delaware to develop and implement a comprehensive data security (or cybersecurity) program.

Prior to the implementation of this law, there were no standards for insurance companies to follow regarding protection of consumers’ data, and notifying the Department. Historically, when an insurer determined that a data breach had occurred, notification to the Department of Insurance was delayed, sometimes by several months.
Click to expand...

Notably, this Act accomplishes the following:

Requires insurance companies to implement information security programs and conduct risk assessments to try to prevent data breaches and compromising of consumers’ Nonpublic Information and personal data;

Notify the Insurance Commissioner within three (3) business days of determining that a data breach or cybersecurity event has occurred;

Mandates that insurers notify all impacted consumers within sixty (60) days of the determination that their data has or may have been compromised; [...]

Click to expand...

Press release issued by the Delaware Department of Insurance

guest · Aug 10, 2019

New Hampshire Enacts Insurance Data Security Law
August 8, 2019
https://www.natlawreview.com/article/new-hampshire-enacts-insurance-data-security-law

New Hampshire Governor Chris Sununu recently signed the New Hampshire Insurance Data Security Law, which “establishes the exclusive state standards applicable to licensees for data security, the investigation of a cybersecurity event…, and notification to the commissioner.”

The law requires insurance companies to implement an Information Security Program (ISP) that contains administrative, technical and physical safeguards to protect non-public information and includes a security risk assessment.
The Commissioner has the right to investigate any cybersecurity event of a licensee to determine if it has been in violation of the law, and “may take action that is necessary or appropriate to enforce the provisions of the law.”
Click to expand...

guest · Aug 12, 2019

3 Important Facts to Take Away From the New Data Security Law
August 12, 2019
https://blog.knowbe4.com/3-important-facts-to-take-away-from-the-new-data-security-law

New Hampshire joins Ohio, South Carolina, and Michigan in enacting a new data security law directed at insurers modeled after the National Association of Insurance Commissioners (NAIC) Model Law of National Association of Insurance Commissioners. The Bill will take effect January 1, 2020.

The New Hampshire State insurance commissioner has the right to take action to enforce the new law, and violations can result in the suspension or revocation of a licensee’s certificate of authority or license. There is also a monetary penalty of up to US $2500 per violation.
Despite current legislation being directed at specific industries, we can see by other laws such as the California Consumer Protection Act (CCPA) that legislation is moving towards broad, personal data protection laws.

After conducting a risk assessment, licensees are required to provide their personnel with new-school security awareness training to reflect the risks identified in the risk assessment. It seems that states are catching on to the fact that the best way to protect company information is to empower their users and create a human firewall.
Click to expand...

What are the important facts to take away from this new law?

Create a Written Information Security Program: Licensees are now required to create a comprehensive information security program based on the size and complexity of the licensee. Licensees will have to take into account their third-party service providers, sensitivity of the data, and the nature of the licensees’ activities.

Incident Response Plan: Each licensee is required to establish an incident response plan designed to respond to and recover from any cybersecurity event that compromises company non public information (such as a successful phishing attack).

Board of Directors: The licensee board or appropriate committee of the board are mandated to ensure that executive management develops or delegates the development of the licensee’s written information security program.

Click to expand...

guest · Apr 7, 2020

Insurers & Producers in Virginia: Get Ready for New Data Security and Notification Requirements!
April 7, 2020
https://www.jdsupra.com/legalnews/insurers-producers-in-virginia-get-77546/

Virginia has a new law, the Insurance Data Security Act (New Law), going into effect on July 1, 2020, which will expand the data security and incident notification requirements on insurers licensed in the Commonwealth.
The New Law is similar to the National Association of Insurance Commissioner’s Insurance Data Security Model Law – with some important modifications. Below is a high-level overview of the New Law, along with a focus on certain specifics, to help you gain a better understanding of what will be required.

Until July 1, 2020, insurers will continue to be governed by Virginia’s general data breach notification requirements; however, the New Law will put in place a new set of requirements for cyber security investigation and notification by insurers.
[...]
Click to expand...

Conclusion
Insurers and producers operating in Virginia need to review their current programs, policies and procedures to ensure they are ready to comply with the New Law. An important step in implementing the robust InfoSec Program requirements under the New Law is to conduct a risk assessment to help an organization identify and understand existing threats, risks and vulnerabilities.

While the New Law will create more statutory and regulatory requirements, the good news is that compliance can also serve to improve an organizations overall cybersecurity posture.
Click to expand...

guest · Jul 30, 2020

Connecticut Insurance Dept. Reminds Licensees to Comply with Data Security Law
July 29, 2020
https://www.natlawreview.com/articl...reminds-licensees-to-comply-data-security-law

On July 20, 2020, the Connecticut Insurance Department issued a bulletin to licensees reminding them that the Connecticut Insurance Data Security Law (“Act”) becomes effective on October 1, 2020 and providing guidance on compliance.

The Act requires “all persons who are licensed, authorized to operate or registered, or required to be licensed, authorized or registered pursuant to the insurance laws of Connecticut” to “develop, implement and maintain a comprehensive written information security program (“ISP”) that complies with” the Act “not later than October 1, 2020.” The Act generally applies to domestic insurers and health care centers, with some exemptions.

The bulletin outlines in detail the obligations of licensees following a cybersecurity attack or event.
Click to expand...

Log in or Sign up

Insurance Data Security Act Signed into Law

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Insurance Data Security Act Signed into Law

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches