Insurance Data Security Act Signed into Law

mood · Aug 4, 2019

Delaware Signs Insurance Data Security Act into Law
August 1, 2019
https://www.whiteandwilliams.com/re...gns-Insurance-Data-Security-Act-into-Law.html

On July 31, 2019, Governor Carney signed the Delaware Insurance Data Security Act (formerly, HB 174) into law.
Based on the National Association Of Insurance Commissioners (NAIC) Insurance Data Security Model Law, the Delaware law establishes a regulatory framework requiring insurers licensed to do business in Delaware to develop and implement a comprehensive data security (or cybersecurity) program.

Prior to the implementation of this law, there were no standards for insurance companies to follow regarding protection of consumers’ data, and notifying the Department. Historically, when an insurer determined that a data breach had occurred, notification to the Department of Insurance was delayed, sometimes by several months.
Click to expand...

Notably, this Act accomplishes the following:

Requires insurance companies to implement information security programs and conduct risk assessments to try to prevent data breaches and compromising of consumers’ Nonpublic Information and personal data;

Notify the Insurance Commissioner within three (3) business days of determining that a data breach or cybersecurity event has occurred;

Mandates that insurers notify all impacted consumers within sixty (60) days of the determination that their data has or may have been compromised; [...]

Click to expand...

Press release issued by the Delaware Department of Insurance

mood · Aug 10, 2019

New Hampshire Enacts Insurance Data Security Law
August 8, 2019
https://www.natlawreview.com/article/new-hampshire-enacts-insurance-data-security-law

New Hampshire Governor Chris Sununu recently signed the New Hampshire Insurance Data Security Law, which “establishes the exclusive state standards applicable to licensees for data security, the investigation of a cybersecurity event…, and notification to the commissioner.”

The law requires insurance companies to implement an Information Security Program (ISP) that contains administrative, technical and physical safeguards to protect non-public information and includes a security risk assessment.
The Commissioner has the right to investigate any cybersecurity event of a licensee to determine if it has been in violation of the law, and “may take action that is necessary or appropriate to enforce the provisions of the law.”
Click to expand...

mood · Aug 12, 2019

3 Important Facts to Take Away From the New Data Security Law
August 12, 2019
https://blog.knowbe4.com/3-important-facts-to-take-away-from-the-new-data-security-law

New Hampshire joins Ohio, South Carolina, and Michigan in enacting a new data security law directed at insurers modeled after the National Association of Insurance Commissioners (NAIC) Model Law of National Association of Insurance Commissioners. The Bill will take effect January 1, 2020.

The New Hampshire State insurance commissioner has the right to take action to enforce the new law, and violations can result in the suspension or revocation of a licensee’s certificate of authority or license. There is also a monetary penalty of up to US $2500 per violation.
Despite current legislation being directed at specific industries, we can see by other laws such as the California Consumer Protection Act (CCPA) that legislation is moving towards broad, personal data protection laws.

After conducting a risk assessment, licensees are required to provide their personnel with new-school security awareness training to reflect the risks identified in the risk assessment. It seems that states are catching on to the fact that the best way to protect company information is to empower their users and create a human firewall.
Click to expand...

What are the important facts to take away from this new law?

Create a Written Information Security Program: Licensees are now required to create a comprehensive information security program based on the size and complexity of the licensee. Licensees will have to take into account their third-party service providers, sensitivity of the data, and the nature of the licensees’ activities.

Incident Response Plan: Each licensee is required to establish an incident response plan designed to respond to and recover from any cybersecurity event that compromises company non public information (such as a successful phishing attack).

Board of Directors: The licensee board or appropriate committee of the board are mandated to ensure that executive management develops or delegates the development of the licensee’s written information security program.

Click to expand...

Log in or Sign up

Insurance Data Security Act Signed into Law

mood Updates Team

mood Updates Team

mood Updates Team

Target sues insurer for up to $74 million in 2013 data breach costs

California Extends Data Breach Notification Law to Passports, Biometric Data

Keeping data secure in oil and gas

MICROCHIPS Act wants to secure US govt supply chain against Chinese sabotage

New York Governor Signs Legislation Protecting New Yorkers Against Data Security Breaches

Log in or Sign up

Insurance Data Security Act Signed into Law

mood Updates Team

mood Updates Team

mood Updates Team

Target sues insurer for up to $74 million in 2013 data breach costs

California Extends Data Breach Notification Law to Passports, Biometric Data

Keeping data secure in oil and gas

MICROCHIPS Act wants to secure US govt supply chain against Chinese sabotage

New York Governor Signs Legislation Protecting New Yorkers Against Data Security Breaches

Useful Searches