Representation Opportunity: Insurance in Data Breaches

For the first time ever, Zurich Surety registers as a lobbyist in Canada amid interest in data security legislation.

Folks, data security insurance is a business that is growing exponentially. The well read will remember that just last week, Information Intelligence brought you news of the first lawsuit concerning insurance coverage in a data breach. 

Rapidly growing industry. Not Yet in Texas. Hello opportunities. 

Canadian Underwriter

Federal Data Breach Sparks Call for Trade Sanctions

This week, Rep. Mo Brooks (R-Ala.)  introduced the “Protect US Act,” which would:

  • Give the president and Congress the power to add foreign powers accused of harboring or conducting hacking to a “State Sponsors of Cyberattacks” list.
  • The president would be granted power to impose a wide range of trade sanctions on those countries.

China/Chinese hackers were allegedly behind the massive federal government data breach.

The Hill

Data Security and Electric Grids

Sen. Debbie Stabenow (D-Mich.) and Sen. Martin Heinrich (D-N.M) say the Energy and Water Development funding bill shortchanges our electric grid from being properly protected from a cyber attack.

They call for funding the following data security protections:

  • virtual forensics platform,” intended to detect malicious actors sitting on the network
  • Replace the $11M removed from the Cybersecurity for Energy Delivery Systems

The Hill

Trend: States Strengthening Health Data Privacy

Connecticut and Oregon both strengthened laws protecting health care data this year. Specifically the states , strengthened protections of personally identifiable information (“PII”).

  • Connecticut did this:
    • Effective October 1, 2015, S.B. 941 
      • Requires notice of a breach of personal information within 90 days of discovery
      • If a breach involves social security numbers, must offer a year of complimentary identity theft prevention and mitigation services, and the notifications must include information on signing up for these services, as well as information on placing a credit freeze. 
      •  Health insurance companies must implement, maintain, and update annually a “comprehensive information security program” to protect personal information (including protected health information, government-issued ID numbers, biometric data, and financial information).
  • Oregon did this:
    • Senate Bill 601 (SB 601) is effective January 1, 2016, and will:
      •  Expand the definition of “personal information” triggering a required notification to include:
        • 1) biometrics
        • 2) health insurance policy number or subscriber identification number in combination with any other unique identifier that a health insurer uses to identify the individual; or
        • 3) any information about a consumer’s medical history or mental or physical condition or about a health care professional’s medical diagnosis or treatment of the individual.
      •  The Attorney General must be notified for breaches of personal information involving 250 residents of the state or more & may bring Deceptive Trade Practices Act violations.
      • The threshold for notification is altered  to an “unlikely to suffer harm” standard in place of the previous standard of “no reasonable likelihood of harm” and requires this determination be made in writing by the effected entity and maintained for at least five years.  

The Beat @ CooleyHealth

Secure Data by Collecting More Data. Credit Card Companies Look to Biometrics.

In an effort to protect data,  large financial entities, like credit card companies, are looking to collecting facial recognition software to further protect their and your financial data.

Storing biometric information along side financial information at one company seems like that company is putting put a neon sign that reads, “Hacker Dreams Come True Here.” 

Coin Telegraph: Future of Money

47 Attorneys General Oppose National Data Breach laws. Support States Rights.

47 Attorneys General signed a letter supporting state authority over data breach enforcement and strongly opposing any attempts at federal preemption.

 Gen. Paxton is notably absent from the list: Arkansas, Connecticut, Illinois, Indiana, Maryland, Massachusetts and Nebraska, was also joined by the following states and territories, according to the news release: Alabama, Alaska, Arizona, California, Delaware, District of Columbia, Florida, Georgia, Hawaii, Idaho, Iowa, Kansas, Kentucky, Louisiana, Maine, Michigan, Minnesota, Mississippi, Missouri, Montana, Nevada, New Hampshire, New Jersey, New Mexico, New York, North Carolina, North Dakota, North Mariana Islands, Ohio, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Utah, Vermont, Virginia, Washington, and West Virginia.

LasCruces Sun News      Montana Department of Justice 

Legal Trend: Stand Alone Cybersecurity Insurance Coverage Denied for Breach Claim. First Legal Case on the issue.

Say you’re a health care provider. You buy data breach insurance policy to cover any potential hacks or breaches. you think you’re doing the right thing to protect your business.

Then, your data gets hacked. You file a claim with your insurance company. You’re denied. You go to court.

The insurance company says the health care provider failed to provide the required minimum security standards. 

Its a case of first impression. It’ll make history and make legislation far and wide as the claims are state law and federal (HIPPA).

Crowell Moring Data Law