{"id":573,"date":"2016-10-25T20:20:00","date_gmt":"2016-10-25T20:20:00","guid":{"rendered":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/2016\/10\/25\/insurance-data-security-bill-of-rights-for-consumers\/"},"modified":"2016-10-25T20:20:00","modified_gmt":"2016-10-25T20:20:00","slug":"insurance-data-security-bill-of-rights-for-consumers","status":"publish","type":"post","link":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/insurance-data-security-bill-of-rights-for-consumers\/","title":{"rendered":"Insurance. Data Security. Bill of Rights for Consumers."},"content":{"rendered":"<p><strong>To whom does the\u00a0model insurance-cybersecurity law apply?\u00a0<\/strong>\u00a0To anyone who holds a license, registration or is authorized\u00a0by\u00a0a state insurance agency<\/p>\n<p><strong>There&#8217;s a revision to the model law, what&#8217;s changed?<\/strong><\/p>\n<ul>\n<li>No preemption by the model law<\/li>\n<li>No private causes of action. tort reformers rejoice.\u00a0<\/li>\n<li>No contractual requirements for 3rd party vendors, but 3rd part vendors must be capable of protecting information<\/li>\n<li>Stronger notification requirements that trigger notification within 3 days of learning that personal\u00a0information has been taken, removing a requirement that the information be toed to\u00a0\u201csubstantial harm or inconvenience\u201d<\/li>\n<li>Penalties have been removed and left to state regulators<\/li>\n<\/ul>\n<p><a href=\"http:\/\/www.natlawreview.com\/article\/insurance-regulators-fine-tuning-cybersecurity-guidance\">National Law Review |\u00a0Insurance Regulators Fine Tuning Cybersecurity Guidance<\/a><\/p>\n<p>\u00a0<\/p>\n<p>\u00a0<\/p>\n<p>\u00a0<\/p>\n<p>Your informed intel from August 25, 2016:<\/p>\n<div>\n<div>\n<h2><a href=\"https:\/\/informedintel.com\/account\/datasecurity\/?post=model-law-for-insurance-data-security-is-here-it-s-like-valentine-s-the-tooth-fairy\" style=\"color:rgb(95,96,94);text-decoration:none;\">Model law for Insurance Data Security is here. Like a Valentine + Birthday Wish Wrapped in a Rainbow.\u00a0<\/a><\/h2>\n<ul>\n<li>Posted Aug 25, 2016 04:53 PM<\/li>\n<li><a href=\"https:\/\/informedintel.com\/account\/datasecurity\/?category=2017-legislative-issue\" style=\"color:rgb(119,118,119);text-decoration:none;\">2017 legislative issue<\/a>,\u00a0<a href=\"https:\/\/informedintel.com\/account\/datasecurity\/?category=insurance\" style=\"color:rgb(119,118,119);text-decoration:none;\">insurance<\/a><\/li>\n<\/ul>\n<\/div>\n<div>\n<p>What entity is proposing model data security laws for insurance?\u00a0\u00a0the Cybersecurity Task Force (Task Force) of the National Association of Insurance Commissioners (NAIC)<\/p>\n<p>Is it final?\u00a0No, its a revised draft after taking into account stakeholder positions<\/p>\n<p>What issues are covered in the model act draft?<\/p>\n<ul>\n<li>Require licensees to create a \u201ccomprehensive written information security program\u201d<\/li>\n<li>Required Data Security programs will\u00a0detail\u00a0the:\n<ul style=\"list-style-type:disc;\">\n<li>administrative,<\/li>\n<li>technical, &amp;<\/li>\n<li>physical safeguards for the protection of personal information<\/li>\n<\/ul>\n<\/li>\n<li>Require\u00a0licensees to contract only with 3rd service providers who are \u201ccapable of maintaining appropriate safeguards for personal information.\u201d<\/li>\n<li>Creates standards for investigations of a data breach, including:\n<ul style=\"list-style-type:disc;\">\n<li>\u00a0When a data breach occurs<\/li>\n<li>That \u00a0the licensee must properly investigate the breach<\/li>\n<li>Assessing\u00a0the nature and scope of the breach<\/li>\n<li>Identifying the personal information that may have been involved<\/li>\n<li>Determining if the personal information had been acquired without authorization<\/li>\n<li>Taking reasonable measures to restore the security of the systems compromised in the breach.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>To comment: Email\u00a0Sara Robben at\u00a0srobben@naic.org\u00a0by close of business on Friday, September 16, 2016.<\/p>\n<p><a href=\"http:\/\/www.lexology.com\/library\/detail.aspx?g=ab6052e5-1969-468b-9f4c-97eb00c98597\" style=\"color:rgb(53,152,252);text-decoration:none;\">Lexology | Mayer Brown |\u00a0NAIC Issues Revised Insurance Data Security Model Law<\/a><\/p>\n<div>\u00a0<\/div>\n<\/div>\n<\/div>\n<div>\n<div>\u00a0<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p><strong>To whom does the\u00a0model insurance-cybersecurity law apply?\u00a0<\/strong>\u00a0To anyone who holds a license, registration or is authorized\u00a0by\u00a0a state insurance agency<\/p>\n<p><strong>There&#8217;s a revision to the model law, what&#8217;s changed?<\/strong><\/p>\n<ul>\n<li>No preemption by the model law<\/li>\n<li>No private causes of action. tort reformers rejoice.\u00a0<\/li>\n<li>No contractual requirements for 3rd party vendors, but 3rd part vendors must be capable of protecting information<\/li>\n<li>Stronger notification requirements that trigger notification within 3 days of&#8230;<\/li>\n<\/ul>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[30,19,3,24,28],"tags":[],"class_list":["post-573","post","type-post","status-publish","format-standard","hentry","category-2017-legislative-issue","category-insurance","category-legislative-trend","category-private-corporations","category-regulatory-trend","entry"],"_links":{"self":[{"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/posts\/573","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/comments?post=573"}],"version-history":[{"count":0,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/posts\/573\/revisions"}],"wp:attachment":[{"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/media?parent=573"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/categories?post=573"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/informedintel.com\/account\/datasecurity\/wp-datasecurity\/wp-json\/wp\/v2\/tags?post=573"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}