Law / United States / 
Alabama
Insurance Data Security Law, information security program
Insurance Data Security Law, Ala. Code sec. 27-62-4
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to a licensee under Alabama insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate or registered, or required to be, under the insurance laws of Alabama, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state.
- Develop, implement and maintain a comprehensive written information security program, based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information system, commensurate with your size and complexity, your activities (including your use of third-party service providers) and the sensitivity of the nonpublic information.
- Designate the person responsible for the program, identify and assess the reasonably foreseeable internal and external threats to nonpublic information, and implement information safeguards to manage them, assessing the effectiveness of the key controls, systems and procedures at least annually.
- Determine which of the security measures the law lists are appropriate and implement them, which include access controls, encryption of nonpublic information in transit over an external network and on portable devices, multi-factor authentication for employees accessing nonpublic information, regular testing and monitoring of systems, audit trails, and secure disposal of nonpublic information.
- Establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information, your information systems or the continuing functionality of your business.
- Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it holds.
- If you have a board of directors, have the board or a committee require executive management to develop, implement and maintain the program and to report to the board in writing at least annually on the program's overall status, your compliance with the chapter and material matters such as risk assessment, third-party arrangements and cybersecurity events.
- If you are an insurer domiciled in Alabama, submit to the Commissioner of Insurance by February 15 each year a written statement certifying that you comply with the chapter, and keep the supporting records for five years.
- A licensee with fewer than 25 employees, less than $5 million in gross annual revenue or less than $10 million in year-end total assets is exempt from the program duty, and a licensee that meets the Health Insurance Portability and Accountability Act (HIPAA) or Gramm-Leach-Bliley conditions in section 27-62-9 is treated as meeting it.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 27-62-10(b) allows a fine of up to $10,000 per violation, in lieu of suspension or revocation of the license or certificate of authority and at the Commissioner's discretion, for a licensee other than a producer; an insurance producer is penalized under section 27-7-19.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
The Commissioner of Insurance, who may examine and investigate any licensee and take the action necessary or appropriate to enforce the chapter (section 27-62-7).
What this law does
Section 27-62-4 requires each licensee to develop, implement, and maintain a comprehensive written information security program based on its risk assessment that contains administrative, technical, and physical safeguards for the protection of nonpublic information and its information system.
A licensee is any person licensed, authorized to operate, or registered, or required to be, under the insurance laws of Alabama, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state. A licensee must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information.
A licensee must exercise due diligence in selecting a third-party service provider and require the provider to implement appropriate administrative, technical, and physical measures to protect the information systems and nonpublic information that the provider holds. Each insurer domiciled in Alabama must submit to the commissioner, annually on or before February 15, a written statement certifying that it complies with the chapter.
A licensee is exempt from section 27-62-4 if it has fewer than 25 employees, less than $5 million in gross annual revenue, or less than $10 million in year-end total assets. A licensee other than an insurance producer that violates the chapter may be subject to suspension or revocation of its license or certificate of authority or, in lieu of that, a fine of up to $10,000 per violation.
Licensees had until to implement section 27-62-4 other than subsection (f), and until to implement subsection (f). The chapter does not create or imply a private cause of action for a violation of its provisions.
When LexLint raises it
When your app profile says your app is an insurer.