Law / United States / 
Connecticut
Insurance Data Security Law, licensee information security program
Insurance Data Security Law, Conn. Gen. Stat. sec. 38a-38(c)
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to a licensee under Connecticut insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate or registered, or required to be, under the insurance laws of Connecticut, other than a purchasing group or risk retention group chartered and licensed in another state or an assuming insurer domiciled in another state.
- Develop, implement and maintain a comprehensive written information security program, based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information systems, commensurate with your size and complexity, your activities (including your use of third-party service providers) and the sensitivity of the nonpublic information.
- Designate the person responsible for the program, identify the reasonably foreseeable internal and external threats to nonpublic information, and assess the effectiveness of your safeguards' key controls, systems and procedures at least annually.
- Based on your risk assessment, determine which of the security measures the law lists are appropriate and implement them, which include access controls, secure development practices for applications you build, effective controls such as multifactor authentication, regular testing and monitoring of systems to detect attacks and intrusions, and audit trails designed to detect and respond to cybersecurity events.
- Establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information, your information systems or the continuing functionality of any aspect of your business or operations.
- Conduct a prompt investigation if you learn that a cybersecurity event has, or may have, occurred, and, where the event occurred in a system a third-party service provider maintains, complete the investigation steps or confirm and document that the provider has completed them.
- Exercise due diligence in selecting your third-party service providers and, not later than , require each of them to implement appropriate administrative, technical and physical measures to protect and secure the information systems and nonpublic information accessible to, or held by, them.
- If you have a board of directors, have the board or an appropriate committee require executive management to develop, implement and maintain the program and to report to the board in writing, at least annually, on the program's overall status and your compliance with the section.
- If you are an insurer, health care center or fraternal benefit society domiciled in Connecticut, submit to the Insurance Commissioner by April 15 each year a written statement certifying that you comply with the program requirements, and keep the supporting records, schedules and data for five years.
- A licensee with fewer than ten employees (counting independent contractors with access to the nonpublic information) is exempt on and after , and a licensee that maintains a program under the federal health privacy rules, or under 23 NYCRR Part 500, is deemed to comply if it complies and submits an annual written statement of compliance by April 15.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 38a-38(f)(3)(B) allows, after a hearing, a civil penalty of not more than $50,000 for each violation, in addition to or in lieu of suspending, revoking or refusing to reissue or renew a license, and the Commissioner may bring a civil action to recover a penalty imposed.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 50,000
Who enforces it
Enforcement body
The Insurance Commissioner, who may examine and investigate the affairs of a licensee to determine whether it is, or has been, engaged in conduct in this state that violates the section (Conn. Gen. Stat. sec. 38a-38(f)(1)).
What this law does
Each licensee must, not later than , develop, implement and maintain a comprehensive written information security program that is based on its risk assessment and contains administrative, technical and physical safeguards for nonpublic information and its information systems.
A licensee is any person licensed, authorized to operate or registered, or required to be, under the insurance laws of Connecticut, including a fraternal benefit society, an interlocal risk management agency and an employers' mutual association, but not a purchasing group or risk retention group chartered and licensed in another state, a person acting as an assuming insurer and domiciled in another state or jurisdiction, or a commissioner of the Superior Court acting as a title agent.
Each licensee must, as part of its information security program, establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information, its information systems or the continuing functionality of any aspect of its business or operations.
Each licensee must exercise due diligence in selecting its third-party service providers and, not later than , require each of them to implement appropriate administrative, technical and physical measures to protect and secure the information systems and nonpublic information accessible to, or held by, them.
Each insurer, health care center or fraternal benefit society domiciled in Connecticut must submit to the Insurance Commissioner a written statement, not later than April fifteenth annually, certifying that it is in compliance with the information security program requirements. On and after , a licensee with fewer than ten employees, counting independent contractors who have access to the nonpublic information, is exempt from the information security program requirements.
A licensee that is subject to the federal Health Insurance Portability and Accountability Act and maintains an information security program under it is deemed to satisfy the requirements if it complies and submits to the Insurance Commissioner, not later than April fifteenth annually, a written statement certifying its compliance.
A licensee that maintains an information security program in compliance with Part 500 of Chapter I of Title 23 of the New York Codes, Rules and Regulations is deemed to satisfy the requirements if it complies and submits to the commissioner, not later than April fifteenth annually, a written statement certifying its compliance.
After a hearing, the Insurance Commissioner may, in addition to or in lieu of suspending, revoking or refusing to reissue or renew a license, impose on a licensee a civil penalty of not more than fifty thousand dollars for each violation of the section.
When LexLint raises it
When your app profile says your app is an insurer.