Law / United States / 
Iowa
Insurance Data Security Act, licensee information security program and third-party service provider oversight
Insurance Data Security Act, Iowa Code secs. 507F.4 and 507F.5
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to a licensee under Iowa insurance law, which you declare by stating that you are an insurer: a person licensed, authorized to operate, or registered, or required to be, under the insurance laws of Iowa, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state or jurisdiction.
- Develop, implement and maintain a comprehensive written information security program, based on your risk assessment, commensurate with your size and complexity, the nature and scope of your activities including your use of third-party service providers, and the sensitivity of the nonpublic information you hold.
- Conduct the risk assessment: designate who is responsible for the program, identify reasonably foreseeable internal and external threats to nonpublic information, assess their probability and potential damage, assess the sufficiency of your safeguards, and implement safeguards and assess the effectiveness of their key controls, systems and procedures at least annually.
- Based on the risk assessment, determine which of the security measures the law lists are appropriate and implement each one that is, which include access controls, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices, multi-factor authentication where effective, regular testing and monitoring of systems, audit trails, and secure disposal of nonpublic information.
- Include cybersecurity risks in your enterprise-wide risk management process and give your personnel cybersecurity awareness training that is updated to reflect the risks your risk assessment identifies.
- If you have a board of directors, have the board or an appropriate committee require executive management to develop, implement and maintain the program and to give the board a written report, at least annually, on the program's overall status and your compliance with the chapter.
- Exercise due diligence in selecting third-party service providers, oversee every third-party service provider arrangement, and require each provider to implement appropriate administrative, technical and physical measures to protect and secure the information systems and nonpublic information that it can access or holds (compliance with this duty was due by ).
- Conduct a prompt investigation if you discover that a cybersecurity event has occurred or may have occurred.
- A licensee with fewer than twenty individuals on its workforce, less than five million dollars in gross annual revenue or less than ten million dollars in year-end total assets is exempt from the program duty, a licensee that complies with the Health Insurance Portability and Accountability Act, or that is owned or controlled by a federally insured depository institution that complies with the Gramm-Leach-Bliley Act, is outside the chapter, and a licensee that relies on the Health Insurance Portability and Accountability Act exemption must annually certify its compliance to the commissioner.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 507B.7(1)(a) lets the Commissioner of Insurance, after hearing, order a civil penalty of not more than $1,000 for each act or violation, up to an aggregate of $10,000, or, if the person knew or reasonably should have known of the violation, not more than $5,000 for each act or violation, up to an aggregate of $50,000 in any one six-month period.
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 50,000
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
The Iowa Commissioner of Insurance, who may adopt rules to administer chapter 507F and take any enforcement action under the Commissioner's authority (Iowa Code 507F.15).
What this law does
A licensee must develop, implement and maintain a comprehensive written information security program based on its risk assessment, commensurate with its size and complexity, the nature and scope of its activities including its use of third-party service providers, and the sensitivity of the nonpublic information it holds.
A licensee is a person licensed, authorized to operate, or registered, or required to be, under the insurance laws of Iowa, and does not include a purchasing group, a risk retention group chartered and licensed in another state, or a person acting as an assuming insurer that is domiciled in another state or jurisdiction.
Section 507F.4 does not apply to a licensee that has fewer than twenty individuals on its workforce, including employees and independent contractors, has less than five million dollars in gross annual revenue, or has less than ten million dollars in year-end total assets.
A licensee must exercise due diligence in selecting its third-party service providers, conduct oversight of all third-party service provider arrangements and require each provider to implement appropriate administrative, technical and physical measures to protect and secure the information systems and nonpublic information it can access or holds. Licensees had to comply with the third-party service provider section no later than .
A licensee with a board of directors must have the board or an appropriate committee require executive management to develop, implement and maintain the program and to provide the board a written report at least annually. The chapter does not apply to a licensee that is subject to, and in compliance with, the Health Insurance Portability and Accountability Act, and that licensee must annually submit to the commissioner a written certification of its compliance.
The chapter does not apply to a licensee that is owned or controlled by a federally insured depository institution that is subject to, and in compliance with, the Gramm-Leach-Bliley Act or comparable federal law and corresponding regulations. A licensee that violates the chapter is subject to penalties under section 505.7A and chapter 507B of the Iowa Code. The chapter does not create or imply a private cause of action for a violation of its provisions.
When LexLint raises it
When your app profile says your app is an insurer.