Law / United States / 
Indiana
Insurance Data Security: notice of a cybersecurity event to the insurance commissioner
In force since .
A breach notification rule binding private bodies.
- Obligation class
- Breach notice, Reporting
- Audit expectation
- none
As of .
What it requires
- As an insurance licensee, notify the insurance commissioner as promptly as possible, and not later than three business days after you determine that a cybersecurity event involving nonpublic information in your possession has occurred, if Indiana is your state of domicile as an insurer or your home state as a producer and the event has a reasonable likelihood of materially harming a consumer residing in Indiana or a material part of your normal operations (Ind. Code 27-2-27-21(c)(1)).
- Notify the commissioner within the same three business days if you reasonably believe the nonpublic information of at least 250 consumers residing in Indiana was affected and either another state, federal or local law requires notice of the event or the event has a reasonable likelihood of materially harming a consumer residing in Indiana or a material part of your normal operations (27-2-27-21(c)(2)).
- Provide as much as possible of the information section 21(d) lists, in electronic form as the commissioner directs, including the date of the event, how the information was exposed, the types of information involved, the number of Indiana consumers affected, the results of any internal review, your remediation efforts, a copy of your privacy policy and a contact person (27-2-27-21(d)).
- Update and supplement your initial and later notices to the commissioner as material changes to the information occur (27-2-27-21(e)).
- Comply with IC 24-4.9, and send the commissioner a copy of the notice sent to consumers under IC 24-4.9 if you are required to notify the commissioner under subsection (c) (27-2-27-21(f)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
Indiana insurance commissioner, who may suspend or revoke a violating licensee's license, certificate of authority or registration after notice and hearing (Ind. Code 27-2-27-27).
What this law does
Section 21(c) of IC 27-2-27 requires a licensee to notify the commissioner as promptly as possible but not later than three business days after a determination that a cybersecurity event involving nonpublic information in the licensee's possession has occurred, if either of two listed conditions applies.
Section 21(c)(1) reaches an insurer domiciled in Indiana, or a producer whose home state is Indiana, when the event has a reasonable likelihood of materially harming a consumer residing in Indiana or any material part of the licensee's normal operations.
Section 21(c)(2) reaches a licensee that reasonably believes the nonpublic information of at least 250 consumers residing in Indiana was affected, where notice of the event is required by another state, federal or local law or the event has a reasonable likelihood of materially harming a consumer residing in Indiana or a material part of the licensee's normal operations.
Section 21(d) requires a licensee, after learning that a cybersecurity event has or may have occurred, to provide as much as possible of the thirteen listed items of information in electronic form, as directed by the commissioner. Section 21(e) gives the licensee a continuing obligation to update and supplement initial and subsequent notifications to the commissioner regarding material changes to previously provided information.
Section 21(f) requires a licensee to comply with IC 24-4.9 and to provide the commissioner a copy of the consumer notice if the licensee is required to notify the commissioner under subsection (c). In IC 27-2-27, a licensee is a person that is licensed, authorized to operate or registered, or required to be, under title 27 of the Indiana Code and the rules adopted under it.
Section 26(b) of IC 27-2-27 treats a licensee that is subject to Health Insurance Portability and Accountability Act (HIPAA) and maintains an information security program under it as meeting the chapter, except for the notice requirements in section 21. Section 27 of IC 27-2-27 lets the insurance commissioner, after notice and hearing, suspend or revoke the license, certificate of authority or registration of a licensee that violates the chapter.
Section 29 of IC 27-2-27 provides that the chapter does not create a private right of action against any person. Section 1 of IC 27-2-27 provides that the chapter applies after . P.L.130-2020 added the chapter to the Indiana Code.
When LexLint raises it
When your app profile says your app is an insurer.