Law / United States / 
Louisiana
Insurance Data Security Law, information security program
Insurance Data Security Law, La. R.S. 22:2504
In force since .
A sector security regimes rule binding private bodies.
- Private right of action
- No
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to a licensee under Louisiana insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate or registered, or required to be, under the insurance laws of Louisiana, other than a purchasing group or risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state.
- Develop, implement and maintain a comprehensive, written information security program, based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information system, commensurate with your size and complexity, your activities (including your use of third-party service providers) and the sensitivity of the nonpublic information.
- Designate the person responsible for the program, identify and assess the reasonably foreseeable internal and external threats to nonpublic information, and implement information safeguards to manage them, assessing the effectiveness of the key controls, systems and procedures at least annually.
- Implement the security measures the law lists that you determine are appropriate, which include access controls, encryption of nonpublic information in transit over an external network and on portable devices, multifactor authentication for any individual accessing nonpublic information, regular testing and monitoring of systems, audit trails, and secure disposal of nonpublic information.
- Establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information, your information systems or the continuing functionality of your business.
- Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect and secure the information systems and nonpublic information it holds; this duty has applied since .
- If you have a board of directors, have the board or a committee require executive management to develop, implement and maintain the program and to report in writing at least annually on the program's overall status, your compliance with the chapter and material matters such as risk assessment, third-party arrangements and cybersecurity events.
- If you are an insurer domiciled in Louisiana, submit to the commissioner by February 15 each year a written statement certifying that you comply with section 2504, and keep the supporting records for five years.
- A licensee with fewer than twenty-five employees, less than five million dollars in gross annual revenue or less than ten million dollars in year-end total assets is exempt from the program duty, and a licensee that meets the Health Insurance Portability and Accountability Act (HIPAA), Gramm-Leach-Bliley or approved-other-jurisdiction conditions in section 2509 is also exempt.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The commissioner of insurance, who may examine and investigate any licensee and take the action necessary or appropriate to enforce the chapter (R.S. 22:2507).
What this law does
Section 2504 of the Insurance Data Security Law requires a licensee to develop, implement, and maintain a comprehensive, written information security program based on its risk assessment that contains administrative, technical, and physical safeguards for the protection of nonpublic information and its information system.
A licensee is any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered, under the insurance laws of Louisiana, other than a purchasing group or risk retention group chartered and licensed in another state or an assuming insurer domiciled in another state.
A licensee must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information.
A licensee must exercise due diligence in selecting a third-party service provider and require the provider to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that the provider holds. Each insurer domiciled in Louisiana must submit to the commissioner a written statement by February 15, annually, certifying that the insurer is in compliance with the requirements of section 2504.
A licensee is exempt from section 2504 if it has fewer than twenty-five employees, less than five million dollars in gross annual revenue, or less than ten million dollars in year-end total assets. In the case of a violation of the chapter, the commissioner may impose a penalty pursuant to section 18 of Title 22 of the Revised Statutes.
A licensee that satisfies the chapter may assert an affirmative defense to a tort action alleging that its failure to implement reasonable information security controls resulted in a data breach concerning nonpublic information. Section 2504, other than subsection F, became effective on . Subsection F of section 2504, on third-party service providers, became effective on . The chapter does not create or imply a private cause of action for a violation of its provisions.
When LexLint raises it
When your app profile says your app is an insurer.