Law / United States / 
Michigan
Michigan Insurance Data Security Act, cybersecurity event investigation and notice to the director
Insurance Cybersecurity Event Notice, MCL 500.557 and 500.559
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds every licensee under Michigan's Insurance Code, a licensed insurer or producer or other person licensed, authorized or registered under it (reached by declaring that you are an insurer); the small-licensee exemption in section 500.565(1) lifts only section 555, and a licensee in compliance with the Health Insurance Portability and Accountability Act (HIPAA) rules is still bound by section 559 (sections 500.553(g) and 500.565).
- When you learn that a cybersecurity event has or may have occurred, investigate it promptly yourself or through a vendor you designate: determine whether an event occurred, assess its nature and scope, identify the nonpublic information involved, and restore the security of the compromised information systems (section 500.557(1) and (2)).
- Keep records of all cybersecurity events for at least 5 years from the date of each event and produce them on the director's demand (section 500.557(3)).
- Notify the director as promptly as possible, and not later than 10 business days after you determine that a cybersecurity event involving nonpublic information in your possession has occurred, when Michigan is your state of domicile (insurer) or home state (insurance producer) and the event has a reasonable likelihood of materially harming a Michigan consumer or a material part of your normal operation (section 500.559(1)(a)).
- Give the same notice within the same 10 business days when you reasonably believe the nonpublic information involved is of 250 or more Michigan consumers and the event is one you must report to a government body under other law or has a reasonable likelihood of materially harming a Michigan consumer or a material part of your normal operation (section 500.559(1)(b)).
- Give the notice electronically as the director directs, include as much as possible of the information section 500.559(2) lists (the date of the event, how the information was exposed, the number of Michigan consumers affected, the results of your internal review and your remediation efforts), and update and supplement it as previously provided information materially changes (section 500.559(2)).
- Give the director a copy of any consumer notice you send under the chapter (section 500.559(3)).
- Treat a cybersecurity event at a third-party service provider as your own event, with your deadlines running from the day after the provider notifies you or you otherwise have actual knowledge of it, whichever is earlier (section 500.559(4)).
- If you are an assuming insurer, notify your affected ceding insurers and the director of your state of domicile within 10 business days after determining that a cybersecurity event has occurred (section 500.559(5)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The director under the Insurance Code, to whom a licensee must produce its records of cybersecurity events on demand.
What this law does
Section 559 of the Insurance Code requires each licensee to notify the director as promptly as possible, and not later than 10 business days, after a determination that a cybersecurity event involving nonpublic information in its possession has occurred, when either of two sets of criteria is met.
The first set of criteria is that Michigan is the licensee's state of domicile, for an insurer, or its home state, for an insurance producer, and that the event has a reasonable likelihood of materially harming a consumer residing in Michigan or any material part of a normal operation of the licensee.
The second set of criteria is that the licensee reasonably believes the nonpublic information involved is of 250 or more consumers residing in Michigan and that the event is one of two further kinds. A licensee is a licensed insurer or producer, and other persons licensed or required to be licensed, authorized, or registered, or holding or required to hold a certificate of authority under the Insurance Code.
A licensee that learns a cybersecurity event has or may have occurred must conduct a prompt investigation itself or through a designated outside vendor or service provider. A licensee must maintain records concerning all cybersecurity events for at least 5 years from the date of the event and produce them on demand of the director.
A licensee must provide the notice information in electronic form as the director directs and has a continuing obligation to update and supplement its notifications regarding material changes to previously provided information. An assuming insurer must notify its affected ceding insurers and the director of its state of domicile within 10 business days after making the determination that a cybersecurity event has occurred. Section 559 was added by Act 690 of 2018 and took effect on .
When LexLint raises it
When your app profile says your app is an insurer.