Law / United States / 
Missouri
Insurance Data Security Act: notice of a cybersecurity event to the director
Insurance Data Security Act, Mo. Rev. Stat. sec. 375.1410
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Instrument type
- an act of a legislature
- Obligation class
- Security
As of .
What it requires
- This binds a licensee, a person licensed, authorized to operate, or registered, or required to be, under Missouri's insurance laws (reached by declaring that you are an insurer, reinsurer or insurance producer). A licensee with fewer than ten employees is exempt from section 375.1405 only, a producer with fewer than fifty employees, less than $5,000,000 in gross annual revenue, or less than $10,000,000 in year-end total assets is exempt from the Act, and a licensee governed by the Health Insurance Portability and Accountability Act (HIPAA) privacy, security, and breach notification rules is deemed to comply with the Act except for the director notification requirements in subsections 1 and 2 of section 375.1410 (section 375.1417).
- Notify the director as promptly as practicable, and in no event later than four business days, from a determination that a cybersecurity event involving nonpublic information in your possession has occurred, when Missouri is your state of domicile (insurer) or home state (producer) and the event has a reasonable likelihood of materially harming a consumer residing in Missouri or a material part of your normal operations, or when you reasonably believe the information involved is of 250 or more Missouri consumers and notice must be given to a government body, self-regulatory agency, or other supervisory body under state or federal law, or the event has a reasonable likelihood of that harm.
- Provide as much of the listed information as practicable, in electronic form as directed by the director, covering the date and discovery of the event, how the information was exposed, the types of information involved, the period of compromise, the number of Missouri consumers affected, the results of your internal review, your remediation efforts, a copy of your privacy policy, and a contact person; continually update and supplement your notices.
- Comply with section 407.1500 as applicable, and give the director a copy of the notice sent to consumers when you are required to notify the director.
- Treat a cybersecurity event in a system maintained by a third-party service provider as one in your own system; your deadlines run from the day after the provider notifies you or you otherwise have actual knowledge, whichever is sooner.
- As an assuming insurer, notify your affected ceding insurers and the commissioner or director of insurance of your state of domicile within three business days of determining that a cybersecurity event has occurred.
- As an insurer whose consumers accessed your services through an independent insurance producer, and where consumer notice is required by law, notify the producers of record of all affected consumers no later than the time notice is given to those consumers.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The director has power to examine and investigate the affairs of any licensee to determine whether the licensee has been or is engaged in conduct in violation of the Act.
What this law does
A licensee must notify the director as promptly as practicable, and in no event later than four business days, from a determination that a cybersecurity event involving nonpublic information in its possession has occurred when a listed criterion is met. The notice duty is met where the licensee is domiciled in Missouri, or Missouri is its home state, and the event has a reasonable likelihood of materially harming a consumer residing in Missouri or a material part of its normal operations.
The notice duty is also met where the licensee reasonably believes that the nonpublic information involved is of two hundred fifty or more consumers residing in Missouri and the event meets either of two further conditions. An assuming insurer must notify its affected ceding insurers and the director of its state of domicile within three business days of making the determination that a cybersecurity event has occurred.
The licensee must provide as much of the listed information as practicable, in electronic form as directed by the director, and has a continuing obligation to update its notices. A licensee must comply with section 407.1500, as applicable, and give the director a copy of the notice sent to consumers when it is required to notify the director. The Insurance Data Security Act takes effect on .
In the Act, a person means any individual or any nongovernmental entity, including a nongovernmental partnership, corporation, branch, agency, or association.
When LexLint raises it
When your app profile says your app is an insurer.