Law / United States / 
Oklahoma
Insurance Data Security Act: information security program
Insurance Data Security Act, Okla. Stat. tit. 36, Sec. 673
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived 2025. Publisher's page: https://www.oklegislature.gov/cf_pdf/2025-26%20ENR/HB/HB1498%20ENR.PDFIn force since .
A sector security regimes rule binding private bodies.
- Private right of action
- No
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to a licensee under Oklahoma insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate or registered, or required to be, under Title 36 of the Oklahoma Statutes, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state.
- Develop, implement and maintain a comprehensive written information security program, based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information systems, commensurate with your size and complexity, your activities (including your use of third-party service providers) and the sensitivity of the nonpublic information.
- Designate the person responsible for the program, identify and assess the reasonably foreseeable internal and external threats to nonpublic information, and implement information safeguards to manage them, assessing the effectiveness of the key controls, systems and procedures at least annually.
- Determine and implement the security measures that are appropriate, which include access controls, encryption of nonpublic information in transit over an external network and on portable devices, multi-factor authentication for any authorized individual accessing nonpublic information, regular testing and monitoring of systems, audit trails, and secure disposal of nonpublic information.
- Establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information, your information systems or the continuing functionality of your business.
- Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect and secure the information systems and nonpublic information it holds; this duty has applied since .
- If you are an insurer domiciled in Oklahoma, submit to the Insurance Commissioner by April 15 each year a written statement certifying that you comply with section 673, and keep the supporting records for five years.
- A licensee with less than five million dollars in gross annual revenue is exempt from the act, and a licensee that meets the Health Insurance Portability and Accountability Act (HIPAA) or Gramm-Leach-Bliley conditions in section 678 is treated as meeting section 673.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Insurance Commissioner, who may examine and investigate any licensee and take the action necessary or appropriate to enforce the act (section 676).
What this law does
Section 673 of Title 36 requires each licensee in the state to develop, implement, and maintain a comprehensive written information security program based on its risk assessment that contains administrative, technical, and physical safeguards for the protection of nonpublic information and its information systems.
A licensee is any person licensed, authorized to operate, or registered, or required to be, under Title 36 of the Oklahoma Statutes, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state.
A licensee must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information.
A licensee must exercise due diligence in selecting its third-party service provider and require the provider to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that the provider holds. Each insurer domiciled in the state must submit to the Insurance Commissioner a written statement by April 15, annually, certifying that the insurer complies with the requirements of section 673.
A licensee with less than five million dollars in gross annual revenue is exempt from the act. In the case of a violation of the act, a licensee may be penalized in accordance with any applicable sections of the Insurance Code. The Insurance Data Security Act became effective on . Licensees have one year from the effective date to implement section 673 and two years from the effective date to implement its subsection F on third-party service providers. The act does not create or imply a private cause of action for violations of its provisions.
When LexLint raises it
When your app profile says your app is an insurer.