Law / United States / 
Pennsylvania
Insurance Data Security chapter, risk assessment, information security program and investigation of a cybersecurity event
Insurance Data Security chapter, 40 Pa.C.S. §§ 4512 to 4517
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- Applies to a licensee under Pennsylvania insurance law, which you declare by stating that you are an insurer: a person that is or is required to be licensed, authorized to operate or registered under the insurance laws of Pennsylvania, other than a purchasing group or risk retention group chartered and licensed in another state or an assuming insurer domiciled in another state.
- Conduct a risk assessment that identifies reasonably foreseeable internal or external threats to nonpublic information, assesses their likelihood and potential damage, and assesses the sufficiency of your policies, procedures, information systems and safeguards, and assess the effectiveness of the safeguards' key controls, systems and procedures at least annually.
- Develop, implement and maintain a comprehensive written information security program, based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information systems, commensurate with your size, your activities, your use of third-party service providers and the sensitivity of the information.
- Determine which security measures are appropriate and implement them, including access controls, encryption of nonpublic information in transit over an external network and on portable devices, effective controls for employees accessing nonpublic information (which may include multifactor authentication), and regular testing and monitoring of systems.
- Establish and maintain a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information.
- Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect and secure the information systems and nonpublic information it holds.
- If you are an insurer domiciled in Pennsylvania, submit to the commissioner each April 15 a written statement certifying compliance with sections 4512 to 4515, and keep the supporting records for five years.
- Conduct a prompt investigation if you discover that a cybersecurity event has or may have occurred, and keep records concerning all cybersecurity events for at least five years, producing them on the commissioner's demand.
- A licensee with fewer than 10 employees, less than $5,000,000 in gross revenue or less than $10,000,000 in year-end total assets is exempt from sections 4512 to 4516 (risk assessment, program, oversight, certification), but not from the investigation duty in section 4517.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 4522(4): a penalty of not more than $5,000 for each violation that a licensee knew or reasonably should have known was a violation, not to exceed $100,000 in a single calendar year. Section 4522(5): not more than $1,000 for each violation the licensee did not know nor reasonably should have known was a violation, not to exceed $20,000 in a single calendar year. The commissioner may also suspend or revoke, or refuse to issue or renew, the license, authorization or registration, and issue a cease and desist order.
- Rule
- Per violation only
- As of
- Currency
- USD
- Fixed cap
- 100,000
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
The Pennsylvania Insurance Commissioner (Insurance Department), who may, after notice and hearing, impose the section 4522 penalties.
What this law does
Section 4512 requires a licensee to conduct a risk assessment that identifies reasonably foreseeable internal or external threats that could result in unauthorized access, transmission, disclosure, misuse, alteration or destruction of nonpublic information. Section 4513 requires each licensee to develop, implement and maintain a comprehensive written information security program based on the licensee's risk assessment.
A licensee must determine which security measures are appropriate and implement them, and the measures the section lists include effective controls, which may include multifactor authentication procedures, for any employees accessing nonpublic information.
The listed measures include protecting, by encryption or other appropriate means, all nonpublic information transmitted over an external network and all nonpublic information stored on a laptop computer or other portable computing or storage device or media.
Each licensee must establish and maintain a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information in its possession, its information systems or the continuing functionality of any aspect of its business or operations.
If a licensee has a board of directors, the board or an appropriate committee of the board must require the licensee's executive management or delegates to develop, implement and maintain the licensee's information security program.
A licensee must exercise due diligence in selecting its third-party service provider and require the provider to implement appropriate administrative, technical and physical measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the provider. Each insurer domiciled in Pennsylvania must submit to the commissioner each April 15 a written statement certifying that the insurer is in compliance with sections 4512 through 4515.
If a licensee discovers that a cybersecurity event has or may have occurred, the licensee or an outside vendor or service provider designated to act on its behalf must conduct a prompt investigation. A licensee must maintain records concerning all cybersecurity events for a period of at least five years from the date of the cybersecurity event and produce those records upon demand of the commissioner.
A licensee with fewer than 10 employees, less than $5,000,000 in gross revenue or less than $10,000,000 in year-end total assets is exempt from sections 4512 through 4516. A licensee is a person that is or is required to be licensed, authorized to operate or registered under the insurance laws of Pennsylvania. Act 2 of 2023 provides that the addition of the chapter takes effect in 180 days.
When LexLint raises it
When your app profile says your app is an insurer.