Law / United States / 
Virginia
Insurance Data Security Act: information security program and investigation of a cybersecurity event
Va. Code Ann. §§ 38.2-623 and 38.2-624
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security
As of .
What it requires
- This binds a licensee: any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered under the insurance laws of the Commonwealth, other than a purchasing group or a risk retention group chartered and licensed in another state or an assuming insurer domiciled in another state; declare is_insurer if your organization is one.
- Develop, implement, and maintain a comprehensive written information security program, based on your assessment of your risk, that contains administrative, technical, and physical safeguards for the protection of nonpublic information and your information system, commensurate with your size and complexity, the nature and scope of your activities including your use of third-party service providers, and the sensitivity of the nonpublic information.
- Design the program to protect the security and confidentiality of nonpublic information and the security of the information system, protect against reasonably foreseeable threats or hazards to their security or integrity, protect against unauthorized access to or use of nonpublic information, minimize the likelihood of harm to any consumer, and define and periodically reevaluate a schedule for retention of nonpublic information and a mechanism for its destruction.
- Designate one or more employees, an affiliate, or an outside vendor responsible for the program; place access controls on information systems; restrict access to physical locations containing nonpublic information to authorized persons; protect against destruction, loss, or damage of nonpublic information from environmental hazards or technological failures; maintain procedures for the secure disposal of nonpublic information in any format; stay informed of emerging threats or vulnerabilities; and provide personnel with cybersecurity awareness training.
- If you have a board of directors, the board or an appropriate committee must require executive management or its delegates to develop, implement, and maintain the program and to report to it in writing on the overall status of the program and your compliance with the article, and on material matters such as risk assessment, third-party service provider arrangements, testing results, and cybersecurity events.
- Beginning , if you use a third-party service provider, exercise due diligence in selecting it and require it to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the provider.
- Monitor, evaluate, and adjust the program as relevant changes occur in technology, the sensitivity of your nonpublic information, internal or external threats, and your own business arrangements such as mergers, alliances, outsourcing, and changes to information systems.
- Establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information, your information systems, or the continuing functionality of your business or operations, addressing the internal response process, the plan's goals, roles and decision-making authority, external and internal communications, remediation of identified weaknesses, documentation and reporting, and evaluation and revision of the plan after an event.
- If you learn that a cybersecurity event has or may have occurred, conduct a prompt investigation, or have an investigator do so, determining whether an event occurred, its nature and scope, the nonpublic information involved, and performing or overseeing reasonable measures to restore the security of the compromised systems; where the event is in a third-party service provider's system, complete those steps or make reasonable efforts to confirm and document that the provider has completed them.
- Maintain records concerning all cybersecurity events for at least five years from the date of the event and produce them on the Commissioner's demand.
- If you are an insurer domiciled in the Commonwealth, submit to the Commissioner by February 15 each year, beginning in 2023, a written statement certifying that you are in compliance with section 38.2-623, any rules adopted under the article, and any requirements prescribed by the Commission, keep the supporting records for five years, and document any areas, systems, or processes that need material improvement together with the remedial efforts planned and underway.
- A licensee subject to Health Insurance Portability and Accountability Act (HIPAA) that maintains a program under it, certifies its compliance, and certifies that it will protect nonpublic information not subject to HIPAA in the same manner is considered to meet the program duty, and a licensee affiliated with a depository institution whose program complies with the Interagency Guidelines is considered to meet it on producing documentation the Commissioner finds satisfactory; a licensee that ceases to qualify for an exception has 180 days to comply.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 38.2-218: a person who knowingly or willfully violates any provision of Title 38.2, or any regulation issued under it, is punished for each violation by a penalty of not more than $5,000, and a person who violates a provision without knowledge or intent may be punished for each violation by a penalty of not more than $1,000, with a series of similar violations from the same act limited to $10,000 in the aggregate. The knowing or willful ceiling is recorded as per_violation_amount.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
Virginia Commissioner of Insurance, who may examine and investigate the affairs of any licensee and take the action that is necessary or appropriate to enforce the article (section 38.2-627).
What this law does
Each licensee must develop, implement, and maintain a comprehensive written information security program, based on its assessment of its risk, that contains administrative, technical, and physical safeguards for the protection of nonpublic information and its information system.
Each licensee must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in its possession, its information systems, or the continuing functionality of any aspect of its business or operations.
Beginning , a licensee that uses a third-party service provider must exercise due diligence in selecting it and require it to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the provider.
Beginning in 2023, each insurer domiciled in the Commonwealth must submit to the Commissioner by February 15 each year a written statement certifying that it is in compliance with section 38.2-623, any rules adopted under the article, and any requirements prescribed by the Commission. A licensee that learns that a cybersecurity event has or may have occurred must conduct a prompt investigation, or have an investigator conduct one.
Each licensee must maintain records concerning all cybersecurity events for a period of at least five years from the date of the event and produce those records upon demand of the Commissioner.
A licensee is any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered under the insurance laws of the Commonwealth, other than a purchasing group or a risk retention group chartered and licensed in another state or a person acting as an assuming insurer domiciled in another state or jurisdiction.
A licensee subject to Health Insurance Portability and Accountability Act (HIPAA) that maintains an information security program under it is considered to meet section 38.2-623 if it is compliant, submits a written statement certifying its compliance, and certifies that it will protect nonpublic information not subject to HIPAA in the same manner as information that is subject to HIPAA.
A licensee affiliated with a depository institution that maintains a program in compliance with the Interagency Guidelines Establishing Standards for Safeguarding Customer Information is considered to meet section 38.2-623 if it produces, on request, documentation satisfactory to the Commissioner that independently validates the depository institution's program.
When LexLint raises it
When your app profile says your app is an insurer.