MN Insurance Data Security Model
The new law requires agents, insurers, and other entities licensed by the DOC to develop, implement and maintain an information security program; investigate any cybersecurity events; and notify the Commissioner of such events. The specific requirements for the information security program, investigation of cybersecurity event and the circumstances under which you need to notify the Commissioner are included in the new law.
The DOC introduced the NAIC Model, which contains numerous onerous provisions, verbatim. Over the past two years, we pushed hard for and achieved the following changes to ease the burdens on agents imposed by the new law:
- The DOC’s bill contained a small entity exemption that was woefully inadequate as it only applied to licensees with fewer than 10 employees, including independent contractors, and it only exempted licensees from the information security program requirements. We were able to expand the small entity exemption to licensees with fewer than 25 employees, excluding independent contractors, and our exemption also applies to the investigation requirements, which our smaller agencies found to be particularly onerous.
- We added a producer-specific exemption for individual employees and agents that work within an agency.
- We expanded the exemption for HIPAA covered entities to all provisions of the new law except for the requirement to report cybersecurity events to the Commissioner, and in the case of insurers, to notify their agents of a cybersecurity event as well.
- To ensure that agents are not subject to multiple and conflicting data security standards, we added language providing that this law is the only state law governing data security standards for DOC licensees. The DOC fought us on this up until the very last minute.
- We modified the definition of “nonpublic information” so that agents would not be required to safeguard non-sensitive information in unnecessarily demanding ways.
- We made numerous changes to the information security program implementation requirements to make sure that agents could comply with them. These included deleting language that would have required agents to test and evaluate the security of externally developed software such as Microsoft Word.
- The DOC’s bill would have required agents to notify the Commissioner of a cybersecurity event no later than 72 hours after the discovery of the event. This requirement was simply unreasonable and we amended the bill to give agents 5 business days to notify the Commissioner
.
As I mentioned above, the new law takes effect on August 1, 2021. However, agents, who are not subject to an exemption, have until August 1, 2022 to come into compliance with the information security program requirements and until August 1, 2023 to comply with the third-party oversight provisions.
The requirements to investigate and to report cybersecurity events to the Commissioner, begin on August 1.
