Phase 2 of PA's Insurance Data Security Law Is Coming — Record of Compliance Required

As a quick recap, the Insurance Data Security Law requires organizations to implement and maintain adequate cybersecurity measures to protect the confidentiality, integrity, and availability of insurance-related data, labeled "nonpublic information," and defined by the statute as business-related information whose compromise would have a "materially adverse impact" to the licensee's business, and consumer personal data combined with that person's Social Security number, driver's license or nondriver identification card number, PCI or financial account data, PHI, or biometric data. This definition is broader than the definition for personal identifiable information under Pennsylvania's data breach notification statute. The statute defines a "cybersecurity event" as an unauthorized access, misuse, or disruption of a licensee's information system or nonpublic information—again, a term that is much broader than a "breach of security" under Pennsylvania's data breach notification statute.

Effective Dec. 11, 2023, the law required licensees to investigate a suspected cybersecurity event, and implemented a five-day notification deadline to the Pennsylvania Insurance Commissioner upon the discovery of a cybersecurity event that creates a "reasonable likelihood of materially harming a Pennsylvania resident" or the "normal operations" of the organization where the licensee is a domiciled insurer or insurance producer claiming Pennsylvania as its home state, or where the licensee "reasonably believes" the event involves the nonpublic information of 250 or more Pennsylvania residents and the event either triggers a legal notification requirement or there is a "reasonable likelihood" of materially harming a Pennsylvania resident or the licensee's "normal operations."