Q&A: Connecticut’s New Data Breach Mandate

Many states are enacting data breach notification laws, but Connecticut is the first state to have its insurance department get involved, enacting what is known as Bulletin IC-25. Wanting to know more about this recent development, I contacted Ed Goodman, chief privacy officer at Identity Theft 911. Below is our exchange:

What is Bulletin IC-25?

EG: On August 18, 2010, the Connecticut Insurance Department issued Bulletin IC-25. Bulletin IC-25 covers the handling of information security incidents that pose a potential risk to an individual’s personal health and/or financial information.


Is Connecticut the first state to issue such requirements for insurance companies doing business in the state?

EG: While CT already has data breach notification laws, this is the first time any state Insurance Department set out specific stringent breach requirements for insurance companies doing business in its state.


Why is this rule important?

EG: Insurance companies doing business in Connecticut must know how the rule affects them and what they are required to do if they suffer a data breach. Companies with BOP (business owner policies) need to know how the new law affects their business customers, so they can address concerns and meet their customers’ needs. While other states (California and Massachusetts) have been on the cutting edge of data breach regulations, Connecticut is the first to establish the insurance department in an active role in data breaches specifically in the insurance industry. Understanding breach regulations is crucial to every insurance company to:
* Avoid sanctions or fines
* Preserve goodwill with people who trust them with their personal data
* Listening, then advising, educating and advocating protecting and restoring their identities


Do you see other states enacting the same sort of rule in the near future?

EG: Other state insurance departments will follow Connecticut. So all U.S. insurance companies should be prepared and knowledgeable, as well. The State of Connecticut Insurance Department’s Bulletin IC-25 is the beginning of a trend towards high scrutiny security incidents by regulators, especially in the insurance industry. Expect to see more departments following suit in the coming years.

To view more blogs such as this one, please visit www.riskmanagementmonitor.com

Votes: 0
E-mail me when people leave their comments –

You need to be a member of Global Risk Community to add comments!

Join Global Risk Community

Comments

  • Hi Shavvone,

    This is a informative article. Thanks for sharing. I do not think we have a similar requirement in India at present regarding it. Might impact the organizations who have outsourced insurance processes.

    Kind regards,

    Sonia
This reply was deleted.

    About Us

    The GlobalRisk Community is a thriving community of risk managers and associated service providers. Our purpose is to foster business, networking and educational explorations among members. Our goal is to be the worlds premier Risk forum and contribute to better understanding of the complex world of risk.

    Business Partners

    For companies wanting to create a greater visibility for their products and services among their prospects in the Risk market: Send your business partnership request by filling in the form here!

lead