Q&A: Connecticut’s New Data Breach Mandate

Many states are enacting data breach notification laws, but Connecticut is the first state to have its insurance department get involved, enacting what is known as Bulletin IC-25. Wanting to know more about this recent development, I contacted Ed Goodman, chief privacy officer at Identity Theft 911. Below is our exchange:

What is Bulletin IC-25?

EG: On August 18, 2010, the Connecticut Insurance Department issued Bulletin IC-25. Bulletin IC-25 covers the handling of information security incidents that pose a potential risk to an individual’s personal health and/or financial information.

Is Connecticut the first state to issue such requirements for insurance companies doing business in the state?

EG: While CT already has data breach notification laws, this is the first time any state Insurance Department set out specific stringent breach requirements for insurance companies doing business in its state.

Why is this rule important?

EG: Insurance companies doing business in Connecticut must know how the rule affects them and what they are required to do if they suffer a data breach. Companies with BOP (business owner policies) need to know how the new law affects their business customers, so they can address concerns and meet their customers’ needs. While other states (California and Massachusetts) have been on the cutting edge of data breach regulations, Connecticut is the first to establish the insurance department in an active role in data breaches specifically in the insurance industry. Understanding breach regulations is crucial to every insurance company to:
* Avoid sanctions or fines
* Preserve goodwill with people who trust them with their personal data
* Listening, then advising, educating and advocating protecting and restoring their identities

Do you see other states enacting the same sort of rule in the near future?

EG: Other state insurance departments will follow Connecticut. So all U.S. insurance companies should be prepared and knowledgeable, as well. The State of Connecticut Insurance Department’s Bulletin IC-25 is the beginning of a trend towards high scrutiny security incidents by regulators, especially in the insurance industry. Expect to see more departments following suit in the coming years.

To view more blogs such as this one, please visit www.riskmanagementmonitor.com

Views: 73


You need to be a member of GlobalRisk community to add comments!

Join GlobalRisk community

Comment by Sonia Jaspal on September 23, 2010 at 2:42am
Hi Shavvone,

This is a informative article. Thanks for sharing. I do not think we have a similar requirement in India at present regarding it. Might impact the organizations who have outsourced insurance processes.

Kind regards,


Our Sponsors

Would you like to reach over 90,000 + Risk Professionals? 



Current Partners Include:





Join GRC Inner Circle - Get Top Risk Resources, Member Support PLUS become our patron

Business Exchange

If your organization delivers products and services that bring value to our members, you are welcome to join our partnership program.

Companies are welcome to setup a business profile page in our Multimedia Business Directory. You will get full control of the page and can include cutting edge possibilities – videos, adverts, presentations, white papers, job offers, Press Releases, product information, company blog, news feeds and more.


Our Knowledge Partners

Request our MEDIA KIT

Our Twitter feed

© 2020   Created by Boris Agranovich.   Powered by

Badges  |  Report an Issue  |  Terms of Service