South Carolina Agent & Broker Winter 2019

More documents

Recommendations

Info

SC Insurance Data Security Act: Top Five Things Producers and Agencies Need to Know iStockphoto.com/ismagilov This article was prepared by IIABSC staff members and is intended to be a guide to help producers and agencies prepare for the new Insurance Data Security Act. It is NOT legal advice. Producers and agencies should be familiar with all parts of the new law and should seek professional guidance if in doubt about their compliance. The SC Insurance Data Security Act becomes effective Jan. 1, 2019 and will affect every South Carolina licensed producer and agency – resident and non-resident. IIABSC has broken out the primary requirements that will affect producers and agencies (there are unique and additional requirements for insurance companies) in an effort help them comply with the new law. Here are our top five things that producers and agencies should know about the new law. 10 South Carolina Agent & Broker • Winter 2019
No. 1: The law applies to ALL SC Department of Insurance licensees – producers, agencies, brokers, insurance companies – and excludes a very limited and narrow group. If you do not have electronic information, do NOT have any Nonpublic Personal Information (NPI) or are a risk retention group – then you do not have to comply with the new law. No. 2: ALL producers/agencies must report ALL data breaches to the SC Department of Insurance. There are no exemptions from this part of the law. Beginning Jan. 1, 2019, any loss of electronic data that contains Nonpublic Personal Information must be reported online to the SC Department of Insurance within 72 hours of discovery. South Carolina resident agencies/producers must report all breaches regardless of the amount of records. Non-resident agencies/producers must report a breach if: 1. Nonpublic information of 250 or more South Carolina consumers is involved and either a. Notice is required to be provided to a governmental or selfregulatory agency or any other supervisory body pursuant to state or federal law or b. The cybersecurity event has a reasonable likelihood of materially harming: i. Any consumer residing in South Carolina. ii. Any material part of the normal operations of the licensee. No. 3: There are limited exemptions for some. Exemptions from part of the law apply to: 1. Licensee with fewer than 10 employees including independent contractors. 2. Licensee that comes under another licensee security plan (an individual producer would normally be covered under an agency security plan). 3. Licensees subject to HIPAA that submit written certification of compliance with HIPAA. 4. Licensees that certify compliance with the New York Cyber Security Regulation. The exemption only applies to having a written security plan – all licensees must comply with the reporting requirements. Also, qualifying for an exemption does not exempt a licensee from protecting NPI under other state and federal laws such as the Gramm Leach Bliley Act, Fair Credit Report Act/ Fair and Accurate Credit Transactions Act, the Federal Trade Commission Act and HIPAA. For more details on the requirements of these laws, visit our cyber resource page (see sources below). No. 4: If you do not qualify for one of the exemptions listed in No. 3, there are additional requirements for producers/agencies. These requirements include: 1. Conducting a risk assessment of your agency. Risk assessment will be different for each licensee – depending on the size and complexity of your operation. The assessment should include identification of reasonably foreseen internal and external threats to NPI, evaluation of policies, procedures and information systems to protect against threats and continued monitoring to assess effectiveness of safeguards. 2. Implementing an information security program (deadline is July 1, 2019). Your agency should compile a written security plan that addresses any known or suspected threats as well how your office will respond to a cybersecurity breach. IIABSC members can start with the downloadable cyber security plan template available through the Agents Council on Technology (this tool available to IIABSC members only). 3. Providing cybersecurity awareness training for employees and third parties. Employees should be trained to protect NPI data, they should be taught to alert management for suspicious computer activity, they should be taught to recognize email scams, they should learn to safeguard computers by locking them and keeping them secure, changing and protecting passwords according to the agency policy, and being familiar with the laws that protect the information they us to perform their jobs. 4. Exercising due diligence with the selection of third-party vendors, requiring them to implement the necessary security measures (deadline is July 1, 2020). There will be more guidance on this requirement from the SC Department of Insurance. Ultimately, SC licensees will be held accountable for the actions of third-party vendors with which the agency works with and has access to agency NPI. No. 5: One size does not fit all. Please understand that there is no single answer to compliance with this new law. Each agency/producer may use different solutions to comply. Whatever tract your operation takes, document your compliance efforts. While you do not have to report to the DOI how you are complying with the law, in the event of a data breach in your agency, the DOI investigation will include an analysis of your preparation and prevention. Other tips for effective compliance include: • Be methodical in your approach to compliance. • Assign responsibilities for the ISP and hold people accountable. • Devote the necessary time and resources to your risk assessment. • Develop a plan/framework for your information security program with checklist(s) for each significant part of the Act. • Develop security policies, standards and guidelines based on your business’ risk assessment. • Train your employees. Other sources for help: • IIABSC has a dedicated resource web page for the SC Insurance Data Security Act that has additional information and resources to help agencies comply. Find it at iiabsc.com/cybersecurity. • There is also complete information on the law and access to the DOI bulletins at the SC Department of Insurance cyber resource page, found at www.doi.sc.gov/cyber. We recommend watching the DOI webinar overview of the law and reviewing the PowerPoint presentation prepared by DOI staff. • IIABSC members can review and download additional cyber tools and resources from ACT – Agents Council on Technology – including a downloadable cyber security plan template. Find them at independentagent.com/act. • Your IT support team will also be a valuable resource for helping comply – from helping assess your risk to implementing technology safeguards and protocols. • All agencies should consider a cyberliability insurance policy. Cyber insurance policies with breach response coverage are an affordable and valuable protection for your agency should you have to respond to a data breach in your agency. IIABSC offers cyberliability insurance, complete with an online risk assessment of your agency, from Coalition. This program is also available to offer your clients. Learn more on our website, iiabsc.com/cyberliability. Protection of your client’s personal information is one of the highest priorities you and your staff should have. Be proactive and implement the necessary steps to not only comply with SC law, but to safeguard your client’s information. For more information regarding the SC Insurance Data Security Act, contact Becky McCormack (bmccormack@iiabsc.com) or Frank Sheppard (fsheppard@iiabsc.com) at IIABSC, 803-731-9460. Winter 2019 • South Carolina Agent & Broker 11
Page 1 and 2: WINTER 2019 SC Insurance Data Secur
Page 3 and 4: Expect big things in workers’ com
Page 5 and 6: Relax, South Carolina We’ve got y
Page 7 and 8: NOTICE OF COMMISSION INCREASE SEPTE
Page 9: DISCOVER THE ACCESS HOME DIFFERENCE
Page 13 and 14: People Pathways Purpose IIABSC Annu
Page 15 and 16: Winter 2019 • South Carolina Agen
Page 17 and 18: Whether it’s the voice in your he
Page 19 and 20: Save the date for these upcoming ev
Page 21 and 22: CISR ELITE Those with the CISR Elit
Page 23 and 24: “Excellence through Education”
Page 25 and 26: Coming in 2019 to Charleston Ultima
Page 27 and 28: COMMERCIAL COVERAGE GAPS & How to F
Page 29 and 30: COMMERCIAL LINES Agent Friendly End
Page 31 and 32: Insurance and the Property Lease
Page 33 and 34: THERE IS NO COMPARISON Assure Allia
Page 35 and 36: New Course Series: Commercial Agent
Page 37 and 38: Bankers Insurance Group Heritage Pr
Page 40: WE NEVER DEMAND YOU Give up carrier

South Carolina Agent & Broker Winter 2019

Create successful ePaper yourself

Delete template?

Save as template?