South Carolina Agent & Broker Winter 2019

No. 1: The law applies to ALL SC Department of Insurance licensees –
producers, agencies, brokers, insurance companies – and excludes a very
limited and narrow group. If you do not have electronic information, do
NOT have any Nonpublic Personal Information (NPI) or are a risk retention
group – then you do not have to comply with the new law.
No. 2: ALL producers/agencies must report ALL data breaches to the SC
Department of Insurance. There are no exemptions from this part of the law.
Beginning Jan. 1, 2019, any loss of electronic data that contains Nonpublic
Personal Information must be reported online to the SC Department of
Insurance within 72 hours of discovery.
South Carolina resident agencies/producers must report all breaches
regardless of the amount of records.
Non-resident agencies/producers must report a breach if:
1. Nonpublic information of 250 or more South Carolina consumers is
involved and either
a. Notice is required to be provided to a governmental or selfregulatory
agency or any other supervisory body pursuant to state
or federal law or
b. The cybersecurity event has a reasonable likelihood of materially
harming:
i. Any consumer residing in South Carolina.
ii. Any material part of the normal operations of the licensee.
No. 3: There are limited exemptions for some. Exemptions from part of
the law apply to:
1. Licensee with fewer than 10 employees including independent
contractors.
2. Licensee that comes under another licensee security plan (an individual
producer would normally be covered under an agency security plan).
3. Licensees subject to HIPAA that submit written certification of
compliance with HIPAA.
4. Licensees that certify compliance with the New York Cyber Security
Regulation.
The exemption only applies to having a written security plan – all licensees
must comply with the reporting requirements. Also, qualifying for an
exemption does not exempt a licensee from protecting NPI under other state
and federal laws such as the Gramm Leach Bliley Act, Fair Credit Report Act/
Fair and Accurate Credit Transactions Act, the Federal Trade Commission
Act and HIPAA. For more details on the requirements of these laws, visit our
cyber resource page (see sources below).
No. 4: If you do not qualify for one of the exemptions listed in No. 3, there
are additional requirements for producers/agencies. These requirements
include:
1. Conducting a risk assessment of your agency. Risk assessment will be
different for each licensee – depending on the size and complexity
of your operation. The assessment should include identification of
reasonably foreseen internal and external threats to NPI, evaluation of
policies, procedures and information systems to protect against threats
and continued monitoring to assess effectiveness of safeguards.
2. Implementing an information security program (deadline is July
1, 2019). Your agency should compile a written security plan that
addresses any known or suspected threats as well how your office will
respond to a cybersecurity breach. IIABSC members can start with
the downloadable cyber security plan template available through the
Agents Council on Technology (this tool available to IIABSC members
only).
3. Providing cybersecurity awareness training for employees and third
parties. Employees should be trained to protect NPI data, they should
be taught to alert management for suspicious computer activity,
they should be taught to recognize email scams, they should learn
to safeguard computers by locking them and keeping them secure,
changing and protecting passwords according to the agency policy, and
being familiar with the laws that protect the information they us to
perform their jobs.
4. Exercising due diligence with the selection of third-party vendors,
requiring them to implement the necessary security measures (deadline
is July 1, 2020). There will be more guidance on this requirement from
the SC Department of Insurance. Ultimately, SC licensees will be held
accountable for the actions of third-party vendors with which the
agency works with and has access to agency NPI.
No. 5: One size does not fit all. Please understand that there is no single
answer to compliance with this new law. Each agency/producer may use
different solutions to comply. Whatever tract your operation takes, document
your compliance efforts. While you do not have to report to the DOI how
you are complying with the law, in the event of a data breach in your agency,
the DOI investigation will include an analysis of your preparation and
prevention. Other tips for effective compliance include:
• Be methodical in your approach to compliance.
• Assign responsibilities for the ISP and hold people accountable.
• Devote the necessary time and resources to your risk assessment.
• Develop a plan/framework for your information security program with
checklist(s) for each significant part of the Act.
• Develop security policies, standards and guidelines based on your
business’ risk assessment.
• Train your employees.
Other sources for help:
• IIABSC has a dedicated resource web page for the SC Insurance Data
Security Act that has additional information and resources to help
agencies comply. Find it at iiabsc.com/cybersecurity.
• There is also complete information on the law and access to the DOI
bulletins at the SC Department of Insurance cyber resource page, found
at www.doi.sc.gov/cyber. We recommend watching the DOI webinar
overview of the law and reviewing the PowerPoint presentation
prepared by DOI staff.
• IIABSC members can review and download additional cyber
tools and resources from ACT – Agents Council on Technology –
including a downloadable cyber security plan template. Find them at
independentagent.com/act.
• Your IT support team will also be a valuable resource for helping
comply – from helping assess your risk to implementing technology
safeguards and protocols.
• All agencies should consider a cyberliability insurance policy. Cyber
insurance policies with breach response coverage are an affordable
and valuable protection for your agency should you have to respond
to a data breach in your agency. IIABSC offers cyberliability insurance,
complete with an online risk assessment of your agency, from Coalition.
This program is also available to offer your clients. Learn more on our
website, iiabsc.com/cyberliability.
Protection of your client’s personal information is one of the highest
priorities you and your staff should have. Be proactive and implement the
necessary steps to not only comply with SC law, but to safeguard your client’s
information. For more information regarding the SC Insurance Data Security
Act, contact Becky McCormack (bmccormack@iiabsc.com) or Frank Sheppard
(fsheppard@iiabsc.com) at IIABSC, 803-731-9460.
Winter 2019 • South Carolina Agent & Broker 11