On Oct. 24, the National Association of Insurance Commissioners(NAIC) formally approved the Insurance Data Security Model Law (model law). The NAICis a standard setting and regulatory support organizationconsisting of the top insurance regulators from the 50 states,District of Columbia, and five U.S. territories.

The model law applies to “licensees” which are defined aspersons and nongovernmental business entities subject tothe insurance laws of the state adopting the model law. InPennsylvania, for example, this would encompass insurance companiesand insurance producers (i.e., agents, agencies and brokers).Notably, this applies to nonresident licensees except forpurchasing groups, risk retention groups or when acting as assuminginsurer. For example, a broker resident in a state that hasnot adopted the model law, is potentially subject to the modellaw if they are also licensed in another state that has adopted themodel law. Thus, it will be important to track what states enactthe model law and also how uniformly the model law is enactedstate to state.

Related: Cybersecurity and health care: where the concernlies