Maine recently became one of the latest states to enact a version of the National Association of Insurance Commissioners (NAIC) model data security law in March. The Maine Insurance Data Security Act was signed into law on March 17.
The NAIC adopted its Insurance Data Security Model Law in 2017. With skyrocketing cyber-attack numbers, the Data Security Model Law was designed to establish data security standards for regulators and insurers to mitigate damage from a data breach.
The Maine Insurance Data Security Act depicts standards for insurers licensed in the state, requiring them to develop, implement, and maintain a written information security program that aligns with the size and complexity of their business based on a risk assessment. The risk assessments are required to be conducted annually to assess the effectiveness of cybersecurity controls, information systems and other safeguards to manage threats.
When a cybersecurity event does occur, insurers, or outside vendors acting on behalf of insurers, are required to conduct a prompt investigation and notify the superintendent no later than three business days after the event is discovered. The insurer must provide a copy of the notice to the consumers.
The Maine Insurance Data Security Act takes effect on January 1, 2022.
Several states have adopted versions of the Model Law, including Alabama, Connecticut, Delaware, Indiana, Louisiana, Michigan, Mississippi, New Hampshire, Ohio, South Carolina, and Virginia.