Insurance Data Security Law

Springfield Office 320 W. Washington Street Springfield, Illinois 62767 (217) 782-4515 Chicago Office 122 S. Michigan Ave., 19th Floor Chicago, Illinois 60603 (312) 814-2420 Illinois Department of Insurance JB PRITZKER Governor DANA POPISH SEVERINGHAUS Director To: All Companies Licensed in Illinois From: Dana Popish Severinghaus, Director of Insurance Date: March 22, 2024 Re: Company Bulletin 2024-10 Insurance Data Security Law The purpose of this Bulletin is to notify companies of new requirements for all insurance companies licensed in Illinois under Public Act 103-0142 the Illinois Insurance Data Security Law, which took effect January 1, 2024. Initial Notification of Cybersecurity Event to Department If a company experiences a cybersecurity event, the company must notify the Department by email at DOI.DataSecurity@illinois.gov within three business days after a determination a cybersecurity event has occurred. Such notification must meet all the data requirements of 215 ILCS 215/20 possible and the impacted company has a continuing obligation to update the Department regarding material changes to previously provided information. Initial notification of a cybersecurity event to the Department shall include as much of the following information as possible: 1. the date of the cybersecurity event; 2. a description of how the information was exposed, lost, stolen, or breached, including the specific roles and responsibilities of third-party service providers, if any; 3. how the cybersecurity event was discovered; 4. whether any lost, stolen, or breached information has been recovered and if so, how it was recovered; 5. the identity of the source of the cybersecurity event; 6. whether the company has filed a police report or has notified any regulatory, government, or law enforcement agencies and, if so, when such notification was provided; 7. a description of the specific types of information acquired without authorization, including types of medical information, types of financial information, or types of information allowing identification of the consumer; Springfield Office 320 W. Washington Street Springfield, Illinois 62767 (217) 782-4515 Chicago Office 122 S. Michigan Ave., 19th Floor Chicago, Illinois 60603 (312) 814-2420 8. the period during which the information system was compromised; 9. the number of total Illinois consumers affected by the cybersecurity event (best estimate). Update this estimate with each subsequent report to the Director; 10. the results of any internal review identifying a lapse in either automated controls or internal procedures, or confirming that all automated controls or internal procedures were followed; 11. a description of efforts being undertaken to remediate the situation which permitted the cybersecurity event to occur; 12. a copy of the company’s privacy policy and a statement outlining the steps the company will take to investigate and notify consumers affected by the cybersecurity event; and 13. the name of a contact person who is both familiar with the cybersecurity event and authorized to act for the company. Companies must conduct their cybersecurity investigation in accordance with Section 15 of the Insurance Data Security Law. 215 ILCS 215/15. This notification requirement is in addition to all reporting requirements under the Illinois Personal Information Protection Act. 815 ILCS 530/1 et seq. Annual Certification of Compliance Filing Companies must submit their annual certification of compliance with Section 10 of the Illinois Insurance Data Security Law 215 ILCS 215/10 by April 15, 2025. These should be submitted by email at DOI.DataSecurity@illinois.gov. A sample template is shown as Appendix A below. Companies seeking an exemption from the requirements of Section 10 and Section 15 pursuant to the Section 35(a)(2) exemption (pertaining to federal regulation), “the licensee must submit an annual statement by April 15 certifying its compliance with the applicable provisions of federal law referenced in this paragraph.” 215 ILCS 215/35(a)(2) must submit the exemption requests by April 15, 2024, and annually thereafter. Questions about this Bulletin should be directed to DOI.DataSecurity@illinois.gov. Springfield Office 320 W. Washington Street Springfield, Illinois 62767 (217) 782-4515 Chicago Office 122 S. Michigan Ave., 19th Floor Chicago, Illinois 60603 (312) 814-2420 Appendix A Annually, an insurer domiciled in Illinois shall submit to the Director a written statement by April 15 certifying that the insurer is in compliance with the requirements set forth in this Section. Each insurer shall maintain for examination by the Department all records, schedules, and data supporting this certificate for a period of 5 years. To the extent an insurer has identified areas, systems, or processes that require material improvement, updating, or redesign, the insurer shall document the identification and the remedial efforts planned and underway to address such areas, systems, or processes. The documentation of identified areas, systems, or processes must be available for inspection by the Director. I certify that Company Name is in compliance with the requirements set forth in Section 10 of the Illinois Insurance Data Security Law 215 ILCS 215/10. We have identified the following areas, systems, or processes that require material improvement, updating, or redesign. Documentation of the identification and the remedial efforts planned and underway to address such areas, systems, or processes are included below. ____________________________________________________________________________________ ____________________________________________________________________________________ ____________________________________________________________________________________ ____________________________________________________________________________________ ____________________________________________________________________________________ ____________________________________________________________________________________ ____________________________________________________________________________________ ____________________________________________________________________________________ Name: __________________________________________ Title: __________________________________________ Signature: __________________________________________ Date: __________________________________________