Disaster Planning, Preparedness and Response

NOTE: WITHDRAWN EFFECTIVE APRIL 16, 2007 Circular Letter No. 4 (2006) March 14, 2006 TO: All authorized life insurers, retirement systems, and fraternal benefit societies RE: Disaster Planning, Preparedness and Response STATUTORY REFERENCE: Sections 301, 305, and 308; and Articles 42, 45, and 46 of the New York Insurance Law This circular letter replaces and repeals Circular Letter No. 7 (2004) and applies to life insurers, retirement systems and fraternal benefit societies previously covered under Circular Letter No. 7 (2004). These companies -authorized life insurers, retirement systems and fraternal benefit societies- are hereafter referred to as "life companies" in this circular letter and its attachments. Disaster planning, preparedness and response of property/casualty and health companies originally covered under Circular Letter No. 7 (2004) were addressed in Circular Letter No. 14 (2005) and Circular Letter No. 23 (2005), respectively. A. History & Background - Circular Letter No. 11 (2001) In keeping with New York Governor George E. Pataki's mandate to anticipate potential problems for the citizens of New York State, Circular Letter No. 11 (2001), issued on May 10, 2001, was addressed to all property/casualty insurers licensed to do business in New York State and established the New York State Insurance Disaster Coalition (Insurance Disaster Coalition). The Insurance Disaster Coalition, a public private partnership, was created to “identify and organize specific Insurance Department and insurance industry resources to serve victims of natural disasters and other state emergencies.” In addition, the circular letter provided for the creation of the Insurance Emergency Operations Center (IEOC), which would be staffed by selected insurance industry disaster liaisons and representatives of the Insurance Department, to coordinate disaster response. As part of the disaster response effort Circular Letter No. 11 (2001) and its two supplements: Established an annual "Pre-disaster" report detailing property exposure information, by county, in the state; Indicated that companies should name "Insurance Company Disaster Liaisons" and provide their contact information to the Department; Issued a Disaster Response Questionnaire and asked property casualty insurers to submit a copy of their Disaster Response Plan to the Department; Created a method by which insurers could obtain "Insurance Adjuster Temporary Permits"; and Provided a mechanism for post-disaster reporting of claims data. B. Organization of this Circular Letter The following table is provided to enable all licensees to better understand what is required of them by this circular letter. Questions concerning any aspects of this circular letter should be addressed to Senior Insurance Examiner, Ashbert Carrington, of the Disaster Preparedness and Response Bureau, by phone at (212) 480-5340, by e-mail to [email protected] , or by US mail to State of New York Insurance Department, Disaster Preparedness and Response Bureau, 25 Beaver Street, New York, NY 10004. Section Title Page A History & Background – Circular Letter No. 11 (2001) 1 B Organization of this Circular Letter 2 C The New York State Insurance Disaster Coalition and the Insurance Emergency Operations Center (IEOC) 3 D Before a Disaster Strikes 4 D1 Disaster Response Plan and Questionnaire 4 D2 Business Continuity Plan Questionnaire 6 E Operations During a Disaster Insurance Company Disaster Liaisons 7 F After a Disaster Post Disaster Coverage Data and Loss Statistics 8 G Miscellaneous Items 9 G1 Confidentiality 9 G2 Communications Network 9 For the sake of clarity each section of this circular letter begins with a statement indicating the entities to which that section applies. C. The New York State Insurance Disaster Coalition and the Insurance Emergency Operations Center (IEOC) Section C applies to all addressees of this circular letter. When an emergency or disaster situation occurs, the Insurance Department is looked upon to provide the Governor and the State Emergency Management Office (SEMO) with critical information regarding the amount and extent of property losses, as well as other damage assessments. Based on this information the Governor determines whether and when to request a federal disaster declaration and how to prioritize the deployment of state assets. The insurance community, including the property, life and health sectors, has been identified as a key resource to providing early assessments of damages arising from natural or man-made disasters. Insurers play an important role in quantifying the magnitude of losses - insured and uninsured - and determining both the degree and duration of insurer response to losses. Accordingly, all entities addressed by this circular are expected to assist the Insurance Department in obtaining the information needed to accomplish the above objective -before, during and after disasters strike. An integral part of the Insurance Disaster Coalition response to any disaster is the Insurance Emergency Operations Center (IEOC) which will be staffed by selected insurance industry disaster liaisons and representatives of the Insurance Department, to coordinate disaster response. The Insurance Emergency Operations Center will be activated upon direction of the Superintendent of Insurance in accordance with the nature and extent of the event. Where possible this determination will be made in conjunction with our disaster coalition partners. D. Before a Disaster Strikes 1) Disaster Response Plan and Questionnaire Sections 1(a) and 1(b) on Disaster Response Plans and Questionnaires apply to all addressees of this circular letter. Each addressee is asked to incorporate the New York State Insurance Disaster Coalition procedures, into its own disaster response plan. Since the New York State Insurance Disaster Coalition procedures and the Insurance Emergency Operations Center (IEOC) continue to be, integral parts of the industry's response to any disaster in New York State, the completion of the electronic template and the submission of each insurer's disaster response plan are needed to maintain the effectiveness and accuracy of information used by the Coalition in the event of a future disaster. a) Disaster Response Plan The disaster response plan should describe how the entity intends to provide its policyholders with the resources they will need to recover from a disaster. To this end, a disaster response plan should at a minimum indicate what preparations the insurer has made in the following areas: Board of Director support for an "Emergency Preparedness Plan" Appropriate emergency response training of company personnel Plans for suitable expansion of claims handling capacity in a variety of disaster scenarios, including provisions to cover: adequate personnel catastrophe response team availability access to disaster areas and personnel identification applications for temporary adjuster permits Testing of the Emergency Response Plan Incorporation of the role of insurance company disaster liaisons, and their interaction with the New York State Department of Insurance. Please note that more detailed guidance on creating a Disaster Response Plan is provide in the attached appendix. Entities may provide their completed disaster response plans either electronically(as an e-mail attachment), by compact disk or diskette or by hand copy(if no electronic means are available). On June 1, 2006, and annually each June 1 st thereafter Disaster Response Plans submitted to the Insurance Department should be updated, if necessary. If no update is necessary, to a previously submitted Plan, an e-mail containing the Company Name(s), NAIC number(s), and NAIC Group number should be submitted to the Insurance Department Disaster Plans Mail box (see below) to indicate that no change to the plan was necessary. E-mails should be directed to the Insurance Department Disaster Response Plans Mail box at: [email protected] US Mail should be addressed to: State of New York Insurance Department Disaster Preparedness and Response Bureau DRP Unit, 5 th Floor 25 Beaver Street New York, NY 10004 b) Disaster Response Questionnaire The Disaster Response Questionnaire electronic template is not to be used in lieu of an insurer's own disaster response plan. Rather, the requested information is to be included in each insurer's own plan. The Disaster Response Questionnaire electronic template and instructions for its completion and submission can be found on the Insurance Department Web site at: http://www.ins.state.ny.us/dprcldoc.htm On June 1, 2006, and annually each June 1 st thereafter, the Disaster Response Questionnaire electronic template should be submitted to the Insurance Department. If none of the information has changed, from a previously submitted report, the date field should be updated and the previous electronic template(s) may be resubmitted. Insurance Company Disaster Liaisons - by completing the Disaster Response Questionnaire each insurer will be providing the Disaster Preparedness & Response Bureau the name of the designated disaster liaison(s), along with that person's telephone and cell phone number(s) (for during business and after business hours), email address and/or pager number, if applicable. Any change in the liaison(s) and/or contact information should be reported immediately to the Insurance Department, by the resubmission of an updated Disaster Response Questionnaire. Annually, on June 1 st , the Disaster Response Questionnaire electronic template should be submitted to the Insurance Department. If none of the information has changed, the date field should be updated and the previous electronic template(s) may be resubmitted. 2) Business Continuity Plan and Questionnaire This section D(2) on Business Continuity Plan Questionnaires applies to all addressees of this circular letter. To assure the Insurance Department that each addressee has taken steps to put in place a Business Continuity Plan that would reasonably ensure that the recovery of critical business processes could take place in the event of a disaster, each addressee is required to complete the Business Continuity Plan Questionnaire electronic template and attest to the accuracy of their answers. The Business Continuity Plan Questionnaire electronic template and instructions for its completion and submission can be found on the Insurance Department Web site at: http://www.ins.state.ny.us/dprcldoc.htm On June 1, 2006, and annually each June 1 st thereafter, the Disaster Response Questionnaire electronic template should be submitted to the Insurance Department. If none of the information has changed, from a previously submitted report, the date field should be updated and the previous electronic template(s) may be resubmitted. E. Operations During a Disaster Insurance Company Disaster Liaisons This section on Insurance Company Disaster Liaisons applies to all addressees of this circular letter. Upon the Insurance Department's activation of its IEOC due to a State Emergency Disaster situation, the Superintendent may activate designated Insurance Disaster Liaisons representing several of the largest underwriters in the emergency or disaster areas. Participating companies will be determined based on the previously described Pre-Disaster Reports. Disaster Liaisons will be contacted based upon information submitted in the Disaster Response Questionnaire. Subsequently, Liaisons should be prepared to participate in the State's Disaster Response Plan as follows: A teleconference of the selected disaster liaisons will be held, where possible, following the occurrence of a disaster – prior to the activation of the Department of Insurance Emergency Operations Center (IEOC) - to discuss the magnitude of the disaster and the scope of activation plans. Upon activation of the IEOC, Insurance Disaster Liaisons or their designees will be expected to staff the IEOC at either of its two locations: One Commerce Plaza, Albany, NY 12257; or 25 Beaver Street, New York, NY 10004. The Insurance Department will provide a fully equipped IEOC for Liaisons' use at either of the aforementioned locations. Included are analog data and voice telephone lines, along with videoconferencing links to the SEMO emergency operations center. The Insurance Department will continue to coordinate communications among company and association contacts through ongoing teleconference calls to plan staffing of the IEOC for the actual or threatening (as in the case of hurricanes) emergency; individually discuss with each insurer's liaison the company's catastrophe operations; individually review each insurer's response plans; and discuss catastrophe operations and emerging issues. Liaisons may be expected to remain on duty at the IEOC as determined by the Superintendent of Insurance acting in consultation with coalition partners. Liaison Duties and Responsibilities Liaisons should: Have a qualified back up. Both will preferably be members of the insurer's catastrophe team, or a manager-level employee, who are familiar with company protocols and have access to critical information. Provide coverage data and loss statistics as requested by the Insurance Department. Transmit information on the disaster from the insurance industry to emergency response officials and also back to other industry representatives. Be authorized and knowledgeable in company internal information systems and sources, and authorized to access such systems so that applicable, timely information can be provided to SEMO/NYC OEM and other emergency responders via the Insurance Department. Be prepared to remain on duty during the hours when the Emergency Operation Center is operating, normally from 7:00 a.m. to 6:00 p.m., or for such time periods as necessary to assist with the effective management of the disaster. Depending on the level of the disaster this may be a seven-day a week commitment. F. After a Disaster Post Disaster Coverage Data and Loss Statistics This section on Post Disaster Coverage Data and Loss Statistics applies to all addressees of this circular letter. Depending on the type of emergency encountered, in the ensuing days after a disaster, Liaisons will be required to provide specific statistics from each insurer. These statistics will be periodically updated on an as needed basis, but not less than monthly. Reports will be consolidated by Insurance Department staff for submission to SEMO and the Governor's office only. G. Miscellaneous Items This section on Miscellaneous Items applies to all addressees of this circular letter. 1) Confidentiality All of the above reports and statistics are to be compiled and summarized by Insurance Department personnel for internal Insurance Department use. Reports submitted to SEMO and the Governor will be on an aggregate basis with no individual company information identified in those reports. At the time of submission, an insurer should request an exception from disclosure under Section 89(5) of the Public Officers Law (Freedom of Information Law- FOIL) for any information or reports that it submits to the Insurance Department that it believes are trade secrets or commercial information that, if disclosed, would cause substantial injury to its competitive position. In the event that a request is received by the Insurance Department for the release of information pursuant to FOIL and the insurer requested an exception from disclosure upon submission, the insurer will be notified and given the opportunity to respond to the Insurance Department in accordance with FOIL and Regulation 71 (11 NYCRR 241.6). 2) Communications Network Insurance industry representatives of the NYS Insurance Disaster Coalition are requested to provide the Insurance Department with Internet links of not-for-profit web sites that are beneficial to the public before, during and after a disaster. Your cooperation in furnishing timely and accurate responses is essential to the success of the New York State Insurance Disaster Coalition and is appreciated by the Insurance Department and the people of New York State. Very truly yours, ______________________ Howard Mills Superintendent of Insurance Appendix Additional Guidance on Formulating/Maintaining a Disaster Response Plan "LIFE COMPANIES" (As noted earlier, the term "life companies" as used in this document refers to all authorized life insurers, retirement systems and fraternal benefit societies.) If your Disaster Response Plan provides answers to the following questions, it will generally have met the Disaster Preparedness and Response Bureau's best practices standards for a "Life Company’s" Disaster Response Plan ( Plan ). Your Plan should describe how you intend to provide your policyholders, certificateholders, claimants and beneficiaries (herein "customers"), with the assistance they will need to maintain coverage, seek assistance from the company, file claims, and obtain loans and other policyholder services in a disaster situation that affects customers. The Department recognizes that the size, lines of business, corporate structure and location of life companies’ operations in New York varies greatly, as does their particular need for and capacity to implement Plans . Therefore, this Appendix describes, "best practices", some of which may be appropriate only to certain companies, but which all companies should evaluate as they construct and assess their Plans . The Department will evaluate the Plan of each "life company" on its own merits, using Circular Letter No. 4 (2006) and this Appendix as a guide. REQUIREMENTS The Department fully expects each "life company" to perform a risk-based analysis of its capacity to serve its customers in the event that a disaster affects large numbers of its customers. The Department expects each company to establish, maintain and update a Plan that responds to the risk-based analysis performed as required above. If a company already has a Plan or Plans , it should be prepared to explain the elements of its Plan in terms of the risks perceived by the company and how the Plan responds to those risks. APPLICABILITY The Department is aware that certain of its "life companies" are wholly owned subsidiaries of other "life companies" or are members of groups composed of other than "life companies". This tier of companies may be included in the Plan of the parent company. In such cases, the subsidiary should be prepared to demonstrate to the Department that 1) the parent's Plan specifically provides for the needs of the subsidiary and its customers, 2) the parent's Plan has specific application to the subsidiary in the case where only the subsidiary is affected by a disaster, and 3) the parent's Plan provides for the continued operation and service to customers of the subsidiary in the event that the operations of the parent, and not the subsidiary, are affected by a disaster. If the parent's Plan does not cover the subsidiary, or if in the Department's judgment the parent's Plan , as applied to the subsidiary, is inadequate, the subsidiary is required to develop and implement its own Plan in compliance with Circular Letter No. 4 (2006). In addition, smaller companies located in one geographic area of the state may find it cost effective to pool their resources in establishing shared Plan facilities, such as communications equipment, and alternate worksites. The Department encourages this kind of innovative and cooperative approach, and such an approach would be acceptable provided that: 1) the separate management and operational conduct of each company is maintained, 2) no confidential customer, policyholder or claimant financial or health information is disclosed to another party without appropriate consent, and 3) the security of all company information is separately protected, in compliance with Regulations 152, 169 and 173. Sharing of administrative or processing systems is not contemplated by this paragraph. Circular Letter No. 4 (2006) applies to all authorized "life companies" that sell or administer: individual or group life insurance, individual or group annuities, long term care insurance, or individual or group disability income insurance. Circular Letter No. 23 (2005). applies to companies selling medical or health care insurance policies only. Companies that sell both life and medical/health care insurance should respond to the questions in the relevant portions of the Appendix to Circular Letter No. 23 regarding medical insurance and this Appendix with regard to life insurance and related products. Companies selling both life and medical/health care insurance are encouraged to contact the Department if they have questions on how to prepare or report on their combined or separate Plans . ELEMENTS OF DISASTER RESPONSE PLANS The elements of a Plan are contained in the answers to the following questions in this, Appendix which is attached to and which is a part of Circular Letter No. 4 (2006). The Department expects each company to establish and maintain a Plan that considers and is responsive to all of these elements, subject to the qualifications described in this Appendix with regard to "best practices" and the distinctions that can be made for certain subsidiaries and smaller companies. Company/Group Characteristics: 1. What is the company/group's license status (domestic, foreign etc.)? 2. Does the company/group share or participate with an affiliate, parent company or another company's disaster response Plan ? 3. What is the company/group's most recent premium volume? (See Exhibit 1, line 20.1, Col 1-total direct premiums and annuity considerations-of the Company's Annual Statement.) 4. Where is the company's main administrative office location? 5. Where are the company's administrative offices which handle the following claims, requests and payments for New York residents located? (Please specify county and state of office and specify individual or group, where applicable) a. death claims; b. cash value surrenders/withdrawals; c. policy loans; d. changes to annuity payouts or separate account transfers; e. other policy or contract changes; f. premium payments 6. What types of products are sold or administered by the company/group? Management Oversight: 1. Does the Company have a Plan ? 2. Is it a written Plan ? 3. Has the Plan been reviewed and approved by: a) Senior Management? b) Board of Directors or a committee thereof? 4. Has a resolution been adopted by the Board of Directors, or a committee thereof, attesting to the approval of the Plan ? 5. Has Management identified additional, or alternative, dedicated resources that may be needed during a disaster? (For example, telephones, server capacity and staff.) 6. Is there a person/titled position or positions designated and charged with responsibility for formulating, activating and coordinating the conduct of the Plan ? 7. Is there a person/titled position named as being responsible for monitoring and testing the Plan ? 8. Is there a person/titled position named as being responsible for terminating the activation of the Plan following a disaster? General Information: 1. Does the company/group have a methodology for identifying a disaster, and the levels thereof, that require activation of all or parts of the Plan ? 2. Are there guidelines that help to determine the need for activation of one or more parts of the Plan ? 3. Has the company/group formed a disaster response team? 4. Are the responsibilities of the disaster response team members defined in order to establish areas of responsibility and reporting authority? 5. Does the Plan provide for training of staff in order to prepare them in their responsibilities in the case of varying levels of disasters that activate various parts of the Plan ? Policyholder and Claimant (Customer) Services: 1. Does the Plan explain what steps the company has taken to ensure timely responses to customers for such requests as: a. death claims; b. lost policy or contract; c. cash value surrenders/withdrawals; d. policy loans; e. changes to annuity payouts or separate account transfers; f. extended grace periods for payment of premiums; g. temporary or permanent changes of contact information; h. access to an agent or policyholder representative? 2. Has Management provided for additional or alternative claims and policyholder service handling capacity and procedures (system or personnel) that might be needed during the activation of the Plan ? 3. If the company/group uses a Third Party Administrator (TPA), Managing General Administrator (MGA), etc. for claims processing; has that TPA, MGA, etc. made plans to provide for additional or alternative claims and policyholder service handling capacity and procedures (system or personnel) that might be needed during the activation of the Plan ? External Communication: 1. Does the Plan explain what steps will be taken to notify, in a timely manner, its customers of any procedural changes? 2. Does the Plan describe how your company communicates with, and responds to, employees of a group located in state, when the employer is out of state during a disaster (for example, the employer is in New Orleans, and the employee is in NY)? 3. Does the Plan describe how your company communicates with, and responds to, employees of a group located out of state, when the employer is in state during a disaster (for example, the employee in New Jersey, and the employer is in NY)? Producer Relations: 1. Does the Plan explain what steps will be taken to notify, in a timely manner, the company's producers of any procedural changes made in response to a disaster? 2. Does the Plan provide for alternative communication links with producers affected by the disaster? 3. Does the Plan provide for alternative facilities/equipment for producers (who are normally supplied with facilities and equipment by the company) who are affected by the disaster? 4. Does the Plan provide for backup record keeping systems for producers (whose records are normally maintained by the company) who are affected by the disaster? Fraud Detection: 1. Does the Plan include any additional procedures for detecting fraud in the event that normal antifraud programs are unavailable or impaired by the disaster? 2. Does the Plan include specific additional procedures to detect and prevent fraud that may be attempted as a result of the disaster? 3. Does the Plan include procedures for reporting fraudulent activity to the appropriate regulatory authorities? Testing of Plan: 1. Has the Plan been tested? 2. Does the Plan indicate how often the Plan will be tested? 3. Did the testing include the use of an alternate site for information technology (IT) systems?