Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="alignright wp-image-5823" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2019/09/Maryland-state-house-GettyImages-180694827_1200x630_72dpi.jpg" alt="" width="438" height="230" />

On Aug. 29, 2019, the Maryland Insurance Administration (MIA) issued <a href="https://insurance.maryland.gov/Insurer/Documents/bulletins/19-14-Breach-of-Security-of-a-Computer-System-Notification-Requirement.pdf">Bulletin 19-14</a>. The purpose of the bulletin is to inform insurers, nonprofit health service plans, health maintenance organizations, managed care organizations, managed general agents and third-party administrators of a new security breach reporting requirement to the Compliance &amp; Enforcement Unit at the MIA.

Effective Oct. 1, 2019, pursuant to Insurance Article § 4-406, carriers are required to notify the insurance commissioner of a breach of the security of a system if the carrier (1) conducts an investigation required under § 14-3504(b) or (c) of the Commercial Law Article; and (2) determines that the breach of security of the system creates a likelihood that personal information has been or will be misused. The notice needs to be provided at the same time that the Maryland attorney general is notified pursuant to § 14-3504(h) of the Commercial Law Article.

The notice to the commissioner must include (1) a brief description of the circumstances of the security breach, (2) a copy of any notifications sent to consumers and (3) a copy of the notice submitted to the Maryland attorney general. The MIA has created an <a href="https://insurance.maryland.gov/Insurer/Documents/bulletins/Notice-of-Breach-of-Security-System-FORM.pdf">online form</a> that can be used to submit the notice.

The MIA has thus joined a growing number of insurance departments that have issued bulletins, guidance or regulations on reporting security breaches. <em>See our previous blog posts <a href="https://www.dataprivacymonitor.com/data-breach-notification-laws/state-data-breach-notification-requirements-specifically-applicable-to-insurers/">here</a> and <a href="https://www.dataprivacymonitor.com/state-legislation/insurance-data-security-model-law-picks-up-steam/">here</a>.</em>

Maryland Insurance Administration Issues Breach Notification Bulletin