Many states are enacting data breach notification laws, but Connecticut is the first state to have its insurance department get involved, enacting what is known as Bulletin IC-25. Wanting to know more about this recent development, I contacted Ed Goodman, chief privacy officer at Identity Theft 911. Below is our exchange:

What is Bulletin IC-25?

EG: On August 18, 2010, the Connecticut Insurance Department issued Bulletin IC-25. Bulletin IC-25 covers the handling of information security incidents that pose a potential risk to an individual’s personal health and/or financial information.

Is Connecticut the first state to issue such requirements for insurance companies doing business in the state?

EG: While CT already has data breach notification laws, this is the first time any state Insurance Department set out specific stringent breach requirements for insurance companies doing business in its state.

Why is this rule important?

EG: Insurance companies doing business in Connecticut must know how the rule affects them and what they are required to do if they suffer a data breach. Companies with BOP (business owner policies) need to know how the new law affects their business customers, so they can address concerns and meet their customers’ needs. While other states (California and Massachusetts) have been on the cutting edge of data breach regulations, Connecticut is the first to establish the insurance department in an active role in data breaches specifically in the insurance industry. Understanding breach regulations is crucial to every insurance company to:

*       Avoid sanctions or fines

*       Preserve goodwill with people who trust them with their personal data

*       Listening, then advising, educating and advocating protecting and restoring their identities

Do you see other states enacting the same sort of rule in the near future?

EG: Other state insurance departments will follow Connecticut. So all U.S. insurance companies should be prepared and knowledgeable, as well. The State of Connecticut Insurance Department’s Bulletin IC-25 is the beginning of a trend towards high scrutiny security incidents by regulators, especially in the insurance industry. Expect to see more departments following suit in the coming years.

The above article is reprinted from the Risk Management Monitor - the official blog of Risk Management magazine.