Insurance businesses would protect private data and report cyber incidents

Insurance businesses without an exemption would maintain written security programs based on their risks. Coverage includes D.C.-regulated insurers and insurance sellers. It excludes purchasing and risk retention groups chartered and licensed elsewhere, and reinsurers based elsewhere that insure other insurers. The programs would include safeguards for private information and computer systems, plus staff training updated as risks change. Exemptions from these program requirements would apply.

Eligible insurance businesses and licensed representatives could request exemptions from the security-program requirements. These exemptions apply to security-program requirements, rather than the separate incident investigation and reporting rules. Size exemptions cover fewer than 10 employees, counting contractors; under $5 million in D.C. premiums in each of the last three calendar years; or under $10 million in year-end assets recognized under insurance accounting rules, including affiliates’ assets. Other exemptions cover businesses maintaining security programs under HIPAA, the federal health privacy law, and certifying compliance, plus licensed representatives covered by another licensee’s program. Applicants would follow the regulator’s exemption-request rules. A business losing its exemption would have 180 days to comply.

Covered insurance businesses would promptly investigate suspected cyber incidents and notify the D.C. insurance regulator when reporting rules apply. The ordinary reporting rule covers insurers based in D.C. and insurance sellers whose home jurisdiction is D.C., along with certain incidents at other covered businesses. For other covered businesses, the ordinary reporting rule requires a reasonable belief that information involves at least 250 D.C. residents, plus another legally required report or likely substantial harm to a resident or business operations. The ordinary deadline starts when the business determines an incident occurred. For vendor systems, three days starts with vendor notice or actual knowledge, whichever comes first.

D.C. regulators would withhold covered security filings and investigation records from public records requests. Protection covers security-program and incident records submitted to regulators, plus information obtained through examinations or investigations. The protection would also block demands for these records directed to the Commissioner during lawsuits. It would not automatically shield records sought directly from a business or its agent in a private damages lawsuit.

D.C. insurance regulators could investigate violations and impose penalties. Regulators could examine covered insurance businesses; the stated daily fine applies to insurers. After notice and a hearing, an insurer violating the rules without just cause would owe up to $1,000 per day, capped at $25,000. Regulators could define just cause and establish other penalties through rules. The title would preserve existing rights to sue under other laws. The act would take effect following mayoral approval or a veto override and a 30-day congressional review period.