Insurance Data Security Model Law #668: 250 consumers, 72 hours

The Insurance Data Security Model Law, number 668 in the NAIC's catalogue, is the model statute the state insurance regulators adopted in the fourth quarter of 2017 to set "standards for data security and standards for the investigation of and notification to the Commissioner of a Cybersecurity Event". It requires every licensee, from a large insurer to a one-person agency, to keep a written information security program and an incident response plan, to investigate any event that may have happened, and to notify the commissioner no later than 72 hours from determining that a cybersecurity event occurred: the home state's commissioner always, and another state's when 250 or more of its residents are involved and the event is either reportable to another government body or likely to cause material harm. A model is not law until a state enacts it; the NAIC's Summer 2026 state page lists 28 jurisdictions that have.

The notice is the part of the model that turns an incident into deadlines, and it is the part Botminds' Data Breach Notification Management is built around: AI agents read the vendor's notice and the forensic report, work out which commissioners are owed a notice under each adopting state's text, and draft each notice with the thirteen items the model asks for, each tied to its source, for counsel to sign. Examples on this page come from its fictional sample incident, a ransomware attack on the vendor that scans Wrenfield Mutual's claims mail.

What is the Insurance Data Security Model Law?

It is a thirteen-section model act that a state can enact, usually as an "Insurance Data Security Act" in its insurance code; South Carolina's, for instance, "may be cited as the 'South Carolina Insurance Data Security Act'". Its sections run from definitions, through the information security program (section 4), the investigation of an event (5) and notification (6), to the commissioner's powers, confidentiality, exceptions and penalties. It creates no private right to sue and does not take one away.

The model was written with New York in view. New York's cybersecurity regulation for financial services companies had taken effect on 1 March 2017, and the model carries a drafting note: "The drafters of this Act intend that if a Licensee, as defined in Section 3, is in compliance with N.Y. Comp. Codes R. & Regs. tit.23, § 500, Cybersecurity Requirements for Financial Services Companies, effective March 1, 2017, such Licensee is also in compliance with this Act." New York has not adopted the model, and its regulation has since been amended, so the two have drifted; how far is set out below.

Who must comply, and who is left out

The model applies to every "Licensee", defined as "any Person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered pursuant to the insurance laws of this State". That reaches insurers, producers, adjusters and other licensed entities. It leaves out a purchasing group or risk retention group chartered and licensed in another state, and a licensee acting as an assuming insurer domiciled elsewhere.

The exceptions are narrower than they look, because they excuse the security program, not the notice. A licensee with fewer than ten employees, counting independent contractors, is exempt from section 4. A licensee that keeps a HIPAA information security program and certifies its compliance is treated as meeting section 4. An employee or agent covered by another licensee's program need not build its own. None of the three exceptions touches section 6: a small agency still notifies its commissioner within 72 hours.

The insurance data security model law defines "commissioner" as what?

The model defines the commissioner as "the chief insurance regulatory official of the state", which is why an adopting state's text replaces the word with its own title: South Carolina's act notifies "the director", Minnesota's the commissioner of commerce or of health, whichever regulates the licensee. A notice addressed to the wrong office is a notice the right office did not receive.

Three more definitions decide whether anything is owed. A "Consumer" is an individual resident of the state whose nonpublic information the licensee holds, including "applicants, policyholders, insureds, beneficiaries, claimants, and certificate holders". "Nonpublic Information" covers business information whose disclosure would materially harm the licensee, identifying information combined with a Social Security, licence, account or biometric number, and any health information from a provider or the consumer, other than age or gender. And a "Cybersecurity Event" is "an event resulting in unauthorized access to, disruption or misuse of, an Information System or information stored on such Information System".

The health prong matters for insurers more than any other. Claim files are full of health information, and many state breach laws do not count it. Under the model it counts toward a state's 250 consumers even when the same people are not owed a letter under that state's breach law, so a commissioner's count and a residents' count can differ for the same state in the same incident.

What is a reportable cybersecurity event?

An event is reportable to a commissioner when the licensee has determined it occurred and one of the section 6.A criteria is met: the state is the licensee's home state, or 250 or more of the state's residents are involved and the event is either reportable to another government body or reasonably likely to cause material harm. Two kinds of incident are not events at all: encrypted data taken without its key, and data the licensee has determined was not used or released and was returned or destroyed.

Two readings of the table cause most errors. The first is treating 250 as a count of letters. It is a count of consumers whose nonpublic information was involved, health information included. The second is treating the harm test as a reason not to notify the home state. Section 6.A(1) has no harm test and no count: if a cybersecurity event has been determined, the domiciliary commissioner hears of it.

In the sample incident the line fell exactly where the model draws it. Eight commissioners were owed a notice. Delaware's was not: only 174 Delaware residents were in the files, under the 250 threshold, and Delaware was not Wrenfield's home state. Those 174 people were still owed letters under Delaware's breach law within 60 days.

The thirteen items the commissioner asks for

The notice is to provide "as much of the following information as possible", in electronic form as the commissioner directs. The items are not optional; "as possible" recognises that some are unknown at 72 hours. A licensee that gathers them as the investigation runs can file a complete first notice, and one that waits for a final forensic report cannot file at all.

The confidentiality rule is worth knowing before drafting. The model protects the items that describe how the breach happened and what the insurer found and fixed, and leaves the date, the data elements, the consumer count, the privacy policy and the contact outside the protection. Drafters can write the protected items with the detail an examiner needs, and keep the unprotected ones factual.

The duty to keep the commissioner's notice current

The first notice is the start of a conversation, not the end of one. The model gives the licensee "a continuing obligation to update and supplement initial and subsequent notifications", asks for the best estimate of affected consumers in the first report with the estimate updated in each later one, and requires a copy of the consumer notice sent under the state's breach law to go to the commissioner whenever the commissioner was owed a notice.

In the sample incident all eight commissioners were told 46,900 people on 23 and 24 September. The data review of 9 October found 48,016. The update was drafted for counsel's signature, and the copies of each state's letter followed as the batches were mailed. A plan that treats the commissioner notice as done once filed will miss both.

Vendors, reinsurers and producers

The model handles three relationships specially. An event at a vendor is treated as the licensee's own, with deadlines starting the day after the vendor's notice or when the licensee otherwise knew, whichever is sooner; and nothing in the model prevents the licensee from agreeing with the vendor that the vendor will carry out the investigation or the notices. A reinsurer that suffers an event involving data it holds without a direct relationship with the consumers notifies its affected ceding insurers and its home commissioner within 72 hours, and the ceding insurers carry out the consumer notices. An insurer whose affected customers bought through independent producers notifies the producers of record as the commissioner directs.

The vendor rule is the one that most often surprises. It can start an insurer's clock before the insurer has decided anything, and it is the reason a vendor contract's notice period matters as much as its security terms. How it interacts with the residents' clocks is set out in the insurer's two clocks.

The information security program behind the notice

Section 4 is the larger part of the model, and it is what an examiner reads first after a breach. It requires a written information security program based on a risk assessment, a designated person responsible for it, safeguards chosen from a list that includes access controls, encryption in transit and on portable devices, multi-factor authentication and audit trails, annual written reporting to the board, due diligence over vendors and an incident response plan covering seven defined areas. Each insurer domiciled in an adopting state certifies its compliance to its commissioner every year by February 15, and keeps the records behind the certificate for five years.

The model gave licensees one year from a state's effective date to implement section 4 and two years for the vendor oversight provisions. For the 28 jurisdictions on the NAIC's list, the earliest enactments date from 2018, so most adopters' insurers have been certifying for years. Which states those are, and how they changed the text, is on the page on adoption.

NAIC model law 668 compared with New York's Part 500

The model and New York's regulation share the 72 hours and much of the vocabulary, but since New York's 2023 amendment they differ in what is reportable, what starts the clock and who signs the certificate. A multi-state insurer licensed in New York runs both.

The table also shows why "compliant with one, compliant with the other" no longer holds without checking. Ransomware deployed within a material part of a company's systems is a reportable incident in New York even if no consumer's data was touched. Under the model the same attack is a cybersecurity event, since it disrupts a system, and so reportable to the home state; other states hear of it only if 250 of their residents' nonpublic information was involved.

The model law inside Data Breach Notification Management

In the solution each adopting state's version of the model is a row in counsel's rules, with its own clock, threshold and items, and the notification rules agent applies it to the incident's facts and counts. The notice drafter fills each of the thirteen items from a named source, such as a page of the forensic summary, the vendor's notice or the data review, so the counsel who signs can check every line against its evidence.

Commissioner notices with the 13 items, each with its source

The agents do not decide that an event has been determined, and they do not decide that a harm test is met in a state where the 250 count is reached; counsel does both, and records them. The sample incident's eight commissioner notices were signed by regulatory counsel and filed on 23 and 24 September. For the clock arithmetic, see the 72-hour breach notification requirements.

Questions people ask

Is the Insurance Data Security Act the same as the NAIC model law?

An Insurance Data Security Act is usually a state's enactment of the NAIC model, often under that name; the model itself is titled the "Insurance Data Security Law". Adopting states changed details, such as Delaware, Virginia and Iowa writing three business days instead of 72 hours, so the enacted text, not the model, is what applies.

What is NAIC model law 668?

It is the NAIC's Insurance Data Security Model Law, adopted in the fourth quarter of 2017 and technically edited in 2025. It sets information security program requirements for insurance licensees and a duty to notify the commissioner within 72 hours of determining a cybersecurity event.

Is the NAIC cybersecurity model law the same thing?

The NAIC model that governs cybersecurity at insurance licensees is #668, formally the Insurance Data Security Model Law. It covers both the security program and the notice to the commissioner.

Does the model law let consumers sue?

No. Section 2 says the act does not create or imply a private cause of action, and does not take away one that would otherwise exist. Enforcement is by the commissioner, under the state's general insurance penalty statute.

Are small insurance agencies exempt from the model law?

Partly. A licensee with fewer than ten employees, including independent contractors, is exempt from the information security program in section 4, but not from investigating an event or notifying the commissioner under sections 5 and 6.

Does a health insurer covered by HIPAA have to follow it?

A licensee that keeps a HIPAA information security program and certifies its compliance is treated as meeting section 4. The notification duties in section 6 still apply to it in an adopting state, alongside HIPAA's own breach notice rules.