Which laws or standards govern privacy and data security in insurance?

Which laws or standards govern privacy and data security in insurance?

• A. HIPAA, GLBA
• B. GLBA, state privacy laws, and cybersecurity standards; breach notification requirements may apply.
• C. FERPA and COPPA.
• D. No specific laws apply.

Answer: (C)

Privacy and data security in insurance are governed by a mix of federal and state laws and standards that regulate how financial information is collected, used, stored, and shared, as well as the steps insurers must take to protect data from cyber threats. The Gramm-Leach-Bliley Act sets expectations for financial institutions, including insurers, to safeguard nonpublic personal information and to provide customers with privacy notices. Many states have their own privacy laws that impose additional protections and breach notification requirements. Cybersecurity standards, whether from government bodies or industry groups, provide concrete technical benchmarks for securing data. Health information may fall under HIPAA if the insurer acts as a covered entity or business associate, but HIPAA isn’t the blanket rule for all insurance privacy. FERPA and COPPA address educational records and children's online privacy, not general insurance privacy. Therefore, the best-fit view is that GLBA, state privacy laws, and cybersecurity standards govern insurance privacy, with breach notification requirements potentially applying.

Privacy and data security in insurance are governed by a mix of federal and state laws and standards that regulate how financial information is collected, used, stored, and shared, as well as the steps insurers must take to protect data from cyber threats. The Gramm-Leach-Bliley Act sets expectations for financial institutions, including insurers, to safeguard nonpublic personal information and to provide customers with privacy notices. Many states have their own privacy laws that impose additional protections and breach notification requirements. Cybersecurity standards, whether from government bodies or industry groups, provide concrete technical benchmarks for securing data. Health information may fall under HIPAA if the insurer acts as a covered entity or business associate, but HIPAA isn’t the blanket rule for all insurance privacy. FERPA and COPPA address educational records and children's online privacy, not general insurance privacy. Therefore, the best-fit view is that GLBA, state privacy laws, and cybersecurity standards govern insurance privacy, with breach notification requirements potentially applying.