Careers

Diversity

With 17 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Services

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

Ohio Clock

Hallway with a grandfather clock displayed

Congress Faces Pre-election Budget Vote to Avoid Government Shutdown

Senate Passes Kids Online Safety Measure But House Passage Unclear

Current State of U.S. Economic Sanctions Imposed in Response to Russia’s Invasion of Ukraine – August 29, 2024

Current State of U.S. Export Controls in Response to the Russian Federation’s Invasion of Ukraine – August 29, 2024

<figure class="wp-block-image alignright size-large is-resized"><img decoding="async" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2022/04/DADM_GettyImages-1279905459_1200x630-662x348.jpg" alt="" class="wp-image-6977" width="428"/></figure>



Kentucky became the latest state to adopt the NAIC insurance data security model law with Governor Andy Beshear’s signing of <a href="https://apps.legislature.ky.gov/recorddocuments/bill/22RS/hb474/bill.pdf">House Bill 474</a>. The new law goes into effect Jan. 1, 2023, and gives covered licensees one or two years for implementation, depending on the specific provision. Like many other states, Kentucky enacted the law with some variations to the model law. One notable difference is Kentucky’s reporting requirements for a “cybersecurity event.” Under the new law, a “cybersecurity event” is “an event resulting in unauthorized access to, disruption of, or misuse of an information system or nonpublic information stored on an information system.” Here, for an insurer domiciled in Kentucky, notification to the insurance commissioner is required if the cybersecurity event “has a reasonable likelihood of harming any material part of normal operations of the licensee.” Additionally, for an insurance producer whose home state is Kentucky, notice of a cybersecurity event is required without any qualification.



This is a continuation of a trend begun with the NYDFS regulation that requires licensees to report cybersecurity events to NYDFS under similar circumstances. More regulators are moving toward frameworks that require covered organizations to report incidents that do not necessarily impact personal or nonpublic information.



For licensees who are not domiciled in Kentucky, the reporting trigger occurs where the cybersecurity event involves the nonpublic information of 250+ Kentucky residents and one or both of the following: the licensee is required to notify another regulator under state or federal law, and the event has a reasonable likelihood of materially harming any Kentucky consumer or a material part of the normal operations of the licensee.



Like other insurance data security laws, Kentucky’s new law also requires covered licensees to, among other things, implement a written information security program, conduct risk assessments, enact appropriate data security measures, and require third-party service providers to implement appropriate measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the third-party service provider. Licensees with fewer than 50 employees, including independent contractors, are exempt from most of these requirements, including reporting requirements. In joining the nearly 30 other states with an insurance data security law, Kentucky is the latest state to enact cybersecurity and reporting requirements for entities operating in a regulated industry. This new law and its nuances highlight the patchwork of state laws that impose similar obligations on insurance, mortgage, and other heavily regulated industries.

Kentucky Joins Nearly 30 States by Enacting an Insurance Data Security Law

Featured Insights

Related Services

Featured Insights