New York Department of Financial Services Issues Guidance Regarding Life Insurers’ Use of External Consumer Data in Underwriting

Feb 20 2019

Stephanie H. Dobecki, Andrew Holland and Blake T. Vettel

On January 18, 2019, the New York State Department of Financial Services (NYDFS) issued Circular Letter 2019-1 (the Circular Letter), addressing insurers’ use of external consumer data and information sources in underwriting for life insurance. The Circular Letter follows an investigation commenced by NYDFS regarding life insurers’ use of external data, which was initiated in light of reports that insurers were using algorithms and predictive models that include unconventional sources or types of external data. Among other things, the Circular Letter provides guidance that when insurers use external data sources in connection with underwriting decisions, (1) the use of external data sources must not result in any unlawful discrimination, (2) the underwriting or rating guidelines must be based on sound actuarial principle; and (3) life insurers must have adequate consumer disclosures to notify insureds or potential insureds of the right to receive the specific reasons for any adverse underwriting decision based on such data.

Artificial Intelligence, Big Data, Financial Privacy, Insurance, U.S. State Law

Blockchain Technology: SEC Commissioner Peirce Presents an Opportunity to Rethink Regulation

Feb 18 2019

Lilya Tessler, Geoffrey F. Aronow, K. Braeden Anderson and Daniel Engoren

On February 8, 2019, U.S. Securities and Exchange (SEC) Commissioner Hester Peirce delivered a speech addressing the relationship between technological innovation and regulation, in particular addressing some of the pending regulatory challenges surrounding blockchain and digital assets.¹The key takeaways from Commissioner Peirce’s speech, titled “Regulation: A View From Inside the Machine,” ² are these:

FinTech, Policy, SEC

Health Sector Council Released Cybersecurity Recommendations for Medical Devices and Health IT

Feb 14 2019

Nancy K. Stade and Kate Heinzelman

On January 28, 2019, the Healthcare and Public Health Sector Coordinating Council released the “Medical Device and Health IT Joint Security Plan” (“JSP” or “Plan”)—cybersecurity recommendations for medical device manufacturers, healthcare information technology vendors, and healthcare providers. U.S. Government entities, including the FDA, participated in the development of the Plan. The JSP comes close on the heels of the “Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients,” a similar effort by a public-private partnership to provide cybersecurity guidance to healthcare industry stakeholders.

DHS, FDA, Health Privacy, HHS, Legislation, Policy

Takeaways From CCPA Public Forums

Feb 12 2019

Christopher Fonzone and Sheri Porath Rockwell

When California Governor Jerry Brown signed the California Consumer Privacy Act (CCPA) into law on June 28, 2018, there was broad agreement that revisions and clarifications were necessary. The CCPA was written and enacted with extraordinary speed, as legislators felt the need to move quickly in order to preempt a data privacy ballot initiative that had received enough signatures to be placed on California’s November ballot. Consequently, June 28 was, in many ways, the beginning of a debate over the specifics of the CCPA, rather than the end. Indeed, the California legislature has already passed a “clean-up” bill to address concerns expressed about the CCPA, and heated debates over the meaning and merits of specific provisions continue.

California, Policy, U.S. State Law

Michigan Adopts National Association of Insurance Commissioners’ (NAIC) Insurance Data Security Model Law

Feb 11 2019

Thomas D. Cunningham and Shay Banerjee

On December 28, 2018, Michigan adopted the National Association of Insurance Commissioners’ (NAIC) Insurance Data Security Model Law in the form of Michigan H.B. 6491 (Act). By doing so, Michigan joins Ohio and South Carolina as the third state to adopt the Model Law and the fifth state – along with Connecticut and New York – to have enacted cybersecurity regulations focused on insurance companies. See CT Gen Stat § 38a-999b (2015); 23 NYCRR 500. (Please see our prior coverage for more information on Ohio and South Carolina’s adoption of the Model Law). Moreover, adoption of the Model Law is still gaining steam with Rhode Island potentially next in line.

Cybersecurity, Data Breaches, Enforcement, Financial Privacy, Information Security, Insurance, Legislation, U.S. State Law

First Multistate HIPAA Data Breach Lawsuit May Signal Increased State Interest in Data Security Enforcement

Feb 06 2019

Colleen Theresa Brown and Britney Alexandrea Garr

On December 3, 2018, twelve attorneys general (“AGs”) jointly filed a data breach lawsuit against Medical Informatics Engineering and its subsidiary, NoMoreClipboard LLC (collectively “the Company”), an electronic health records company, in federal district court in Indiana. See Indiana v. Med. Informatics Eng’g, Inc., No. 3:18-cv-00969 (N.D. Ind. filed Dec. 3, 2018). The suit—led by Indiana Attorney General Curtis Hill—is joined by AGs from Arizona, Arkansas, Florida, Iowa, Kansas, Kentucky, Louisiana, Minnesota, Nebraska, North Carolina and Wisconsin. While state AGs have previously exercised their civil enforcement authorities under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), this is the first multi-state data breach lawsuit alleging HIPAA violations in federal court and may signal increased interest on the part of state officials in exercising their data protection authorities to address cybersecurity incidents.

Cybersecurity, Data Breaches, Data Security, Enforcement, Health Privacy, HIPAA

New York Department of Financial Services Issues Guidance Regarding Life Insurers’ Use of External Consumer Data in Underwriting

Blockchain Technology: SEC Commissioner Peirce Presents an Opportunity to Rethink Regulation

Health Sector Council Released Cybersecurity Recommendations for Medical Devices and Health IT

Takeaways From CCPA Public Forums

Michigan Adopts National Association of Insurance Commissioners’ (NAIC) Insurance Data Security Model Law

First Multistate HIPAA Data Breach Lawsuit May Signal Increased State Interest in Data Security Enforcement

Categories

Archives

Contacts

Upcoming Events

Women in Privacy