Ind. Code § 27-2-27-1 Applicability of chapter
Sec. 1. This chapter applies after June 30, 2021.
As added by P.L.130-2020, SEC.10.
Ind. Code ch. 27-2-27
Ind. Code ch. 27-2-27
in effectInd. Code § 27-2-27-2 "Authorized individual"
Sec. 2. As used in this chapter, "authorized individual" means an individual authorized by the licensee to have access to the nonpublic information held by the licensee and its information systems.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-3 "Commissioner"
Sec. 3. As used in this chapter, "commissioner" refers to the insurance commissioner appointed under IC 27-1-1-2.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-4 "Consumer"
Sec. 4. As used in this chapter, "consumer" means a resident of Indiana whose nonpublic information is in a licensee's possession, custody, or control.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-5 "Cybersecurity event"
Sec. 5. As used in this chapter, "cybersecurity event" means an event resulting in unauthorized access to or a disruption or misuse of an information system or nonpublic information stored on the information system that has a reasonable likelihood of materially harming a consumer or any material part of the normal operations of the licensee. However, the term does not include the following:
(1) The unauthorized acquisition of encrypted nonpublic information if the encryption, process, or key is not also acquired, released, or used without authorization.
(2) An event in which a licensee has determined that the nonpublic information accessed by an unauthorized person has not been used or released and has been returned or destroyed.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-6 "Department"
Sec. 6. As used in this chapter, "department" means the department of insurance created by IC 27-1-1-1.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-7 "Encrypted"
Sec. 7. As used in this chapter, "encrypted" means the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-8 "Information security program"
Sec. 8. As used in this chapter, "information security program" means the administrative, technical, and physical safeguards that a licensee uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle nonpublic information.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-9 "Information system"
Sec. 9. As used in this chapter, "information system" means either of the following:
(1) A discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of nonpublic information.
(2) Any specialized system, such as industrial or process control systems, telephone switching systems, private exchange systems, and environmental control systems.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-10 "Licensee"
Sec. 10. (a) As used in this chapter, "licensee" means a person that is:
(1) licensed, authorized to operate, or registered; or
(2) required to be licensed, authorized to operate, or registered;
under this title and the rules adopted under this title.
(b) The term does not include any of the following:
(1) A purchasing group or risk retention group that is chartered and licensed in another state.
(2) A person that is:
(A) acting as an assuming insurer; and
(B) domiciled in a state or jurisdiction other than Indiana.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-11 "Multi-factor authentication"
Sec. 11. As used in this chapter, "multi-factor authentication" means authentication through verification of at least two (2) of the following types of authentication factors:
(1) Knowledge factors, such as a password.
(2) Possession factors, such as a token or text message on a mobile phone.
(3) Inherence factors, such as a biometric characteristic.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-12 "Nonpublic information"
Sec. 12. As used in this chapter, "nonpublic information" means electronic information that is not publicly available information and is described in either of the following subdivisions:
(1) Any information concerning a consumer, which because of name, number, personal mark, or other identifier can be used, in combination with any one (1) or more of the following data elements, to identify the consumer:
(A) Social Security number.
(B) Driver's license number or nondriver identification card number.
(C) Financial account number, credit card number, or debit card number.
(D) Any security code, access code, or password that would permit access to a consumer's financial account.
(E) Biometric records.
(2) Any information or data, except age or gender, in any form or medium created by or derived from a health care provider or a consumer that can be used to identify a consumer and relates to:
(A) the past, present, or future physical, mental, or behavioral health or condition of the consumer or a member of the consumer's family;
(B) the provision of health care to the consumer; or
(C) payment for the provision of health care provided to the consumer.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-13 "Publicly available information"
Sec. 13. As used in this chapter, "publicly available information" means any information that a licensee has a reasonable basis to believe is lawfully made available to the general public from:
(1) federal, state, or local government records;
(2) widely distributed media; or
(3) disclosures to the general public that are required to be made by federal, state, or local law.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-14 "Risk assessment"
Sec. 14. As used in this chapter, "risk assessment" means the assessment a licensee is required to conduct under section 17 of this chapter.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-15 "Third party service provider"
Sec. 15. As used in this chapter, "third party service provider" means a person that contracts with a licensee to maintain, process, store, or otherwise is permitted access to nonpublic information through its provision of services to the licensee.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-16 Information security program; requirements
Sec. 16. (a) A licensee shall develop, implement, and maintain a comprehensive, written information security program that:
(1) is based on the risk assessment required under section 17 of this chapter; and
(2) contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information systems.
(b) An information security program must accomplish the following:
(1) Protect the security and confidentiality of nonpublic information and information systems.
(2) Protect against any threats or hazards to the security or integrity of nonpublic information and information systems.
(3) Protect against unauthorized access to or use of nonpublic information and minimize the likelihood of harm to a consumer.
(4) Define and periodically reevaluate a schedule for retention of nonpublic information and a procedure for its destruction when no longer needed.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-17 Risk assessment; requirements
Sec. 17. A licensee shall conduct a risk assessment of its information systems and treatment of nonpublic information by doing the following:
(1) Designating one (1) or more employees, an affiliate, or an outside vendor designated to act on behalf of the licensee information security program.
(2) Identifying reasonably foreseeable internal or external threats that could result in a cybersecurity event, including threats to information systems and nonpublic information held or accessed by third party service providers.
(3) Assessing the likelihood and potential damage of the threats identified in subdivision (2), taking into consideration the sensitivity of the nonpublic information.
(4) Assessing the sufficiency of the policies, procedures, information systems, and other safeguards currently in place to manage the threats identified in subdivision (2), including an assessment of threats in each relevant area of the licensee's operations, including the following:
(A) Employee training and management.
(B) Information systems, including network and software design, and information classification, governance, processing, storage, transmission, and disposal.
(C) Procedures for detecting, preventing, and responding to cybersecurity events or other systems failures.
(5) Implementing information safeguards to manage the threats identified under subdivision (2), and assessing the effectiveness of the safeguards' key controls, systems, and procedures at least one (1) time each year.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-18 Actions required based on risk assessment results
Sec. 18. Based on the results of the risk assessment, a licensee shall do the following:
(1) Design its information security program to mitigate the identified risks, commensurate with:
(A) the licensee's size and complexity;
(B) the nature and scope of the licensee's activities; and
(C) the sensitivity of the nonpublic information in the licensee's control.
(2) Determine and implement appropriate security measures, which may include the following:
(A) Placing access controls on information systems, including controls to authenticate and permit only authorized individuals to have access to nonpublic information.
(B) Identifying and managing the data, personnel, devices, systems, and facilities that enable the licensee to achieve business purposes in accordance with their relative importance to business objectives and risk strategy.
(C) Restricting physical access to nonpublic information to authorized individuals only.
(D) Protecting by encryption or other appropriate means all nonpublic information while being transmitted over an external network and all nonpublic information stored on a laptop computer or other portable computing or storage device or media.
(E) Adopting secure development practices for in-house developed applications used by the licensee.
(F) Modifying information systems in accordance with the licensee's information security program.
(G) Using effective controls, which may include multi-factor authentication procedures for any employees accessing nonpublic information.
(H) Regularly testing and monitoring systems and procedures to detect actual and attempted attacks on, or intrusions into, information systems.
(I) Including audit trails within the information security program designed to detect and respond to a cybersecurity event and designed to reconstruct material financial transactions sufficient to support normal operations and obligations of the licensee.
(J) Implementing measures to protect against destruction, loss, or damage of nonpublic information due to environmental hazards, such as fire and water damage or other catastrophes or technological failures.
(K) Developing, implementing, and maintaining procedures for the secure disposal of nonpublic information in any format.
(3) Include cybersecurity risks in the licensee's enterprise risk management process.
(4) Stay informed regarding emerging threats or vulnerabilities.
(5) Use reasonable security measures when sharing information, relative to the character of the sharing and the type of information shared.
(6) Provide personnel with cybersecurity awareness training that is updated as necessary to reflect risks identified in the risk assessment.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-19 Board of directors; executive management
Sec. 19. (a) If the licensee has a board of directors, the board of directors shall require the licensee's executive management or its delegates to develop, implement, and maintain the licensee's information security program.
(b) If the licensee's executive management delegates any of its responsibilities under this section, it shall:
(1) oversee the development, implementation, and maintenance of the licensee's information security program prepared by the delegate; and
(2) receive a report from the delegate concerning:
(A) the overall status of the information security program;
(B) the licensee's compliance with this chapter; and
(C) material matters related to the information security program addressing such issues as:
(i) risk assessment;
(ii) risk management and control decisions;
(iii) third party service provider arrangements;
(iv) results of testing;
(v) cybersecurity events and management's responses to cybersecurity events; and
(vi) recommendations for changes in the information security program.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-20 Incident response plan
Sec. 20. (a) As part of its information security program, a licensee shall establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event.
(b) An incident response plan must include the following:
(1) The internal process for responding to a cybersecurity event.
(2) The goals of the incident response plan.
(3) The definition of clear roles, responsibilities, and levels of decision making authority.
(4) External and internal communications and information sharing.
(5) Identification of requirements for the remediation of any identified weaknesses in information systems and associated controls.
(6) Documentation and reporting regarding cybersecurity events and related incident response activities.
(7) The evaluation and revision, as necessary, of the incident response plan.
(c) Annually, not later than April 15, each insurer domiciled in Indiana shall submit to the commissioner a written statement certifying that the insurer is in compliance with the requirements set forth in sections 16 through 19 of this chapter and this section. Each insurer shall maintain for examination by the department all records, schedules, and data supporting this certificate for a period of five (5) years. To the extent an insurer has identified areas, systems, or processes that require material improvement, updating, or redesign, the insurer shall document the identification of the areas, systems, or processes and the remedial efforts planned and underway to address the areas, systems, or processes. The documentation must be available for inspection by the commissioner.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-21 Investigation of cybersecurity event
Sec. 21. (a) If a licensee learns that a cybersecurity event has or may have occurred, the licensee, or an outside vendor or service provider designated to act on the licensee's behalf, shall conduct a prompt investigation. During the investigation, the licensee or outside vendor or service provider designated to act on the licensee's behalf shall:
(1) determine:
(A) whether a cybersecurity event has occurred;
(B) if so, the nature and scope of the cybersecurity event; and
(C) whether any nonpublic information may have been involved in the cybersecurity event; and
(2) perform or oversee reasonable measures to restore the security of the information systems compromised in the cybersecurity event in order to prevent further unauthorized acquisition, release, or use of nonpublic information in the licensee's possession, custody, or control.
(b) A licensee shall maintain records concerning all cybersecurity events for at least five (5) years after the date of the cybersecurity event. A licensee shall produce these records upon demand of the commissioner.
(c) A licensee shall notify the commissioner as promptly as possible but not later than three (3) business days after a determination that a cybersecurity event involving nonpublic information that is in the possession of the licensee has occurred if either of the following applies:
(1) Indiana is the licensee's state of domicile, if the licensee is an insurer, or the licensee's home state, if the licensee is a producer, and the cybersecurity event has a reasonable likelihood of materially harming a consumer residing in Indiana or materially harming any material part of the normal operations of the licensee.
(2) The licensee reasonably believes that the nonpublic information of at least two hundred fifty (250) consumers residing in Indiana was affected by the cybersecurity event and that the cybersecurity event is either of the following:
(A) A cybersecurity event impacting the licensee of which notice is required to be provided by any other state, federal, or local law.
(B) A cybersecurity event that has a reasonable likelihood of materially harming:
(i) a consumer residing in Indiana; or
(ii) any material part of the normal operations of the licensee.
(d) After learning that a cybersecurity event has or may have occurred, a licensee shall provide as much of the following information as possible in electronic form, as directed by the commissioner:
(1) The date of the cybersecurity event.
(2) A description of how the information was exposed, lost, stolen, or breached, including the specific roles and responsibilities of any third party service providers.
(3) How the cybersecurity event was discovered.
(4) Whether any lost, stolen, or breached information has been recovered and, if so, how this was done.
(5) The identity of the source of the cybersecurity event.
(6) Whether the licensee has filed a police report or has notified any regulatory, government, or law enforcement agencies and, if so, when the notification was provided.
(7) A description of the specific types of information acquired without authorization. Specific types of information means particular data elements including, for example, types of medical information, types of financial information, or types of information allowing identification of the consumer.
(8) The period during which the information system was compromised by the cybersecurity event.
(9) The total number of consumers in Indiana affected by the cybersecurity event. The licensee shall provide the best estimate in the initial report to the commissioner and update this estimate with each subsequent report to the commissioner under this section.
(10) The results of any internal review:
(A) identifying a lapse in either automated controls or internal procedures; or
(B) confirming that all automated controls or internal procedures were followed.
(11) A description of efforts being undertaken to remediate the situation that permitted the cybersecurity event to occur.
(12) A copy of the licensee's privacy policy and a statement outlining the steps the licensee will take to investigate and notify consumers affected by the cybersecurity event.
(13) The name of a contact person who is both familiar with the cybersecurity event and authorized to act for the licensee.
(e) The licensee has a continuing obligation to update and supplement initial and subsequent notifications to the commissioner regarding material changes to previously provided information relating to the cybersecurity event.
(f) A licensee shall comply with IC 24-4.9, as applicable, and provide a copy of the notice sent to consumers under IC 24-4.9 to the commissioner if the licensee is required to notify the commissioner under subsection (c).
(g) Nothing in this chapter abrogates or prevents an agreement between a licensee and:
(1) another licensee;
(2) a third party service provider; or
(3) any other party;
to fulfill any investigation requirements imposed under subsection (a) or notice requirements imposed under subsections (c) through (f).
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-22 Notice to ceding insurers and commissioner of cybersecurity event
Sec. 22. (a) In the case of a cybersecurity event involving nonpublic information that:
(1) is used by a licensee acting as an assuming insurer; or
(2) is in the possession, custody, or control of a licensee that:
(A) is acting as an assuming insurer; and
(B) does not have a direct contractual relationship with the affected consumers;
the assuming insurer shall notify its affected ceding insurers and the commissioner of its state of domicile within three (3) business days after making the determination that a cybersecurity event has occurred and the ceding insurers that have a direct contractual relationship with affected consumers shall fulfill the consumer notification requirements imposed under IC 24-4.9 and any other notification requirements relating to a cybersecurity event imposed under section 21(c) through 21(f) of this chapter.
(b) In the case of a cybersecurity event involving nonpublic information that is in the possession, custody, or control of a third party service provider of a licensee that is an assuming insurer:
(1) the assuming insurer shall notify its affected ceding insurers and the commissioner of its state of domicile within three (3) business days after receiving notice from its third party service provider that a cybersecurity event has occurred; and
(2) the ceding insurers that have a direct contractual relationship with affected consumers shall fulfill the consumer notification requirements imposed under IC 24-4.9 and any other notification requirements relating to a cybersecurity event imposed under section 21(c) through 21(f) of this chapter.
(c) Except for the obligations set forth in this section, a licensee acting as assuming insurer has no notice obligations relating to a cybersecurity event or other data breach under section 21 of this chapter or any other law of Indiana.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-23 Notice to producers of cybersecurity event
Sec. 23. (a) In the case of a cybersecurity event:
(1) that involves nonpublic information:
(A) that is in the possession, custody, or control of a licensee that is an insurer or its third party service provider; and
(B) for which a consumer accessed the insurer's services through an independent insurance producer; and
(2) for which consumer notice is required by IC 24-4.9;
the insurer shall notify the producers of record of all affected consumers of the cybersecurity event not later than the time at which notice is provided to the affected consumers.
(b) The insurer is excused from the obligation set forth in subsection (a):
(1) for any producers who are not authorized by law or contract to sell, solicit, or negotiate on behalf of the insurer; and
(2) in those instances in which the insurer does not have the current producer of record information for an individual consumer.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-24 Powers of commissioner
Sec. 24. (a) The commissioner may examine and investigate into the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of this chapter. This power is in addition to the other powers the commissioner has under this title. Any investigation or examination of a licensee under this section shall be conducted pursuant to IC 27-1.
(b) Whenever the commissioner has reason to believe that a licensee has been or is engaged in conduct in Indiana that violates this chapter, the commissioner may take action that is necessary or appropriate to enforce this chapter.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-25 Confidentiality
Sec. 25. (a) Any documents, materials, or other information in the control or possession of the department that are:
(1) furnished by a licensee or an employee or agent acting on behalf of a licensee under section 20(c), 21(d)(2) through 21(d)(5), 21(d)(8), or 21(d)(10) through 21(d)(11) of this chapter; or
(2) obtained by the commissioner in an investigation or examination under section 24 of this chapter;
are confidential by law and privileged, are not subject to IC 5-14-3, are not subject to subpoena, and are not subject to discovery or admissible in evidence in any private civil action. However, the commissioner is authorized to use the documents, materials, or other information in the furtherance of any regulatory or legal action brought as a part of the commissioner's duties. The commissioner shall not otherwise make the documents, materials, or other information public without the prior written consent of the licensee.
(b) Neither the commissioner nor any person who received documents, materials, or other information while acting under the authority of the commissioner shall be permitted or required to testify in any private civil action concerning any confidential documents, materials, or information subject to subsection (a).
(c) In order to assist in the performance of the commissioner's duties under this chapter, the commissioner:
(1) may share documents, materials, or other information, including the confidential and privileged documents, materials, or information subject to subsection (a), with other state, federal, and international regulatory agencies, with the NAIC and its affiliates or subsidiaries, and with state, federal, and international law enforcement authorities, provided that the recipient agrees in writing to maintain the confidentiality and privileged status of the document, material, or other information;
(2) may receive documents, materials, or information, including otherwise confidential and privileged documents, materials, or information, from the NAIC and its affiliates or subsidiaries and from regulatory and law enforcement officials of other foreign or domestic jurisdictions, and shall maintain as confidential or privileged any document, material, or information received with notice or the understanding that it is confidential or privileged under the laws of the jurisdiction that is the source of the document, material, or information;
(3) may share documents, materials, or other information subject to subsection (a), with a third party consultant or vendor provided the consultant or vendor agrees in writing to maintain the confidentiality and privileged status of the document, material, or other information; and
(4) may enter into agreements governing sharing and use of information consistent with this subsection.
(d) No waiver of any applicable privilege or claim of confidentiality in the documents, materials, or information shall occur as a result of disclosure to the commissioner under this section or as a result of sharing as authorized in subsection (c).
(e) Nothing in this chapter prohibits the commissioner from releasing final, adjudicated actions that are open to public inspection under IC 5-14-3 to a data base or other clearinghouse service maintained by the NAIC, its affiliates, or subsidiaries.
(f) Documents, materials, or other information in the possession or control of the NAIC or a third party consultant or vendor under this chapter shall be confidential by law and privileged, shall not be subject to IC 5-14-3, shall not be subject to subpoena, and shall not be subject to discovery or admissible in evidence in any private civil action.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-26 Exemptions from chapter
Sec. 26. (a) A licensee is exempt from sections 16 through 20 of this chapter if the licensee has:
(1) fewer than fifty (50) employees;
(2) less than five million dollars ($5,000,000) in gross annual revenue; or
(3) less than ten million dollars ($10,000,000) in year-end total assets.
(b) A licensee that:
(1) is subject to the federal Health Insurance Portability and Accountability Act (Pub.L. 104–191, 110 Stat. 1936, enacted August 21, 1996); and
(2) has established and maintains an information security program pursuant to that federal act and the regulations, procedures, or guidelines established under that act;
will be considered as meeting the requirements of this chapter, except for the notice requirements described in section 21 of this chapter.
(c) An individual who:
(1) is an employee, agent, representative, or designee of a licensee; and
(2) is also a licensee;
is exempt from sections 16 through 20 of this chapter and need not develop the individual's own information security program to the extent that the individual is covered by the information security program of the licensee of which the individual is an employee, agent, representative, or designee.
(d) A licensee shall be considered to have complied with sections 16 through 20 of this chapter if the licensee is affiliated with a financial institution (as defined in 15 U.S.C. 6809) that maintains an information security program in compliance with the Interagency Guidelines Establishing Standards for Safeguarding Consumer Information adopted under Sections 501 and 505(b) of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 and 6805(b)).
(e) If a licensee ceases to qualify for an exception under subsection (a), (b), (c), or (d), the licensee must comply with sections 16 through 20 of this chapter not more than one hundred eighty (180) days after the licensee ceases to qualify for the exception.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-27 Suspension; revocation
Sec. 27. If a licensee violates this chapter, the insurance commissioner may, after notice and hearing under IC 4-21.5, suspend or revoke the license, certificate of authority, or registration of the licensee.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-28 Rules
Sec. 28. The insurance commissioner may adopt rules under IC 4-22-2 to carry out the provisions of this chapter.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-29 Private right of action
Sec. 29. This chapter does not create a private right of action against any person.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-30 Exclusivity
Sec. 30. Notwithstanding any other provision of law, this chapter establishes the exclusive state standards applying to licensees for:
(1) data security;
(2) the investigation of a cybersecurity event; and
(3) notification to the insurance commissioner concerning a cybersecurity event.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-31 Financial institutions
Sec. 31. The requirements of this chapter do not apply to a financial institution (as defined in 15 U.S.C. 6809), except to the extent the financial institution transacts insurance business.
As added by P.L.130-2020, SEC.10.
Ind. Code § 27-2-27-32 Affirmative defense
Sec. 32. (a) A licensee that satisfies the requirements of this chapter is entitled to an affirmative defense to any cause of action sounding in tort that:
(1) is brought under the laws or in the courts of this state; and
(2) alleges that the failure to implement reasonable information security controls resulted in a data breach concerning nonpublic information.
(b) The affirmative defense available under this section does not limit any other affirmative defenses available to a licensee.
As added by P.L.130-2020, SEC.10.
Source: Open US Law by Vaquill AI (CC BY 4.0)URL: https://iga.in.gov/laws/2026/ic/titles/27Fetched: 10/17/2026