On Aug. 29, 2019, the Maryland Insurance Administration (MIA)
issued Bulletin 19-14. The purpose of the
bulletin is to inform insurers, nonprofit health service plans,
health maintenance organizations, managed care organizations,
managed general agents and third-party administrators of a new
security breach reporting requirement to the Compliance &
Enforcement Unit at the MIA.
Effective Oct. 1, 2019, pursuant to Insurance Article §
4-406, carriers are required to notify the insurance commissioner
of a breach of the security of a system if the carrier (1) conducts
an investigation required under § 14-3504(b) or (c) of the
Commercial Law Article; and (2) determines that the breach of
security of the system creates a likelihood that personal
information has been or will be misused. The notice needs to be
provided at the same time that the Maryland attorney general is
notified pursuant to § 14-3504(h) of the Commercial Law
Article.
