Connecticut's Insurance Department Issues Tough Notice Requirement for Data Breaches

Following on the heels of Health Net's recent settlement with the Connecticut Attorney General for alleged failure to secure medical records and financial information and promptly notifying consumers and regulators of the breach,¹ the Insurance Department issued a bulletin on August 18, 2010 mandating immediate notification to the Department of data breaches by licensees and registrants of the Department.² The new insurance bulletin addresses the delayed notification concern by providing that the Insurance Department may impose administrative penalties on licensees and registrants that fail to quickly and affirmatively notify the Department and consumers of the risks posed by a data breach.