On February 25, 2020, the Virginia State Legislature passed House Bill 1334, the Insurance Data Security
Act, which establishes data security requirements applicable to
persons licensed by the insurance laws of the Commonwealth. See
Virginia Code §§ 38.2-621 – 629. Following on other
state laws that have created data security regimes applicable to
the insurance industry, the Virginia law requires licensees to
maintain the security of information systems and nonpublic
information. The law also requires licensees to investigate
cybersecurity events and to notify individuals and the Commissioner
of Insurance.
Definitions Applicable to Insurance Data Security
The Virginia law requires licensees to protect nonpublic
information, which includes (1) certain business-related
information; (2) any personal information of a consumer including
Social Security number, identification number, or biometric
information; or (3) any healthcare information, including past
treatment or
