Data breach notification management for insurers — every regulator and person to notify, each with its deadline and a draft
Every regulator and person to notify, each with its deadline and a draft.
See one case, screen by screen ↓It is the work of deciding, after a data incident, which regulators and people must be notified, by when and with what content — then drafting, approving, sending and proving each notice. Data Breach Notification Management does this for insurers, covering both the insurance data security laws and every state’s breach law.
How to choose AI solutions for insurance →
Updated
When a cyber incident exposes the personal information of claimants, insureds or employees, an insurer owes two sets of notices at once: to insurance commissioners under the state insurance data security laws, often within 72 hours or three business days, and to residents, attorneys general, state police and the credit bureaus under each state’s breach law — each with its own trigger, threshold, deadline and letter content.
Today the privacy office builds that matrix in a spreadsheet from outside counsel’s 50-state survey, often after the data-review vendor returns the people list. The traps are in the detail: a commissioner clock that starts the day after the vendor’s notice, not the forensic determination; medical information that counts as personal information in one state and not the next; a Massachusetts letter that must leave out what every other letter says.
Estimated split for a multi-state incident, by hand and with the solution. The data review itself is not counted.
Five agents turn the incident into every notice owed, each with its clock and draft; the privacy officer signs.
Pellmark Document Services, the vendor that scans Wrenfield Mutual’s claims mail, is hit by ransomware. Here is what happens next, screen by screen, in the working solution.
An intruder was on Pellmark’s file-transfer server from 2 to 9 September; ransomware was detected on the 13th. Pellmark tells Wrenfield on Monday 21 September at 17:30. For an event at a vendor, the commissioners’ clocks start the day after that notice: Tuesday 22 September, 00:00.
NAIC Model §6.D(2): the day after the vendor notifies us, or when we first knew, whichever is sooner.
Helen Ashby records the determination at 15:10: personal information was acquired. The intake agent reads Pellmark’s notice, Halvard’s 14-page forensic summary and ticket SEC-4471. The mapper turns 53,477 rows into 48,016 people in 20 states. The rules agent applies 20 breach laws and 9 insurance data security laws: 53 notices owed, 6 not owed, each cited. By 16:02 every clock is set.
“Every clock set · first due: Washington OIC, Wed 23 Sep · plan sent to Marisol Vance and Helen Ashby.”
Each person is placed by the last known address in the claim file, with the elements exposed: Social Security numbers from workers’ compensation files, driver’s licences, medical information, bank accounts used for claim payments. Minors, deceased claimants and missing addresses go to Tomás Reyes in Claims Operations. Where a state does not count medical information, a medical-only claimant is not owed a letter — and the screen says why.
Kayleigh Dunmore, Georgia, medical only: “Medical information is not personal information under O.C.G.A. §10-1-911.”
The notice drafter fills the 13 facts the model law asks for, each with its source — the forensic summary page, the vendor’s notice, the data review. Helen signs, and all eight notices go out on 23 and 24 September with their receipts. Delaware’s commissioner is not owed: 174 residents, under the 250 threshold. When the data review raises the count from 46,900 to 48,016, the update is drafted and waits for her signature.
Batch 1 mailed yesterday: 30,636 letters in 11 states. The plan shows 59 notices — 36 sent, 14 scheduled, 6 not owed — and three that need her: the Colorado, Florida and Washington letters, 7,645 residents. Their 30-day deadline is Thursday 22 October; the print vendor needs three business days, so they must be released by Monday 19 October.
“3 letters need you · 7,645 residents. Counsel approved the state wording on 14 Oct.”
1,742 Colorado residents are in the files and all are owed a letter, because Colorado counts medical information. Three notices are owed: the Attorney General at 500 or more residents, the three nationwide credit bureaus above 1,000, and the letters — each with its clause of C.R.S. §6-1-716 and the arithmetic of its deadline.
Version 3: drafted 22 September, revised 13 October, approved by counsel 14 October. The margin shows why each paragraph is there — the date range, the information involved, the credit bureaus and the FTC, the contact details — each marked “required here” under C.R.S. §6-1-716. The 24 months of identity protection is marked as Wrenfield policy, not law.
The same base letter, changed for each state. In Massachusetts the drafter leaves out the nature of the breach and the number affected, adds the right to a police report and a free security freeze, and cites M.G.L. c. 93H §3(b) for each change. The 1,162 Massachusetts letters mailed on 14 October with that wording.
“The Massachusetts notice must not describe the nature of the breach or how many residents were affected.”
She approves the three letters as Chief Privacy Officer: Colorado 1,742, Florida 4,388, Washington 1,515, version 3, counsel 14 October, mailing Tuesday 20 October. Her signature records her name, the time and its meaning, and goes on the incident’s audit trail and the record of notices.
“Marisol Vance — I approve these notices for release.”
The red leaves turn blue: released to print, 7,645 letters, Fernway job FN-88530, mailing Tuesday 20 October — two days inside the 30-day deadline of Thursday 22 October. Nothing on the plan needs her now; the next dates are the three attorneys general on the 20th and batch 2 on 2 November.
The same incident, seen by the four people who carry it — what their weeks looked like, and what they look like now.
Five agents turn the incident into every notice owed, each with its clock and draft; the privacy officer signs.
Reads the vendor’s notice, the forensic summary and the security ticket, and records the facts, the exposure window and the dates every clock depends on.
Deduplicates the data-review rows into people, assigns each a state of residence from the last known address and lists the data elements exposed for each.
Applies each state’s breach law and insurance data security law to the facts — definition, trigger, threshold, deadline and its start — and builds the plan, one cited notice per obligation.
Drafts the commissioner notices with the 13 facts and each state’s letter from the base template, adding what the state requires and removing what it forbids, with the clause in the margin.
Runs every clock, warns at 14 and 7 days counting the print lead time, records each proof and flags updates owed to commissioners.
Signs every letter. The agents propose; a named person decides.
The privacy team can ask about the incident in plain words — or tell it what to change. Every answer points to the screen it came from.
Which notices are at risk this week?
Three letters — 7,645 residents. Colorado (1,742) and Florida (4,388) must be notified within 30 days of the determination, Washington (1,515) within 30 days of discovery: all by Thu 22 Oct. Counsel approved the wording on 14 Oct; Fernway needs 3 business days, so release by Mon 19 Oct. Everything else due this week is sent or approved.
When did the commissioners’ clocks start?
On Tue 22 Sep at 00:00 — the day after Pellmark’s notice of Mon 21 Sep 17:30, not the forensic determination at 15:10 on the 22nd. For an event at a vendor, NAIC Model §6.D(2) starts the clock the day after the vendor tells the licensee. So the 72-hour and 3-business-day notices were due by Thu 24 Sep; Washington’s two business days by Wed 23 Sep. All 8 went out on time.
Why is no notice going to the Delaware commissioner?
Because only 174 Delaware residents are in the files. Delaware’s insurance data security law requires the commissioner’s notice for a non-domicile insurer only when 250 or more residents are involved, and the Attorney General only above 500. The 174 residents still get a letter within 60 days, in batch 2 on Mon 2 Nov.
What must the Massachusetts letter leave out?
Two things: the nature of the breach and the number of residents affected — M.G.L. c. 93H §3(b) forbids both in the letter, though both go to the Attorney General and the Office of Consumer Affairs. It must add the right to a police report and how to get a free security freeze, and 18 months of credit monitoring where SSNs were exposed.
13 screens from the working solution, on its sample data. Pick one to see it large.
Everything that differs between carriers is a setting, applied to every notice on every incident.
| Setting | Default | Choose from |
|---|---|---|
| Red when this close to a deadline, if nobody has approved | 7 days | Set in days · counts print and mail lead time |
| Amber when this close | 14 days | Set in days · reminders to the owner and the Chief Privacy Officer |
| Where a statute gives no number of days | 30 days from the determination | Set in days |
| Commissioner clocks for a vendor’s incident start | Day after the vendor’s notice | NAIC Model §6.D(2) — or when we first knew, if sooner |
| Print and mail lead time | 3 business days | Set in business days |
| Identity protection where SSNs were exposed | 24 months, everywhere | Meets Connecticut; exceeds Massachusetts and Delaware |
| Who approves letters to residents | Chief Privacy Officer | Set under Who decides |
| Who signs commissioner notices and records the determination | Associate General Counsel | Set under Who decides |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample incident · “estimated” = our estimate · “typical” = published figures (NAIC Insurance Data Security Model Law (MO-668) §6 — 72 hours to notify the commissioner; IBM Cost of a Data Breach 2025 — US average). State-law details are as they appear in the working solution’s sample rules library (23 NYCRR 500.17, state breach statutes as cited) and are confirmed by counsel before use. People, companies and vendors named on this page are fictional — characters and sample data in the working solution.
It is the work of deciding, after a data incident, which regulators and people must be notified, by when and with what content — then drafting, approving, sending and proving each notice. Data Breach Notification Management does this for insurers, covering both the insurance data security laws and every state’s breach law.
The notification rules agent applies each state’s definition of personal information to each person, then the thresholds for attorney general, agency, police and credit bureau notices, and the commissioner notice under the insurance data security law. Each notice carries its citation and its deadline; a notice is “not owed” only on a numeric threshold, shown with the count.
For an event at a third-party service provider, the NAIC model law starts the clock the day after the vendor notifies the insurer, or when the insurer first knew, whichever is sooner. The solution sets that start from the facts and shows it on every commissioner notice; the setting can be changed.
Yes. The notice drafter drafts each state’s letter from your base template, adding what the state requires and removing what it forbids, with the clause for each paragraph in the margin. It also drafts the commissioner notices with the 13 facts the model law lists, each with its source.
No. Nothing is sent without a signed approval: letters by the Chief Privacy Officer, commissioner notices by regulatory counsel. Counsel records the determination date and decides any harm-based exception; the agents never do.
Yes. The record of notices lists every notice with its date, recipient, channel, count and proof, and exports for an exam. A notice is marked sent only when a receipt, confirmation number or mailing job proves it.
Yes. When a notice turns red or amber, the default where a statute gives no number of days, the print and mail lead time, identity protection and who approves each kind of notice are all settings.
The Agentic Solution Engine builds and deploys it from your requirements and documents — your incident response plan, letter templates and counsel’s rules — and it goes live once every quality gate has passed. We will walk you through it on a sample incident first.
Each new rule mapped to its policy and owner the day it is published.
1-min demo50-State Regulatory ResearchEvery state answered side by side, each with the statute that says so.
1-min demoMarket Conduct Exam ManagementEvery examiner request tracked to its due date, answered from the file.
1-min demoWe’ll run Data Breach Notification Management on a sample incident with your own states and rules.