The Maryland Insurance Administration says many cybersecurity events are being reported late and is reminding insurers that a completed investigation is not required before notification is due.

In Bulletin 26-27, issued October 30, the regulator clarified existing requirements to report qualifying cybersecurity events as promptly as possible, and no later than three business days after determining an event has occurred.

The guidance covers insurers, nonprofit health service plans, HMOs, dental organizations, managing general agents and third-party administrators.

What triggers reporting?

For Maryland-domiciled carriers, reporting is required when an event is reasonably likely to harm a Maryland consumer or materially disrupt normal operations. There is no minimum number of affected consumers.

Operational disruptions can include interference with accepting applications, underwriting, rating, sending invoices or notices, collecting premiums, or processing claims. A reporting obligation can therefore arise even without confirmed data theft.

For carriers domiciled elsewhere, the requirement applies when the event involves the nonpublic information of at least 250 Maryland residents and either requires notification to another government or supervisory body, or is reasonably likely to materially harm a Maryland consumer or the carrier’s normal operations.

Third-party incidents count

Third-party administrators must report qualifying incidents and identify potentially affected carriers. Carriers affected by an administrator’s incident must also report when the applicable criteria are met.

The administration said there is no penalty for reporting a potentially consequential incident that an investigation later determines did not involve nonpublic information. It will, however, continue enforcing the reporting deadline.