BULLETIN NO. 2024-10

The purpose of this bulletin is to inform all persons and nongovernmental entities who are licensed, registered, or otherwise authorized to operate pursuant to Title 36 of Oklahoma Statutes of important new requirements enacted by Senate Bill 543, which creates the Insurance Data Security Act, 36 O.S. § 670 – 679. Disclaimer: The following overview does not include every legislative change made by Senate Bill 543.  Please refer to the Oklahoma Supreme Court Network (OSCN) webpage to view all changes.

Legislative Changes effective July 1, 2024

36 O.S. § 670

Notwithstanding any other provision of law, the provisions of the Act shall be the exclusive state law for licensees subject to the jurisdiction of the Insurance Commissioner for data security, the investigation of a cybersecurity event, and notification to the Commissioner.

36 O.S. § 673(E)(2)

Annual Report of Status – This provision requires each licensee with a board of directors to file an annual report on the status of, and material matters related to, the information security program required by the Act. The first submission deadline is July 1, 2025. Additional information on this requirement and instructions for filing will be published in a separate bulletin at a later date.

36 O.S. § 673(I)

Data Security Attestation of Compliance – “Annually, each insurer domiciled in this state shall submit to the Commissioner a written statement by April 15, certifying that the insurer complies with the requirements set forth in this section. Each insurer shall maintain, for examination by the Insurance Department, all records, schedules, and data supporting this certificate for a period of five (5) years. To the extent an insurer has identified areas, systems, or processes that require material improvement, updating, or redesign, the insurer shall document the identification and the remedial efforts planned and underway to address such areas, systems, or processes. The documentation shall be available for inspection by the Commissioner upon request.”

The Data Security Attestation form can be found on the Oklahoma Insurance Department website at: https://www.oid.ok.gov/regulated-entities/financial/market-conduct-regulation/. The Data Security Attestation form must be filed by emailing the completed form to OIDRegulatoryReporting@oid.ok.gov. Because licensees have until July 1, 2025, to come into compliance with all the requirements of 36 O.S. § 673, the first deadline for submission of the Form is July 1, 2025, with subsequent Forms to be due by April 15^th of each following year.

36 O.S. § 675

Cybersecurity Event Notification – 36 O.S. § 675(A) and (B) require every licensee to notify the Insurance Commissioner without unreasonable delay, but not later than three business days, from a determination that a cybersecurity event involving nonpublic information that is in the possession of a licensee has occurred when either of the following criteria has been met:

• This state is the state of domicile of the licensee, in the case of an insurer, or this state is the home state of the licensee, in the case of a producer, and the cybersecurity event has a reasonable likelihood of materially harming any material part of the normal operations of the licensee or any consumer residing in this state; or
• The licensee reasonably believes that the nonpublic information involved is of two hundred fifty (250) or more consumers residing in this state and is either of the following:
  • a cybersecurity event impacting the licensee of which notice is required to be provided to any government body, self-regulatory agency, or any other supervisory body pursuant to any state or federal law, or
  • a cybersecurity event that has a reasonable likelihood of materially harming:
    • any consumer residing in this state, or
    • any material part of the normal operation or operations of the licensee.

The licensee making the notification shall provide as much of the following information as possible, electronically in the manner and form prescribed by the Commissioner, along with any applicable fees:

• Date of the cybersecurity event;
• Description of how the information was exposed, lost, stolen, or breached including, but not limited to, the specific roles and responsibilities of third-party service providers, if any;
• How the cybersecurity event was discovered;
• Whether any lost, stolen, or breached information has been recovered and, if so, how this was done;
• The identity of the source of the cybersecurity event;
• Whether the licensee has filed a police report or has notified any regulatory, government, or law enforcement agencies and, if so, when such notification was provided;
• Description of the specific types of information acquired without authorization. The term “specific types of information” means particular data elements including, but not limited to, types of medical information, financial information, or information allowing identification of the consumer;
• The period during which the information system was compromised by the cybersecurity event;
• The number of total consumers in this state affected by the cybersecurity event. The licensee shall provide the best estimate in the initial report to the Commissioner and update this estimate with each subsequent report to the Commissioner pursuant to this section;
• The results of any internal review identifying a lapse in either automated controls or internal procedures, or confirming that all automated controls or internal procedures were followed;
• Description of efforts being undertaken to remediate the situation which permitted the cybersecurity event to occur;
• A copy of the privacy policy of the licensee and a statement outlining the steps the licensee will take to investigate and notify consumers affected by the cybersecurity event; and
• Name of a contact person who is both familiar with the cybersecurity event and authorized to act for the licensee.

The Cybersecurity Event Notification form can be found on the Oklahoma Insurance Department website at: https://www.oid.ok.gov/regulated-entities/financial/market-conduct-regulation/.

36 O.S. § 678(B)

Exceptions – The Insurance Data Security Act does not apply to the following licensees:

• A licensee with less than Five Million Dollars ($5,000,000.00) in gross annual revenue is exempt from this act (Note: This includes all income, not just premiums written);
• A licensee subject to the Health Insurance Portability and Accountability Act, Pub. L. 104–191, 110 Stat. 1936, as amended, that has established and maintains an information security program pursuant to such statutes, rules, regulations, procedures, or guidelines established thereunder, will be considered to meet the requirements of Section 4 of this act, provided that the licensee is compliant with and submits a written statement to the Commissioner certifying its compliance with the same;
• A licensee subject to Title V of the federal Gramm-Leach-Bliley Act of 1999 (15 U.S.C. Sections 6801-6809 and 6821-6827) that has established and maintains an information security program pursuant to such, statutes, rules, regulations, procedures, or guidelines established thereunder, will be considered to meet the requirements of Section 4 of this act, provided that the licensee is compliant with and submits a written statement to the Commissioner certifying its compliance with the same; and
• An employee, agent, representative, or designee of a licensee, who is also a licensee, is exempt from this act and shall not be required to develop their own information security program to the extent that the employee, agent, representative, or designee is covered by the information security program of the licensee.

The scope of all required reporting shall encompass information from the previous calendar year. Pursuant to 36 O.S. § 679, licensees shall have one (1) year from the effective date of the Act (July 1, 2024) to come into compliance with 36 O.S. § 673 and two (2) years from the effective date of the Act to come within compliance of 36 O.S. § 673(F).

The provisions of this act shall take precedence over any other state laws applicable to licensees for data security and the investigation of a cybersecurity event. The licensee shall have a continuing obligation to update and supplement initial and subsequent notifications to the Commissioner regarding material changes to previously provided information relating to the cybersecurity event.

A licensee shall comply with the procedures of the Security Breach Notification Act, 24 O.S. §§ 161, et seq., to notify affected consumers and provide a copy of the notice sent to consumers under that statute to the Commissioner when a licensee is required to notify the Commissioner.

Questions concerning this bulletin should be directed to the Oklahoma Insurance Department by email to OIDRegulatoryReporting@oid.ok.gov.

BULLETIN NO. 2024-05

The Regulated Industry Services (RIS) Division of the Oklahoma Insurance Department (OID) will oversee the new Financial Protection Product registrations.  The OID’s Rate and Form (R&F) Division will oversee the reinsurance policy form filing.   Legislative changes requiring the registration and form filings for Debt Waivers or Vehicle Value Protection Agreements are summarized below.  Disclaimer:  The following overview does not include every legislative change made in 2024.  Please refer to the Oklahoma Supreme Court Network (OSCN) webpage to view all changes.

Financial Protection Products

Legislative Changes effective November 1, 2024

SB 541

Debt Waiver – 15 O.S. § 140.4(B).

Registration – 1. No administrator or creditor operating as an administrator shall perform or engage in any administrative or operational functions of a debt waiver program without first registering with the Insurance Department. Registration shall be renewed annually by July 15 of each calendar year. All registrations shall be filed, and fees shall be paid electronically in the manner and form prescribed by the Commissioner.

Contact change – 2. An administrator or a creditor operating as an administrator shall electronically file an updated registration within thirty (30) days of any change of name, address, or email address.

Days to respond – 3. Every administrator or creditor, upon receipt of any inquiry from the Commissioner, shall furnish the Commissioner with an adequate response to the inquiry within twenty (20) days from the date of receipt of the inquiry.

Vehicle Value Protection Agreements – 15 O.S. § 140.5(B).

Registration – 1. No administrator or provider operating as an administrator shall perform or engage in any administrative or operational functions of vehicle value protection agreements without first registering with the Insurance Department. Registration shall be renewed annually by July 15 of each calendar year. All registrations shall be filed and fees shall be paid electronically in the manner and form prescribed by the Insurance Commissioner.

Contact change – 2. An administrator or a provider operating as an administrator shall electronically file an updated registration within thirty (30) days of any change of name, address, or email address.

Days to respond – 3. Every administrator and provider, upon receipt of any inquiry from the Commissioner, shall furnish the Commissioner with an adequate response to the inquiry within twenty (20) days from the date of receipt of the inquiry.

15 O.S. § 140.5(C)(3)(a).

Amends the reinsurance policy requirement – insure all of its vehicle value protection agreements under an insurance policy that covers one hundred percent (100%) of its claim exposure, satisfies the requirements of this act, and contains the following provision: “In the event the provider is unable to fulfill its obligations under vehicle value protection agreements issued in this state for any reason including insolvency, bankruptcy, or dissolution, the insurer will pay any losses and unearned fees to the person making a claim under such agreement.” The insurance policy shall be issued by an insurer licensed, registered, or otherwise authorized to do business in this state either:

(1) at the time the policy is filed with the Insurance Commissioner, and continuously thereafter, (i) maintain surplus as to policyholders and paid-in capital no less than Fifteen Million Dollars ($15,000,000.00) and (ii) annually file copies of the insurer’s financial statements, its National Association of Insurance Commissioners (NAIC) Annual Statement, and the actuarial certification required by and filed in the insurer’s state of domicile, or

(2) at the time the policy is filed with the Commissioner, and continuously thereafter, (i) maintain surplus as to policyholders and paid-in capital of less than Fifteen Million Dollars ($15,000,000.00) but at least equal to Ten Million Dollars ($10,000,000.00), (ii) demonstrate to the satisfaction of the Commissioner that the company maintains a ratio of net written premiums, wherever written, to surplus as to policyholders and paid-in capital of not greater than 3 to 1, and (iii) annually file copies of the insurer’s audited financial statements, its NAIC Annual Statement, and the actuarial certification required by and filed in the insurer’s state of domicile,

15 O.S. § 140.5(C)(3)(b)(2).

Amends security deposit – removes cash as an option.

Refer to the RIS Webpage for more details and instructions https://www.oid.ok.gov/regulated-entities/regulated-industry-services/.  

BULLETIN NO. 2024-06

The Regulated Industry Services (RIS) Division of the Oklahoma Insurance Department (OID) oversees the Service Warranty Associations licensed in Oklahoma.  The Legislative changes, outlined below, will impact your license requirements beginning soon. Disclaimer:  The following overview does not include every legislative change made in 2024.  Please refer to the Oklahoma Supreme Court Network (OSCN) webpage to view all changes.

Service Warranty Act

Legislative Changes effective November 1, 2024

SB 541

15 O.S. § 141.4 (B).

Electronic Filing and Signed Declaration – Each service warranty association applying for a license shall electronically submit a complete license application and pay the license fee to the Insurance Commissioner in the manner and form prescribed by the Commissioner, along with any transaction or other applicable fees. Each application shall include a signed declaration that under penalty of refusal, suspension, or revocation of the license, the information provided in the application is true, correct, and complete to the best of the applicant’s knowledge and belief.

15 O.S. § 141.5 (6).

Qualifications for License – Clarifies licensee is required to submit all annual financial statements and administrative fees required by the Service Warranty Act.

15 O.S. § 141.8 (6).

Reinstatement Requirements – A license expired for failure to submit a renewal application may be reinstated within ninety (90) days after the expiration date by electronically submitting a fee in an amount that is double the renewal fee and a renewal application in the form and manner prescribed by the Commissioner along with any transaction or other applicable fees. The Commissioner shall require a service warranty association whose license has been expired for more than ninety (90) days to reapply as if a new applicant and pay an application fee that is double the initial application fee, in addition to any fines imposed. All applications received after the license has been expired for more than ninety (90) days shall include a detailed report of service warranties issued in this state during the period of expired licensure.

15 O.S. § 141.13 (C).

Contact Change – Each person and service warranty association shall electronically submit, in the form and manner prescribed by the Commissioner, any change of legal business name, “doing business as” or assumed name, address, or contact email address within thirty (30) days after the change occurred, and any fees deemed necessary by the Commissioner. Any submission of a change under this paragraph received more than thirty (30) days after the change occurs shall be accompanied by a fee of Fifty Dollars ($50.00).

15 O.S. § 141.14 (A).

Financial Statement – clarifies that the annual financial statement submitted by May 1^st annually must be dated not earlier than three hundred sixty-five (365) days prior to the date submitted.

15 O.S. § 141.33 (B).

Days to Respond – Every service warranty association, upon receipt of any inquiry from the Commissioner, shall, within twenty (20) days from the date of the inquiry, furnish the Commissioner with an adequate response to the inquiry.

Refer to the RIS Webpage for more details and instructions https://www.oid.ok.gov/regulated-entities/regulated-industry-services/.