Insurance Data Security Model Law: what it means for software vendors

Who the model law covers and where vendors fit#

The NAIC Insurance Data Security Model Law covers licensees, meaning insurers, agencies and others licensed by a state insurance department, and it reaches software vendors as third-party service providers that store, process or access a licensee's nonpublic information. It is a model, so it has force only where a state enacts it, and states adjust the text when they do.

For a vendor, the practical rule is simple: read the enacted statute in each state where your carrier customers are domiciled or licensed, and read each carrier contract. Some states regulate insurer cybersecurity through their own frameworks instead, such as New York's DFS cybersecurity regulation, and carriers often apply the strictest version across all their vendors.

If your company also holds an insurance license, for example through an agency subsidiary, that entity may be a licensee in its own right. Map your corporate structure before assuming the law reaches you only through customers.

What carriers typically pass down to vendors#

Carriers typically pass their service provider oversight duties down as contract terms, questionnaires and audit rights. The model law expects licensees to exercise diligence in selecting providers and to require appropriate security measures from them, and carriers turn that expectation into specific clauses.

Each clause protects the carrier's security program, and several also limit what you can do with the carrier's data outside the service you were hired to provide.

Questionnaires deserve the same care as contract clauses. An answer saying carrier data never leaves the production environment becomes a representation the carrier relies on, so confirm it against your actual ticketing, logging and analytics setup before you sign off.

What counts as nonpublic information in a vendor's systems#

Nonpublic information under the model law is broader than personal data: it generally covers a licensee's sensitive business information as well as personal and health information about consumers. Check the definition in each enacted statute and in the carrier contract, because the contract definition of confidential information is often wider still.

In a policy administration, claims or rating platform, that means carrier data sits in more places than the production database. Vendors are often surprised by how much of it has leaked into their own operational records over the years.

• 1Production tenants: policies, claims files, underwriting notes, billing and agent records.
• 2Support tickets with screenshots of policy screens, attached claim documents or pasted error payloads.
• 3Application logs and monitoring tools that capture request bodies.
• 4Test and staging environments loaded with copies of production data.
• 5Rating tables, underwriting rules and product filings the carrier configured in your product.
• 6Implementation workbooks and data mapping files from onboarding projects.

How the model law limits vendor data reuse#

The model law limits vendor data reuse indirectly: it does not mention licensing or AI training, but the contracts carriers sign to satisfy it usually confine carrier data to performing the service. Reusing carrier data for anything else generally needs the carrier's express written permission, and many carriers will refuse.

That leaves a vendor's own records as the realistic starting point. Engineering issues, code reviews, release notes, internal design documents and support process records belong to the vendor, though tickets and logs must be checked for carrier data and cleaned before any reuse. Rating rules and underwriting logic configured by a carrier are carrier information, even when they live in your product.

Carriers are also weighing separate NAIC guidance on insurers' own use of AI systems, which adds questions about model documentation and testing. Treat both sets of expectations together when you answer a carrier's due diligence request.

A general counsel's review checklist#

A general counsel's review should start from the carrier contracts and work outward to the systems where carrier data actually sits. The goal is a written map of what each carrier allows, what your company owns outright, and what needs cleaning or consent before any reuse.

Illustrative example: a policy administration vendor scopes its records#

Illustrative: a fictional vendor of policy administration software for regional mutual insurers considers licensing records to an AI developer. Its systems include a hosted policy platform, Jira, GitHub, Zendesk and Confluence, and every carrier contract limits carrier data to performing the service.

Outside counsel confirms that carrier tenant data, rating tables and claims documents are out of scope. A records review then finds policyholder screenshots in older Zendesk tickets and production copies in a staging environment, which the company deletes under its contracts. The proposed package narrows to Jira issues, code reviews, release notes and support tickets with carrier and policyholder details removed, and the company records each carrier contract it relied on.

When a carrier's next vendor review asks whether its data has been used outside the service, the company answers with the scoping memo, the deletion records for the old tickets and staging copies, and the list of systems excluded from the package. The review closes without a dispute, and the company adds a standing rule that support agents attach no policy screens to tickets.

How SourceX handles carrier-regulated records#

SourceX treats carrier data held by an insurance software vendor as the carrier's, and generally excludes it during the Rights step of the SourceX five-step transaction. The assessment focuses on records the vendor created itself, and the fit check collects only metadata, so no carrier information is shared at the start.

When a package proceeds, Preparation removes carrier and policyholder details from tickets and notes, the vendor approves the final scope, and the SourceX Evidence Packet documents provenance, licensing rights, permitted use, the privacy record and release authorization. That record lets the vendor answer a carrier audit question with documents rather than recollection.