🛡️ Insurance compliance · Free audit · Generate full stack

Compliance for Insurance & InsurTech

NAIC Model #668 has now been adopted by 27+ states. NYDFS 23 NYCRR 500 was strengthened in 2023. Health insurers add HIPAA. Generic privacy policies fail every regulator. ComplianceIQ generates state-by-state insurance compliance — and the GLBA Safeguards program required of every licensee.

Generate Insurance stack Audit my existing policy

The Insurance compliance stack

4 frameworks typically in scope. Click any to run the free framework-specific audit.

HIPAA (health-insurance lines)
Health insurers, dental, vision, Medicare Advantage — Covered Entities
Free audit →
SOC 2 (Type 2)
InsurTech + agency-tech vendors — required by carrier partners
Free audit →
ISO 27001:2022
Reinsurance + global carrier diligence
Free audit →
CCPA + 19 state privacy laws
Direct-to-consumer insurance — state laws stack on top of GLBA
Free audit →

The 4-document Insurance bundle

Generate any or all in PDF + DOCX. Maps to HIPAA, SOC, ISO, CCPA.

1
Information Security Program (NAIC #668 + GLBA Safeguards + NYDFS 500)
NAIC / GLBA / NYDFS
Generate →
2
Insurance Privacy Notice (state insurance + GLBA + CCPA)
State / GLBA
Generate →
3
Cybersecurity Event Notification Procedure (72h NYDFS / NAIC)
NAIC #668 / NYDFS 500
Generate →
4
HIPAA Privacy + Security (if health insurance)
HIPAA
Generate →

Who buys this

  • Compliance Officer
  • CISO at carrier / MGA
  • InsurTech Founder
  • Broker / Agency Operations Lead

When teams reach for ComplianceIQ

  • State DOI exam scheduled — insurance data security model law (NAIC #668)
  • NYDFS 23 NYCRR 500 amendment (Nov 2023) — annual cert by CISO + Board
  • Cyber-insurance carrier requiring documented program from policyholder
  • InsurTech Series A diligence flagging compliance gaps
  • AM Best rating review citing cyber-risk governance

Real insurance enforcement actions

$1M
First American Title (NYDFS, 2023)
First NYDFS 23 NYCRR 500 enforcement — 880M-record exposure
$5.1M
Excellus BCBS (HHS OCR, 2021)
9.3M PHI breach — HIPAA settlement
$5M
Carnival (multi-state AG, 2022)
Insurance-data breach — multi-state coordinated settlement
$16M
Anthem (2018)
HHS OCR — largest HIPAA settlement in history

Why insurance compliance projects fail

Treating NAIC #668 as a 'best practice'
27+ states have adopted it as binding law (SC, OH, MI, AL, MS, DE, CT, NH, VA, ND, IA, IN, etc.). Required: written ISP, designated CISO, annual risk assessment, board oversight, 72-hour cybersecurity event reporting. State DOIs are actively examining.
NYDFS 23 NYCRR 500 Part 500 (amended Nov 2023)
Now requires MFA on all access, CISO + Board annual certification, expanded incident reporting to 72 hours, governance + accountability documentation. Major change vs original 2017 rule.
Producers / agencies thinking they're out of scope
Most state insurance data security laws cover 'licensees' — that includes producers, agencies, MGAs, TPAs. Small agencies often lack any documented program and are easy enforcement targets.
Health insurance + GLBA + HIPAA overlap
Health insurers are simultaneously HIPAA Covered Entities AND GLBA financial institutions in some states. You need both privacy programs, both breach notification chains, and reconciled documentation.

Insurance compliance FAQ

What's NAIC Model #668 and does it apply to me?
The NAIC Insurance Data Security Model Law — adopted by 27+ states. Applies to any 'licensee' (insurer, producer, MGA, TPA) authorized in the state. Requires written ISP, CISO, risk assessment, third-party oversight, incident response, 72h cybersecurity event notification, annual certification.
NYDFS 500 vs NAIC #668 — relationship?
NYDFS 500 (2017, amended 2023) was the model for NAIC #668. NY-licensed entities follow 500 directly; entities in NAIC-adopting states follow the state's adoption (substantially identical). Multi-state insurers typically build to the strictest (NYDFS 500 Part 500).
We're an InsurTech selling to carriers — what do they ask for?
Carrier vendor management programs typically demand: SOC 2 Type 2, signed BAA (if PHI), Information Security Policy, Incident Response Plan, vendor risk procedure, evidence of MFA + encryption, and contractual flow-down of NAIC #668 / NYDFS 500 requirements.

Generate your Insurance compliance stack

Bundle pricing: 4 documents, mapped to 4 frameworks, PDF + DOCX, custom-tailored to your org. From $49/mo (unlimited).

Generate stack Audit existing policy first