Title 27, INSURANCE

Sec. 12. (a) Before entering into a contract with an insured, a public adjuster shall provide to the insured a written disclosure concerning any direct or indirect financial interest that the public adjuster has with any other party that is or will be involved in any aspect of th…

Sec. 13. (a) A public adjuster shall not provide services, other than emergency services, to an insured until: (1) a written contract between the public adjuster and the insured has been executed; and (2) an exact copy of the contract has been provided to: (A) the insurer with wh…

Sec. 14. (a) Before an insured enters into a contract with a public adjuster, the public adjuster shall provide to the insured a separate signed and dated disclosure document that states the following: "Property insurance policies obligate the insured to present a claim to his or…

Sec. 15. A contract between a public adjuster and an insured may not contain any of the following: (1) If the public adjuster is to receive as compensation a percentage of the total amount paid by the insurer to resolve the insured's claim, a contract term that would: (A) allow t…

Sec. 16. (a) A public adjuster shall ensure that a contract between the public adjuster and an insured is in writing and contains the following: (1) The legible full name of the public adjuster entering into the contract, as specified in the records of the department. (2) The per…

Sec. 17. The following apply to a contract between an insured and a public adjuster: (1) An insured is not required to hire a public adjuster to help the insured meet the insured's obligations under a policy, but has a right to do so. (2) The public adjuster is not a representati…

Sec. 18. (a) This section applies notwithstanding the terms of a written contract between an insured and a public adjuster. (b) If the insurer, not more than five (5) business days after the date on which the insured's loss is reported to the insurer, either pays or commits in wr…

Sec. 19. (a) A contract between a public adjuster and an insured is voidable at the option of the insured at any time not more than three (3) business days after the day on which the insurer is provided a copy of the contract under section 13(a)(2) of this chapter. (b) An insured…

Sec. 2. (a) No individual or corporation shall act within Indiana as a public adjuster, or receive, directly or indirectly, compensation or reward for services rendered in the adjustment of any claim or claims under the types of insurance policies set forth in section 1(g) of thi…

Sec. 20. (a) An insured may rescind a contract between the insured and a public adjuster at any time not more than three (3) business days after the day on which the insured submits to the insurer the claim to which the contract relates. (b) An insured may rescind a contract with…

Sec. 3. (a) The commissioner of insurance shall issue resident and nonresident public adjusters' certificates of authority to each person who: (1) has complied with the requirements of this chapter, including the payment of fees, the completion of the examination, and, in the cas…

Sec. 4. (a) Each applicant for a certificate of authority as a public adjuster shall file with the commissioner of insurance an application therefor on forms furnished by the commissioner of insurance, which application shall set forth: (1) the name and address of the applicant, …

Sec. 5. (a) The commissioner may not issue a certificate of authority to a nonresident applicant until that nonresident files with the commissioner, in a form prescribed by the commissioner, a designation of an individual resident of Indiana, a corporate resident of Indiana, or a…

Sec. 6. (a) The commissioner of insurance shall, in order to determine the competency of an applicant for a certificate of authority to act as a public adjuster, require such applicant to submit to a written examination, except such applicants who shall be entitled to such certif…

Sec. 7.1. (a) The insurance commissioner: (1) may: (A) suspend; (B) revoke; or (C) refuse to issue or renew; a public adjuster's certificate of authority; or (2) may place a public adjuster on probation; for a cause set forth in subsection (b). (b) A public adjuster is subject to…

Sec. 7.2. (a) Notwithstanding any other provision of this chapter, a nonresident public adjuster who receives a certificate of authority under this chapter shall maintain licensure as a public adjuster in good standing in the nonresident public adjuster's home state. (b) If a non…

Sec. 8. The commissioner of insurance shall, in the manner prescribed by IC 4-22-2, adopt standards for the competent practice of public adjusting appropriate to establish and maintain a high standard of integrity and dignity in the profession of public adjusting. As added by P.L…

Sec. 9. A public adjuster may not: (1) engage in the practice of law; (2) deal directly with any claimant represented by an attorney at law without the consent of the attorney; (3) advise a claimant to refrain from seeking legal advice or retaining counsel; or (4) in the case whe…

Sec. 1. This chapter applies after June 30, 2021. As added by P.L.130-2020, SEC.10.

Sec. 10. (a) As used in this chapter, "licensee" means a person that is: (1) licensed, authorized to operate, or registered; or (2) required to be licensed, authorized to operate, or registered; under this title and the rules adopted under this title. (b) The term does not includ…

Sec. 11. As used in this chapter, "multi-factor authentication" means authentication through verification of at least two (2) of the following types of authentication factors: (1) Knowledge factors, such as a password. (2) Possession factors, such as a token or text message on a …

Sec. 12. As used in this chapter, "nonpublic information" means electronic information that is not publicly available information and is described in either of the following subdivisions: (1) Any information concerning a consumer, which because of name, number, personal mark, or …

Sec. 13. As used in this chapter, "publicly available information" means any information that a licensee has a reasonable basis to believe is lawfully made available to the general public from: (1) federal, state, or local government records; (2) widely distributed media; or (3) …

Sec. 14. As used in this chapter, "risk assessment" means the assessment a licensee is required to conduct under section 17 of this chapter. As added by P.L.130-2020, SEC.10.

Sec. 15. As used in this chapter, "third party service provider" means a person that contracts with a licensee to maintain, process, store, or otherwise is permitted access to nonpublic information through its provision of services to the licensee. As added by P.L.130-2020, SEC.1…

Sec. 16. (a) A licensee shall develop, implement, and maintain a comprehensive, written information security program that: (1) is based on the risk assessment required under section 17 of this chapter; and (2) contains administrative, technical, and physical safeguards for the pr…

Sec. 17. A licensee shall conduct a risk assessment of its information systems and treatment of nonpublic information by doing the following: (1) Designating one (1) or more employees, an affiliate, or an outside vendor designated to act on behalf of the licensee information secu…

Sec. 18. Based on the results of the risk assessment, a licensee shall do the following: (1) Design its information security program to mitigate the identified risks, commensurate with: (A) the licensee's size and complexity; (B) the nature and scope of the licensee's activities;…

Sec. 19. (a) If the licensee has a board of directors, the board of directors shall require the licensee's executive management or its delegates to develop, implement, and maintain the licensee's information security program. (b) If the licensee's executive management delegates a…

Sec. 2. As used in this chapter, "authorized individual" means an individual authorized by the licensee to have access to the nonpublic information held by the licensee and its information systems. As added by P.L.130-2020, SEC.10.

Sec. 20. (a) As part of its information security program, a licensee shall establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event. (b) An incident response plan must include the following: (1) The internal process for…

Sec. 21. (a) If a licensee learns that a cybersecurity event has or may have occurred, the licensee, or an outside vendor or service provider designated to act on the licensee's behalf, shall conduct a prompt investigation. During the investigation, the licensee or outside vendor…

Sec. 22. (a) In the case of a cybersecurity event involving nonpublic information that: (1) is used by a licensee acting as an assuming insurer; or (2) is in the possession, custody, or control of a licensee that: (A) is acting as an assuming insurer; and (B) does not have a dire…

Sec. 23. (a) In the case of a cybersecurity event: (1) that involves nonpublic information: (A) that is in the possession, custody, or control of a licensee that is an insurer or its third party service provider; and (B) for which a consumer accessed the insurer's services throug…

Sec. 24. (a) The commissioner may examine and investigate into the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of this chapter. This power is in addition to the other powers the commissioner has under this title. An…

Sec. 25. (a) Any documents, materials, or other information in the control or possession of the department that are: (1) furnished by a licensee or an employee or agent acting on behalf of a licensee under section 20(c), 21(d)(2) through 21(d)(5), 21(d)(8), or 21(d)(10) through 2…

Sec. 26. (a) A licensee is exempt from sections 16 through 20 of this chapter if the licensee has: (1) fewer than fifty (50) employees; (2) less than five million dollars ($5,000,000) in gross annual revenue; or (3) less than ten million dollars ($10,000,000) in year-end total as…

Sec. 27. If a licensee violates this chapter, the insurance commissioner may, after notice and hearing under IC 4-21.5, suspend or revoke the license, certificate of authority, or registration of the licensee. As added by P.L.130-2020, SEC.10.

Sec. 28. The insurance commissioner may adopt rules under IC 4-22-2 to carry out the provisions of this chapter. As added by P.L.130-2020, SEC.10.

Sec. 29. This chapter does not create a private right of action against any person. As added by P.L.130-2020, SEC.10.

Sec. 3. As used in this chapter, "commissioner" refers to the insurance commissioner appointed under IC 27-1-1-2. As added by P.L.130-2020, SEC.10.

Sec. 30. Notwithstanding any other provision of law, this chapter establishes the exclusive state standards applying to licensees for: (1) data security; (2) the investigation of a cybersecurity event; and (3) notification to the insurance commissioner concerning a cybersecurity …

Sec. 31. The requirements of this chapter do not apply to a financial institution (as defined in 15 U.S.C. 6809), except to the extent the financial institution transacts insurance business. As added by P.L.130-2020, SEC.10.

Sec. 32. (a) A licensee that satisfies the requirements of this chapter is entitled to an affirmative defense to any cause of action sounding in tort that: (1) is brought under the laws or in the courts of this state; and (2) alleges that the failure to implement reasonable infor…

Sec. 4. As used in this chapter, "consumer" means a resident of Indiana whose nonpublic information is in a licensee's possession, custody, or control. As added by P.L.130-2020, SEC.10.

Sec. 5. As used in this chapter, "cybersecurity event" means an event resulting in unauthorized access to or a disruption or misuse of an information system or nonpublic information stored on the information system that has a reasonable likelihood of materially harming a consumer…