Data breach a growing concern for insurance application process.

The recent theft of a file server at American International Group Inc. containing personal information of 930,000 people raises new questions about data breach liability.

Where does liability begin and end for an insurance carrier in data breach incidents where the persons whose identities are exposed are not yet policyholders or customers? Is it the insurer or intermediary that is ultimately responsible and liable for confidential client information misplaced during the initial application process?

Experts say the answers to these questions may depend on a number of factors, including who held the data and for how long; what type of information was contained in the application; the terms of agreement between the prospective customer and intermediary; the source of the application; and the technology contract, if any, between the carrier and the intermediary.

Certain federal laws designed to safeguard customers' non-public personal information already apply to insurance practices. Confidential medical information, for example, is governed by the Health Insurance Portability and Accountability Act, while the Gramm-Leach-Bliley Act and Fair Credit Reporting Act protect the use and dissemination of other non-public personal information.

But Jeff Junkas of the American Insurance Institute said these laws deal typically with companies that are owners of the data at risk, which leaves some gray areas in how and when they are applied.

Currently there are 31 state security breach notification laws, with California's being the one most often mimicked, said Lisa Sotto, head of the privacy practice at law firm Hunton & Williams and vice-chair of the U.S. Department of Homeland Security's Privacy Advisory Committee.

"The California law says it is the responsibility of the data owner or licensor to make notification to individuals when there has been a compromise. And there is another provision that says any person or business that maintains computerized data that has been subject to unauthorized acquisition needs to notify the data owner or licensor," Sotto said.

But according to Sotto, the tricky part is identifying who should be considered the data owner or licensor.

"We do not have in these laws definitions for 'owner' or 'licensor,'" Sotto said.

In AIG's case, the personal information on the file server was contained in requests for quotes submitted by a total of 690 brokers to AIG. The brokers were working on behalf of employers looking to purchase excess medical coverage for their employees, some suffering from catastrophic illnesses.

"This wasn't a database of our policyholders, where we had collected the data and formatted it and were directly responsible for it," spokesman Chris Winans said.

There's no question, Winans added, that AIG is responsible for keeping people from stealing from its offices, "but who's actually and ultimately responsible for the integrity of the data--we're not even trying to answer that question."

Jeff Yates, executive director of the Agents Council for Technology, said barring a technology agreement between the agent and the carrier, "it would be crazy to suggest that the agent would have the responsibility to protect information once it gets into the carriers' system."

A common sense solution would be that the entity that has the information or application is responsible until it transfers that information along to another party, Junkas said.

That also leads to another issue: Who is responsible for application data breached during transit?

Etti Baranoff, assistant professor of insurance and finance at Virginia Commonwealth University's Risk Management and Insurance Studies Center, said while data in transit "is in no man's land," liability ultimately would rest with the agents since they are the only connection to the data.

Indeed, the process by which most agents send applications to carriers is vulnerable to security breaches, Yates said. "What happens quite often in commercial lines is the agent sends the application as an attachment to the e-mail, and because e-mail is open and not encrypted, the information is not secure," said Yates.

DATA SECURITY: Veteran Affairs Secretary Jim Nicholson testified before the House Committee on Government Reform in Washington, D.C., in June and accepted responsibility for the theft of personal information for 26.5 million military personnel and veterans. Nicholson told Congress that improving security measures won't happen overnight.

Data Breaches

Date Made                                                  Number
Public           Company                                 Affected

June 14, 2006    American International Group (AIG)       930,000

April 26, 2006   Aetna                                     38,000

April 6, 2006    Progressive Casualty Insurance                13

Feb. 16, 2006    Blue Cross and Blue Shield of Florida     27,000

Feb. 1, 2006     Blue Cross and Blue Shield of N.C.           600

Source: Privacy Rights Clearinghouse