Does Maryland's insurance data security law apply to title producers?
Short answer: not directly. The law is written for insurance carriers. But a Maryland title agency is still covered by federal rules and by what its underwriters require.
What the Maryland law says
Maryland's Insurance Data Security law is Title 33 of the Insurance Article, enacted in 2022 as Chapter 231 (Senate Bill 207) and effective October 1, 2022. It requires the entities it covers to maintain a written information security program, among other obligations.
The key word is who it applies to. The law covers "carriers," defined as authorized insurers, nonprofit health service plans, health maintenance organizations, dental plan organizations, managing general agents, and third-party administrators.
Insurance producers are not in that definition. A title insurance agency is a producer, so the law does not apply to it directly. Title insurance underwriters, as insurers, are covered. The Maryland Insurance Administration's bulletin on the written information security program requirement (Bulletin 23-18) is likewise addressed to carriers.
Why it still matters to your agency
- Your underwriters are covered. A carrier that must oversee how its information is protected has every reason to ask its agents how they protect it. Read your agency agreements and security questionnaires closely.
- Federal law covers you directly. The FTC Safeguards Rule lists real estate settlement services as covered financial institutions. See our Safeguards Rule guide.
- ALTA Best Practices covers you. Pillar 3 calls for a written information security plan and privacy plan. See the ALTA 5.0 IT checklist.
- Maryland's general breach law is separate. The Maryland Personal Information Protection Act applies to businesses that hold Maryland residents' personal information and is not limited to carriers. Ask counsel what it requires of you.
The practical answer
Whichever rule you start from, they point to the same short list of controls: a written security plan that matches reality, two-step sign-in everywhere, encryption for client information, logging, staff training, and a plan for when something goes wrong. An agency that does those things well is in good shape for its underwriter, for ALTA, and for the FTC.
The fastest first step is finding out what an outsider can already see. Our free spoofing check shows in seconds whether email can be forged from your domain.
Sources
- Chapter 231 of 2022 (Senate Bill 207), Insurance Data Security (Maryland General Assembly)
- Bulletin 23-18 (Maryland Insurance Administration)
- 16 CFR 314.2 (FTC Safeguards Rule definitions)
Common questions
Does Maryland's Insurance Data Security law apply to title insurance producers?
Not directly. Insurance Article Title 33 applies to carriers, a defined term that covers authorized insurers, nonprofit health service plans, HMOs, dental plan organizations, managing general agents, and third-party administrators. Insurance producers are not in that definition, so a title agency is not directly covered. Title underwriters are.
When did Maryland's Insurance Data Security law take effect?
The law, enacted as Chapter 231 of 2022 (Senate Bill 207), took effect October 1, 2022. Carriers had until October 1, 2023 to implement a written information security program.
If the Maryland law doesn't cover us, what does?
The federal FTC Safeguards Rule names real estate settlement services as covered financial institutions. ALTA Best Practices Pillar 3 calls for a written information security plan. Your underwriter's agency agreement may add its own requirements, and Maryland's general data breach law for businesses is separate from the insurance law.