What cybersecurity and privacy changes affect outsourced claim files?

What should New York-regulated buyers already have implemented?

The expanded MFA milestone is past, not upcoming. From 1 November 2025, DFS’s requirements generally extended MFA to individuals accessing a covered entity’s information systems, subject to the specified limited-exemption and approved-compensating-control provisions. The limited exemption still carries defined MFA requirements, including certain remote and third-party application access. (dfs.ny.gov)

DFS’s 21 October 2025 third-party guidance expressly identifies insurance claims management as a potentially critical service. It states that covered entities cannot delegate Part 500 compliance responsibility and clarifies existing obligations rather than imposing new ones. It addresses diligence, contracts, oversight and termination; some suggested contractual practices are recommendations rather than explicit regulatory requirements. (dfs.ny.gov)

Recommended vendor test: ask a production partner to demonstrate account provisioning, removal of access after departure, subcontractor access visibility, incident escalation and a usable exit export. Review whether the evidence covers the actual claims-production environment rather than an unrelated product or corporate system.

Why negotiate California’s 2028 privacy requirements now?

California SB 354 establishes a revised insurance-privacy framework with a main operative date of 1 July 2028. The official announcement addresses insurer and third-party handling of personal information, consumer rights and restrictions on certain sharing and uses; additional implementation arrangements apply to retention/deletion policies and producers. (sd21.senate.ca.gov)

Our procurement recommendation: contracts expected to run into 2028 should already specify permitted purposes, downstream access, assistance with consumer requests and a controlled change process for new data uses. Negotiate model-training restrictions explicitly; do not assume a general permission to process claim files answers every future secondary-use question.

Retain a legal-hold and required-retention exception process. A privacy workflow should not indiscriminately delete claim evidence needed for another applicable obligation.