Pennsylvania Act 2013-78 — INSURANCE COMPANY LAW OF 1921 - ELECTRONIC DELIVERY OF INFORMATION AND POSTING OF POLICIES AND ENDORSEMENTS AND RISK MANAGEMENT AND OWN RISK SOLVENCY ASSESSMENT

Act text

Session of 2013

No. 2013-78

HB 1481

AN ACT

Amending the act of May 17, 1921 (P.L.682, No.284), entitled "An act relating to insurance; amending, revising, and consolidating the law providing for the incorporation of insurance companies, and the regulation, supervision, and protection of home and foreign insurance companies, Lloyds associations, reciprocal and inter-insurance exchanges, and fire insurance rating bureaus, and the regulation and supervision of insurance carried by such companies, associations, and exchanges, including insurance carried by the State Workmen's Insurance Fund; providing penalties; and repealing existing laws," providing for electronic delivery of information and posting of policies and endorsements and for risk management and own risk solvency assessment.

The General Assembly of the Commonwealth of Pennsylvania hereby enacts as follows:

Section 1. The act of May 17, 1921 (P.L.682, No.284), known as The Insurance Company Law of 1921, is amended by adding a section to read:

Section 354.7. Electronic Delivery of Information and Posting of Policies and Endorsements.--(a) (1) With regard to any law or regulation of this Commonwealth requiring an insurer to provide, send or deliver information, notices or documents in writing to an insured or applicant as part of an insurance transaction if the insurer and the insured or applicant have agreed to conduct a transaction by electronic means, the requirement is satisfied if the information is provided, sent or delivered, as the case may be, in an electronic record capable of retention by the recipient at the time of receipt. An electronic record is not capable of retention by the recipient if the sender or its information processing system inhibits the ability of the recipient to print or store the electronic record. The provisions of the act of December 16, 1999 (P.L.971, No.69), known as the "Electronic Transactions Act," shall otherwise apply to the insurer and the insured or applicant with respect to the providing, sending or delivering of the information, notices or documents.

(2) Any law or regulation requiring an insurer to send multiple copies of the information, notices or documents shall not apply where the insurer provides, sends or delivers the information, notices or documents in accordance with the provisions of the "Electronic Transactions Act."

(3) An insurer providing, sending or delivering information, notices or documents shall satisfy any font, size, spacing or other format requirements if the electronic information, notices or documents as provided, sent or delivered by the insurer meet those requirements and may be printed or saved by the insured or applicant using programs or applications widely available on the Internet and free of charge to use.

(b) Notwithstanding subsection (a) or any other law or regulation of this Commonwealth requiring an insurer to provide, send or deliver an insurance policy or endorsement to an insured, an insurer may elect to post a policy or endorsement that does not contain personally identifiable information on its Internet website provided it complies with all of the following:

(1) The policy or endorsement is easily accessible on the Internet website so long as it is in force.

(2) The policy or endorsement is posted in a manner that enables the insured to print and save it using programs or applications widely available on the Internet and free of charge to use.

(3) The insurer provides notice, in the manner it normally communicates with the insured, at the time of issuance or renewal of the policy or endorsement, or at the time of any changes to the policy or endorsement, of a method by which the insured may obtain, upon request and without charge, a paper or electronic copy of the policy or endorsement, or any changes to them, and the Internet address where the policy and endorsement are posted.

(4) The insurer provides all of the following information on each declarations page, or similar document as appropriate to the line of coverage, provided to the insured at the time of issuance or renewal:

(i) A description of the exact policy and endorsement forms purchased by the insured.

(ii) A method by which the insured may obtain, upon request and without charge, a paper or electronic copy of the policy or endorsement, or any changes to them.

(iii) The Internet address where the policy and endorsement are posted.

(5) After expiration of the policy or endorsement, the insurer archives the expired policies or endorsements in accordance with the Insurance Department's general record retention requirements and makes them available upon request.

(c) Upon satisfactory evidence of the violation of this section by an insurer, the Insurance Commissioner may, in his discretion, pursue one or more of the following courses of action:

(1) Suspend or revoke the license of the insurer.

(2) Refuse, for a period not to exceed one year thereafter, to issue a new license to the insurer.

(3) Impose a fine of not more than one thousand dollars ($1,000) for each act in violation of this section.

Section 2. The act is amended by adding an article to read:

ARTICLE XXVI

RISK MANAGEMENT AND OWN RISK SOLVENCY ASSESSMENT

Section 2601. Purpose and scope of article.

(a) Purpose.--The purpose of this article is to:

(1) Require an insurer or insurance group to maintain a risk management framework and complete an own risk and solvency assessment (ORSA).

(2) Set forth the requirements for filing an ORSA summary report with the Insurance Department.

(3) Provide for the confidential treatment of the ORSA, the ORSA summary report and other ORSA-related information, which contain trade secrets and other proprietary information that, if made public, could potentially cause the insurer or insurance group competitive harm or disadvantage.

(b) Scope.--The requirements of this article shall apply to all insurers domiciled in this Commonwealth unless exempt under section 2606.

Section 2602. Definitions.

The following words and phrases when used in this article shall have the meanings given to them in this section unless the context clearly indicates otherwise:

"Commissioner." The Insurance Commissioner of the Commonwealth.

"Department." The Insurance Department of the Commonwealth.

"Insurance group." The insurers and affiliates included within an insurance holding company system as defined in section 1401.

"Insurer." Any fraternal benefit society, health maintenance organization, preferred provider organization, company, association, exchange, hospital plan corporation as defined in and subject to 40 Pa.C.S. Ch. 61 (relating to hospital plan corporations) or professional health services plan corporation subject to 40 Pa.C.S. Ch. 63 (relating to professional health services plan corporations), authorized by the Insurance Commissioner to transact the business of insurance in this Commonwealth except that the term shall not include:

(1) the Commonwealth or any agency or instrumentality thereof; or

(2) agencies, authorities or instrumentalities of the United States, its possessions and territories, the Commonwealth of Puerto Rico, the District of Columbia or a state or political subdivision.

"NAIC." The National Association of Insurance Commissioners or successor organization and its affiliates and subsidiaries.

"ORSA guidance manual." The current version of the Own Risk and Solvency Assessment Guidance Manual developed and adopted by the NAIC and as amended. A change in the ORSA guidance manual will be effective on January 1 following the calendar year in which the change was adopted by the NAIC.

"ORSA-related information." The ORSA, ORSA summary report, risk management framework or any documents, materials or other information related to an insurer or insurance group's ORSA, ORSA summary or risk management framework.

"ORSA summary report." The confidential high-level summary of an insurer or insurance group's ORSA.

"Own risk and solvency assessment" or "ORSA." A confidential internal assessment, appropriate to the nature, scale and complexity of an insurer or insurance group, conducted by that insurer or insurance group, of the material and relevant risks associated with the insurer or insurance group's current business plan and the sufficiency of capital resources to support those risks.

Section 2603. Risk management framework.

An insurer shall maintain a risk management framework for identifying, assessing, monitoring, managing and reporting its material and relevant risks. This requirement may be satisfied if the insurance group of which the insurer is a member maintains a risk management framework applicable to the operations of the insurer.

Section 2604. ORSA requirement.

An insurer, or the insurance group of which the insurer is a member, shall conduct an ORSA consistent with the guidelines set forth in the ORSA guidance manual. The ORSA shall be conducted regularly, but no less frequently than annually, and at any time when there are significant changes to the risk profile of the insurer or the insurance group of which the insurer is a member.

Section 2605. ORSA summary report.

(a) General rule.--Beginning January 1, 2015, and every year thereafter, a domestic insurer or an insurer that is a member of an insurance group of which Pennsylvania is the lead state as determined by the financial analysis handbook adopted by the NAIC shall submit an ORSA summary report to the department once per calendar year. The insurer or insurance group shall determine the most appropriate date of filing based upon the insurer or insurance group's internal strategic planning processes and notify the department of the anticipated date of filing by June 1 of each year.

(b) Exception.--An insurer not required to submit an ORSA summary report under subsection (a) shall do so upon the department's request, but not more than once per calendar year. The insurer shall determine the most appropriate date of the filing based upon the insurer's internal strategic planning processes and notify the department of the anticipated date of filing within 30 days of the department's request.

(c) Form of summary report.--An insurer may comply with subsection (a) or (b) by providing to the department either of the following:

(1) A combination of reports that together contain the information described in the ORSA guidance manual.

(2) A copy of the most recent reports submitted by the insurer, or another member of an insurance group of which the insurer is a member, to the chief insurance regulatory official of another state or to a supervisor or regulator of a foreign jurisdiction, if that report is substantially similar to the ORSA summary report. For purposes of this section, "substantially similar" means containing information comparable to the information described in the ORSA guidance manual as determined by the commissioner. If the report is in a language other than English, it must be accompanied by a translation of that report into the English language.

(d) Attestation.--The ORSA summary report must include a signature of the insurer or insurance group's chief risk officer or other executive having responsibility for the oversight of the insurer's risk management process attesting to the best of that person's belief and knowledge that the insurer applies the risk management process described in the ORSA summary report and that a copy of the report has been provided to the insurer's board of directors or the appropriate committee thereof.

(e) Compliance with ORSA guidance manual.--The ORSA summary report must be prepared in accordance with the ORSA guidance manual. Documentation and supporting information must be maintained and made available upon request in an examination conducted pursuant to section 1406 or Article IX of the act of May 17, 1921 (P.L.789, No.285), known as The Insurance Department Act of 1921.

(f) Review by department.--The department shall review the ORSA summary report and make additional requests for information using procedures similar to current procedures for coordinating analysis and examination of multistate or global insurers and insurance groups.

(g) Summary of material changes and updates.--The ORSA summary report should also include a short summary of material changes and updates to the ORSA summary report since the prior year.

Section 2606. Exemption.

(a) General rule.--An insurer is exempt from the requirements of this article, if:

(1) the insurer has annual direct written and unaffiliated assumed premium, including international direct and assumed premium but excluding premiums reinsured with the Federal Crop Insurance Corporation and Federal Flood Program, less than $500,000,000; and

(2) the insurer is a member of an insurance group, the insurance group has annual direct written and unaffiliated assumed premium, including international direct and assumed premium but excluding premiums reinsured with the Federal Crop Insurance Corporation and Federal Flood Program, less than $1,000,000,000.

(b) Partial exemption for insurer.--If an insurer is exempt under subsection (a)(1), but the insurance group of which the insurer is a member is not exempt under subsection (a)(2), then the ORSA summary report must include every insurer within the insurance group. This requirement may be satisfied by the submission of more than one ORSA summary report for any combination of insurers if the reports include every insurer within the insurance group.

(c) Partial exemption for insurance group.--If an insurer is not exempt under subsection (a)(1), but the insurance group of which the insurer is a member is exempt under subsection (a)(2), then the insurer shall file the ORSA summary report applicable only to the insurer.

(d) Waiver.--An insurer that is not exempt under subsection (a) may apply to the commissioner for a waiver from the requirements of this article based upon unique circumstances. If the insurer is a member of an insurance group with insurers domiciled in more than one state, the commissioner shall coordinate with the lead state commissioner and with the other domiciliary commissioners in considering whether to grant the insurer's request for a waiver. In deciding whether to grant the insurer's request for a waiver, the commissioner may consider:

(1) The type and volume of business written.

(2) Ownership and organizational structure.

(3) Material reduction in risk or risk exposures.

(4) Any other factor the commissioner determines to be relevant to whether a waiver should be granted.

(e) Additional requirements.--Notwithstanding the exemptions under subsection (a):

(1) The commissioner may require that an insurer maintain a risk management framework, conduct an ORSA and file an ORSA summary report based on unique circumstances, including the type and volume of business written, ownership and organizational structure, Federal agency requests and international supervisor requests. If the commissioner requires an insurer to maintain a risk management framework, conduct an ORSA and file an ORSA summary report under this paragraph, the insurer shall have one year after receiving written notice to comply with the requirement.

(2) The commissioner may require that an insurer maintain a risk management framework, conduct an ORSA and file an ORSA summary report if the insurer:

(i) has risk-based capital for a company action level event as set forth in sections 506-A and 505-B of the act of May 17, 1921 (P.L.789, No.285), known as The Insurance Department Act of 1921;

(ii) meets one or more of the standards of an insurer deemed to be in hazardous financial condition as defined in 31 Pa. Code Pt. VIII Ch. 160 (relating to standards to define insurers deemed to be in hazardous financial condition); or

(iii) otherwise exhibits qualities of a troubled insurer as determined by the commissioner.

(3) If an insurer exempt under subsection (a) no longer qualifies for that exemption due to changes in premium as reflected in the insurer's most recent annual statement or in the most recent annual statements of the insurers within the insurance group of which the insurer is a member, the insurer shall have one year after the year the threshold is exceeded to comply with the requirements of this article.

Section 2607. Third-party consultants.

(a) Authorization.--The department may retain, at the insurer's expense, third-party consultants, including attorneys, actuaries, accountants and other experts not otherwise a part of the department's staff as may be reasonably necessary to assist the department in reviewing the risk management framework, ORSA, ORSA summary report or the insurer's compliance with this article.

(b) Control.--Any persons retained under subsection (a) shall be under the direction and control of the department and shall act in a purely advisory capacity.

(c) Confidentiality.--Third-party consultants shall be subject to the same confidentiality standards and requirements as the department.

(d) Verification.--As part of the retention process, a third-party consultant shall verify to the department, with notice to the insurer, that it is free of a conflict of interest and that it has internal procedures in place to monitor compliance with a conflict and to comply with the confidentiality standards and requirements of this act.

(e) Written consent.--A retention agreement with a third-party consultant shall expressly require the written consent of the insurer prior to making public information provided under this act, as required under section 2608(a).

Section 2608. Confidentiality.

(a) General rule.--The ORSA-related information in the possession of or the control of the department that is produced by, obtained by or disclosed to the department or any other person under this article shall be privileged and given confidential treatment and shall not be:

(1) Subject to discovery or admissible as evidence, in a private civil action.

(2) Subject to subpoena.

(3) Subject to the act of February 14, 2008 (P.L.6, No.3), known as the Right-to-Know Law.

(4) Made public by the department or any other person without the prior written consent of the insurer to which it pertains, except as provided in subsection (c).

(b) Private civil actions.--The commissioner, department or any individual or person who receives ORSA-related information while acting under the authority of the commissioner or department or with whom the ORSA-related information is shared pursuant to this article shall not be permitted or required to testify in any private civil action concerning the ORSA-related information.

(c) Use of ORSA-related information by the department.--To assist in the performance of regulatory duties, the department:

(1) May use ORSA-related information in furtherance of any regulatory or legal action brought as part of the department's official duties.

(2) May share ORSA-related information with the NAIC, regulatory or law enforcement officials of this Commonwealth or other jurisdictions, group supervisors, members of any supervisory college under section 1406.1 and with third-party consultants under section 2607, provided that, prior to receiving the ORSA-related information, the recipient demonstrates by written statement the necessary authority and intent to provide the same confidential treatment as required by this article.

(3) May receive and maintain as confidential ORSA-related information from the NAIC, regulatory or law enforcement officials of this Commonwealth or other jurisdictions, group supervisors and members of any supervisory college under section 1406.1 in which the ORSA-related information is confidential by law in those jurisdictions. ORSA-related information obtained under this paragraph shall be given confidential treatment, may not be subject to subpoena and may not be made public by the department, commissioner or any other person.

(d) Written agreements.--The department shall enter into written agreements with the NAIC or a third-party consultant governing sharing and use of information provided under this article that includes all of the following:

(1) Specific procedures and protocols for maintaining the confidentiality and security of ORSA-related information.

(2) Procedures and protocols for sharing ORSA-related information with regulators from other states in which the insurance group has domiciled insurers, including a written acknowledgment of the recipient's intent and legal authority to maintain the confidential and privileged status of the ORSA-related information.

(3) A provision specifying that ownership of the ORSA-related information shared remains with the department and that the use of the ORSA-related information is subject to the direction and approval of the department.

(4) A provision that prohibits storing, in a permanent database after the underlying analysis is completed, ORSA-related information shared pursuant to this article.

(5) A provision requiring the NAIC or third-party consultant, where permitted by law, to give prompt notice to the department and to the insurer regarding any subpoena, request for disclosure or request for production of the insurer's ORSA-related information in the possession of the NAIC or third-party consultant.

(6) A requirement that the NAIC or third-party consultant would consent to intervention by an insurer in any judicial or administrative action in which the NAIC or third-party consultant may be required to disclose ORSA-related information or other confidential information about the insurer or insurance group that was shared under this article.

(e) No delegation.--The sharing of information by the department under this article shall not constitute a delegation of regulatory authority or rulemaking. The department is solely responsible for the administration, execution and enforcement of this article.

(f) No waiver of privilege or confidentiality.--The sharing of ORSA-related information with, to or by the department as authorized by this article shall not constitute a waiver of any applicable privilege or claim of confidentiality.

(g) Information with third parties.--ORSA-related information in the possession or control of the NAIC or a third-party consultant as provided under this article shall:

(1) Be confidential and privileged.

(2) Not be subject to the Right-to-Know Law.

(3) Not be subject to subpoena.

(4) Not be subject to discovery or admissible as evidence, in any private civil action.

Section 2609. Sanctions.

An insurer that fails to timely file an ORSA summary report as required under this article or by regulation shall be required to pay a penalty of $200 for each day of delay. The maximum penalty under this section is $25,000 per year.

Section 2610. Regulations.

The department may promulgate rules and regulations and issue such orders as are necessary to administer and enforce this article.

Section 3. This act shall take effect as follows:

(1) The addition of section 354.7 of the act shall take effect in 60 days.

(2) This section shall take effect immediately.

(3) The remainder of this act shall take effect January 1, 2015.

APPROVED--The 25th day of October, A.D. 2013.

TOM CORBETT