Skip to content
RuleResource Intelligence

← All developments

Missouri Department of Insurance · October 24, 2026 · Primary source

26-01 - Insurance Data Security Act, January 5, 2026

Score 53PRIMARYregulatoryState insurance deptMO

Summary

The Missouri Department of Commerce and Insurance issued Bulletin 26-01 on January 5, 2026, providing implementation guidance for the Missouri Insurance Data Security Act, sections 375.1400 to 375.1427 RSMo Supp. 2025, which took effect January 1, 2026. The bulletin establishes an electronic cybersecurity event notification form and clarifies reporting obligations for events occurring at third-party service providers. It also identifies categories of entities excluded from the definition of licensee, including HMOs, health services corporations, prepaid dental plan corporations, and captive insurers, because those entities are governed by separate statutory schemes that do not incorporate general insurance laws.

What this may mean

Missouri insurance licensees, excluding HMOs, health services corporations, and captive insurers, must use the Department's electronic notification portal to report qualifying cybersecurity events under section 375.1410 RSMo Supp. 2025 as of January 1, 2026. Licensees must also notify the Director when a cybersecurity event occurs at a third-party service provider with access to nonpublic information, treating such events the same as direct incidents under section 375.1410.1. HMOs and other chapter 354 entities fall outside the Act's licensee definition and are not subject to these reporting requirements.

Informational only. Not legal, medical, financial, or other professional advice. Always consult a qualified professional familiar with your specific facts before relying on any item.

Related items