1Amending the act of May 17, 1921 (P.L.789, No.285), entitled, as
2amended, "An act relating to insurance; establishing an
3insurance department; and amending, revising, and
4consolidating the law relating to the licensing,
5qualification, regulation, examination, suspension, and
6dissolution of insurance companies, Lloyds associations,
7reciprocal and inter-insurance exchanges, and certain
8societies and orders, the examination and regulation of fire
9insurance rating bureaus, and the licensing and regulation of
10insurance agents and brokers; the service of legal process
11upon foreign insurance companies, associations or exchanges;
12providing penalties, and repealing existing laws," providing
13for risk management and own risk solvency assessment.

14The General Assembly of the Commonwealth of Pennsylvania
15hereby enacts as follows:

16Section 1. The act of May 17, 1921 (P.L.789, No.285), known
17as The Insurance Department Act of 1921, is amended by adding an
18article to read:

19ARTICLE XIII

20RISK MANAGEMENT AND OWN RISK SOLVENCY ASSESSMENT

21Section 1301. Purpose and scope of article.

22(a) Purpose.--The purpose of this article is to:

23(1) Require an insurer or insurance group to maintain a

1risk management framework and complete an own risk and
2solvency assessment (ORSA).

3(2) Set forth the requirements for filing an ORSA
4summary report with the Insurance Department.

5(3) Provide for the confidential treatment of the ORSA,
6the ORSA summary report and other ORSA-related information,
7which contain trade secrets and other proprietary information
8that, if made public, could potentially cause the insurer or
9insurance group competitive harm or disadvantage.

10(b) Scope.--The requirements of this article shall apply to
11all insurers domiciled in this Commonwealth unless exempt under
12section 1306.

13Section 1302. Definitions.

14The following words and phrases when used in this article
15shall have the meanings given to them in this section unless the
16context clearly indicates otherwise:

17"Commissioner." The Insurance Commissioner of the
18Commonwealth.

19"Department." The Insurance Department of the Commonwealth.

20"Domestic insurer." An insurer that is incorporated or
21organized under the laws of this Commonwealth.

22"Insurance group." The insurers and affiliates included
23within an insurance holding company system as defined in section
241401 of the act of May 17, 1921 (P.L.682, No.284), known as The
25Insurance Company Law of 1921.

26"Insurer." Any fraternal benefit society, health maintenance
27organization, preferred provider organization, company,
28association, exchange, hospital plan corporation as defined in
29and subject to 40 Pa.C.S. Ch. 61 (relating to hospital plan
30corporations) or professional health services plan corporation

1subject to 40 Pa.C.S. Ch. 63 (relating to professional health
2services plan corporations), authorized by the Insurance
3Commissioner to transact the business of insurance in this
4Commonwealth except that the term shall not include:

5(1) the Commonwealth or any agency or instrumentality
6thereof; or

7(2) agencies, authorities or instrumentalities of the
8United States, its possessions and territories, the
9Commonwealth of Puerto Rico, the District of Columbia or a
10state or political subdivision.

11"NAIC." The National Association of Insurance Commissioners
12or successor organization and its affiliates and subsidiaries.

13"ORSA guidance manual." The current version of the Own Risk 
14and Solvency Assessment Guidance Manual developed and adopted by
15the NAIC and as amended. A change in the ORSA guidance manual
16will be effective on January 1 following the calendar year in
17which the change was adopted by the NAIC.

18"ORSA-related information." The ORSA, ORSA summary report,
19risk management framework or any documents, materials or other
20information related to an insurer or insurer group's ORSA, ORSA
21summary or risk management framework.

22"ORSA summary report." The confidential high-level summary
23of an insurer or insurance group's ORSA.

24"Own risk and solvency assessment" or "ORSA"." A
25confidential internal assessment, appropriate to the nature,
26scale and complexity of an insurer or insurance group, conducted
27by that insurer or insurance group, of the material and relevant
28risks associated with the insurer or insurance group's current
29business plan and the sufficiency of capital resources to
30support those risks.

1Section 1303. Risk management framework.

2An insurer shall maintain a risk management framework for
3identifying, assessing, monitoring, managing and reporting its
4material and relevant risks. This requirement may be satisfied
5if the insurance group of which the insurer is a member
6maintains a risk management framework applicable to the
7operations of the insurer.

8Section 1304. ORSA requirement.

9An insurer, or the insurance group of which the insurer is a
10member, shall conduct an ORSA consistent with the guidelines set
11forth in the ORSA guidance manual. The ORSA shall be conducted
12regularly, but no less frequently than annually, and at any time
13when there are significant changes to the risk profile of the
14insurer or the insurance group of which the insurer is a member.

15Section 1305. ORSA summary report.

16(a) General rule.--Beginning January 1, 2015, and every year
17thereafter, a domestic insurer or an insurer that is a member of
18an insurance group of which Pennsylvania is the lead state as
19determined by the financial analysis handbook adopted by the
20NAIC shall submit an ORSA summary report to the department once
21per calendar year. The insurer or insurance group shall
22determine the most appropriate date of filing based upon the
23insurer or insurance group's internal strategic planning
24processes and notify the department of the anticipated date of
25filing by June 1 of each year.

26(b) Exception.--An insurer not required to submit an ORSA
27summary report under subsection (a) shall do so upon the
28department's request, but not more than once per calendar year.
29The insurer shall determine the most appropriate date of the
30filing based upon the insurer's internal strategic planning

1processes and notify the department of the anticipated date of
2filing within 30 days of the department's request.

3(c) Form of summary report.--An insurer may comply with
4subsection (a) or (b) by providing to the department either of
5the following:

6(1) A combination of reports that together contain the
7information described in the ORSA guidance manual.

8(2) A copy of the most recent reports submitted by the
9insurer, or another member of an insurance group of which the
10insurer is a member, to the chief insurance regulatory
11official of another state or to a supervisor or regulator of
12a foreign jurisdiction, if that report is substantially
13similar to the ORSA summary report. For purposes of this
14section, "substantially similar" means containing information
15comparable to the information described in the ORSA guidance
16manual as determined by the commissioner. If the report is in
17a language other than English, it must be accompanied by a
18translation of that report into the English language.

19(d) Attestation.--The ORSA summary report must include a
20signature of the insurer or insurance group's chief risk officer
21or other executive having responsibility for the oversight of
22the insurer's enterprise risk management process attesting to
23the best of that person's belief and knowledge that the insurer
24applies the enterprise risk management process described in the
25ORSA summary report and that a copy of the report has been
26provided to the insurer's board of directors or the appropriate
27committee thereof.

28(e) Compliance with ORSA guidance manual.--The ORSA summary
29report must be prepared in accordance with the ORSA guidance
30manual. Documentation and supporting information must be

1maintained and made available upon request in an examination
2conducted pursuant to section 1406 of the act of May 17, 1921
3(P.L.682, No.284), known as The Insurance Company Law of 1921,
4or Article IX.

5(f) Review by department.--The department shall review the
6ORSA summary report and make additional requests for information
7using procedures similar to current procedures for coordinating
8analysis and examination of multistate or global insurers and
9insurance groups.

10(g) Summary of material changes and updates.--The ORSA
11summary report should also include a short summary of material
12changes and updates to the ORSA summary report since the prior
13year.

14Section 1306. Exemption.

15(a) General rule.--An insurer is exempt from the
16requirements of this article, if:

17(1) the insurer has annual direct written and
18unaffiliated assumed premium, including international direct
19and assumed premium but excluding premiums reinsured with the
20Federal Crop Insurance Corporation and Federal Flood Program,
21less than $500,000,000; and

22(2) the insurer is a member of an insurance group, the
23insurance group has annual direct written and unaffiliated
24assumed premium including international direct and assumed
25premium, but excluding premiums reinsured with the Federal
26Crop Insurance Corporation and Federal Flood Program, less
27than $1,000,000,000.

28(b) Partial exemption for insurer.--If an insurer is exempt
29under subsection (a)(1), but the insurance group of which the
30insurer is a member is not exempt under subsection (a)(2), then

1the ORSA summary report must include every insurer within the
2insurance group. This requirement may be satisfied by the
3submission of more than one ORSA summary report for any
4combination of insurers if the reports include every insurer
5within the insurance group.

6(c) Partial exemption for insurance group.--If an insurer is
7not exempt under subsection (a)(1), but the insurance group of
8which the insurer is a member is exempt under subsection (a)(2),
9then the insurer shall file the ORSA summary report applicable
10only to the insurer.

11(d) Waiver.--An insurer that is not exempt under subsection
12(a) may apply to the commissioner for a waiver from the
13requirements of this article based upon unique circumstances. If
14the insurer is a member of an insurance group with insurers
15domiciled in more than one state, the commissioner shall
16coordinate with the lead state commissioner and with the other
17domiciliary commissioners in considering whether to grant the
18insurer's request for a waiver. In deciding whether to grant the
19insurer's request for waiver, the commissioner may consider:

20(1) The type and volume of business written.

21(2) Ownership and organizational structure.

22(3) Material reduction in risk or risk exposures.

23(4) Any other factor the commissioner determines to be
24relevant to whether a wavier should be granted.

25(e) Additional requirements.--Notwithstanding the exemptions
26under subsection (a):

27(1) The commissioner may require that an insurer
28maintain a risk management framework, conduct an ORSA and
29file an ORSA summary report based on unique circumstances,
30including the type and volume of business written, ownership

1and organizational structure, Federal agency requests and
2international supervisor requests.

3(2) The commissioner may require that an insurer
4maintain a risk management framework, conduct an ORSA and
5file an ORSA summary report if the insurer:

6(i) has risk-based capital for a company action
7level event as set forth in sections 506-A and 505-B;

8(ii) meets one or more of the standards of an
9insurer deemed to be in hazardous financial condition as
10defined in 31 Pa. Code Part VIII, Ch. 160 (relating to
11standards to define insurers deemed to be in hazardous
12financial condition); or

13(iii) otherwise exhibits qualities of a troubled
14insurer as determined by the commissioner.

15(3) If an insurer exempt under subsection (a) no longer
16qualifies for that exemption due to changes in premium as
17reflected in the insurer's most recent annual statement or in
18the most recent annual statements of the insurers within the
19insurance group of which the insurer is a member, the insurer
20shall have one year after the year the threshold is exceeded
21to comply with the requirements of this article.

22Section 1307. Third-party consultants.

23The department may retain, at the insurer's expense, third-
24party consultants, including attorneys, actuaries, accountants
25and other experts not otherwise a part of the department's staff
26as may be reasonably necessary to assist the department in
27reviewing the risk management framework, ORSA, ORSA summary
28report or the insurer's compliance with this article. Any
29persons so retained shall be under the direction and control of
30the department and shall act in a purely advisory capacity.

1Third-party consultants are subject to the same confidentiality
2standards and requirements as the department.

3Section 1308. Confidentiality.

4(a) General rule.--The ORSA-related information that is
5produced by, obtained by or disclosed to, the department or any
6other person under this article shall be privileged and given
7confidential treatment and shall not be:

8(1) Subject to discovery or admissible as evidence in a
9private civil action.

10(2) Subject to subpoena.

11(3) Subject to the act of February 14, 2008 (P.L.6,
12No.3), known as the Right-to-Know Law.

13(4) Made public by the department or any other person
14without the prior written consent of the insurer to which it
15pertains, except as provided in subsection (c).

16(b) Private civil actions.--The commissioner, department or
17any individual or person who receives ORSA-related information
18while acting under the authority of the commissioner or
19department or with whom the ORSA-related information is shared
20pursuant to this article shall not be permitted or required to
21testify in any private civil action concerning the ORSA-related
22information.

23(c) Use of ORSA-related information by the department.--To
24assist in the performance of regulatory duties, the department:

25(1) May use ORSA-related information in furtherance of
26any regulatory or legal action brought as part of the
27department's official duties.

28(2) May share ORSA-related information with the NAIC,
29regulatory or law enforcement officials of this Commonwealth
30or other jurisdictions, group supervisors and members of any

1supervisory college under section 1406.1 of the act of May
217, 1921 (P.L.682, No.284), known as The Insurance Company
3Law of 1921, provided that, prior to receiving the ORSA-
4related information, the recipient demonstrates by written
5statement the necessary authority and intent to provide the
6same confidential treatment as required by this article.

7(3) May receive and maintain as confidential ORSA-
8related information from the NAIC, regulatory or law
9enforcement officials of this Commonwealth or other
10jurisdictions, group supervisors and members of any
11supervisory college under section 1406.1 of The Insurance
12Company Law of 1921 in which the ORSA-related information is
13confidential by law in those jurisdictions. ORSA-related
14information obtained under this paragraph shall be given
15confidential treatment, may not be subject to subpoena and
16may not be made public by the department, commissioner or any
17other person.

18(4) Shall enter into written agreements with the NAIC or
19a third-party consultant governing sharing and use of
20information provided under this article that includes all of
21the following:

22(i) Specific procedures and protocols for
23maintaining the confidentiality and security of ORSA-
24related information.

25(ii) Procedures and protocols for sharing ORSA-
26related information with regulators from other states in
27which the insurance group has domiciled insurers,
28including a written acknowledgment of the recipient's
29intent and legal authority to maintain the confidential
30and privileged status of the ORSA-related information.

1(iii) A provision specifying that ownership of the
2ORSA-related information shared remains with the
3department and that the use of the ORSA-related
4information is subject to the direction and approval of
5the department.

6(iv) A provision that prohibits storing, in a
7permanent database after the underlying analysis is
8completed, ORSA-related information shared pursuant to
9this article.

10(v) A provision requiring the NAIC or third-party
11consultant, where permitted by law, to give prompt notice
12to the department and to the insurer regarding any
13subpoena, request for disclosure or request for
14production of the insurer's ORSA-related information in
15the possession of the NAIC or third-party consultant.

16(vi) A requirement that the NAIC or third-party
17consultant would consent to intervention by an insurer in
18any judicial or administrative action in which the NAIC
19or third-party consultant may be required to disclose
20ORSA-related information or other confidential
21information about the insurer or insurer group that was
22shared under this article.

23(d) No delegation.--The sharing of information by the
24department under this article shall not constitute a delegation
25of regulatory authority or rulemaking. The department is solely
26responsible for the administration, execution and enforcement of
27this article.

28(e) No waiver of privilege or confidentiality.--The sharing
29of ORSA-related information by the department as authorized by
30this article shall not constitute a waiver of any applicable

1privilege or claim of confidentiality.

2(f) Information with third parties.--ORSA-related
3information in the possession or control of the NAIC or a third-
4party consultant as provided under this article shall:

5(1) Be confidential and privileged.

6(2) Not be subject to the Right-to-Know Law.

7(3) Not be subject to subpoena.

8(4) Not be subject to discovery or admissible in
9evidence in any private civil action.

10Section 1309. Sanctions.

11An insurer that fails to timely file an ORSA summary report
12as required under this article or by regulation shall be
13required to pay a penalty of $200 for each day of delay. The
14maximum penalty under this section is $25,000 per year.

15Section 1310. Regulations.

16The department may promulgate rules and regulations and issue
17such orders as are necessary to administer and enforce this
18article.

19Section 2. This act shall take effect January 1, 2015, or
20immediately, whichever is later.