When the Integration Vendor Owns the Data
A mid-sized insurer uses a SaaS claims platform. The platform stores claims data and calls a separate SaaS document-storage service to hold scanned claim forms. The insurer's contract with the claims platform says the insurer owns its data, but the platform's terms allow it to use "aggregated service data" for product improvement. The document service is chosen by the claims platform, not the insurer, and the insurer has no direct contract with it. A regulator asks the insurer to demonstrate where claim data is stored, who can access it, and how it would be retrieved if either provider failed. The insurer's IT team discovers it can export claims data as CSV but the scanned forms are only retrievable through the platform's interface.
1. Assess the insurer's exposure and recommend contractual and technical actions.
Read the worked answer
The insurer has a governance gap rather than a purely technical one. It has a contract with the claims platform but not with the document service, so it is relying on a sub-processor it has not vetted and cannot directly instruct. The "aggregated service data" clause is ambiguous: aggregated data may be low risk, but the insurer must confirm what is aggregated and whether any claim-level detail could be inferred. The retrieval finding is the most serious: claims data can be exported, but scanned forms can only be obtained through the platform's interface, so if the platform fails or the relationship ends, the insurer may lose access to evidence it is obliged to keep.
Contractual actions: require the platform to disclose its sub-processors, including the document service, and to flow down the insurer's data-protection obligations to them; narrow or clarify the aggregated-data clause; add a data-return and exit clause specifying formats and timeframes for all data, including scanned forms; and add notification and assistance obligations for provider failure. Technical actions: establish a tested export of scanned forms, either through a bulk export function or by mirroring forms to storage the insurer controls, and document where data is stored and who can access it so the regulator's questions can be answered with evidence rather than assurance.
2. The regulator asks how the insurer would respond if the document service failed tomorrow. Outline the answer the insurer should be able to give, and what it must do to make that answer true.
Read the worked answer
The insurer should be able to state: which data is held by which provider and where; who can access it and under what controls; what the recovery time and recovery point would be; and how data would be retrieved and verified. To make that true it must first map the data flows, including the sub-processor relationship it did not choose. It must then obtain from the platform a documented recovery capability for the document service, or build its own copy of scanned forms in storage it controls. It must test retrieval, not assume it: an export that has never been run and checked is not a recovery plan. Finally it must record the results and review them periodically, because sub-processors change.
The judgement point is that the insurer cannot outsource accountability. Even though it did not select the document service, it remains responsible to the regulator for the claim data, so it must either gain contractual control over that service or reduce its dependence on it.