How Should Insurers Control Claims Portal Access for Adjusters and Repair Networks?

Insurers should grant claims portal access by claim assignment, role, and time period, not by company name alone. Each adjuster, appraiser, or repair-shop user should have an individual identity, multi-factor authentication, only the claim data needed for the assignment, and a defined end date. The NAIC Insurance Data Security Model Law expects licensees to exercise due diligence in selecting third-party service providers and to require appropriate protective measures (NAIC Model #668).

A claims file can hold some of the most sensitive nonpublic information an insurer maintains: injuries, medical details, financial records, photographs, and payment instructions. Independent adjusters, appraisers, repair networks, and other outside parties often need to see part of that file to do their jobs. The security question is how much of the file each person can see, for how long, and whether the insurer could reconstruct the activity afterward.

This guide gives a practical operating model for that question. The model is our recommendation. Regulations discussed here describe outcomes such as due diligence, minimum practices, and access limits, and they do not mandate a particular portal design. Your counsel determines which rules apply to you.

What are the key takeaways?

• Authorize outside users by claim, role, and expiry date, not by a standing company-wide account.
• Require individual accounts with multi-factor authentication. New York's cybersecurity regulation requires multi-factor authentication for any individual accessing a covered entity's information systems, subject to its stated exemptions (23 NYCRR 500.12).
• Rank vendors by the data they can reach, then match review depth to risk, as the NAIC's own examination mapping describes (NAIC mapping).
• Decide in advance how you will suspend one user, one firm, or one integration when something looks wrong.

Which outside parties belong in a claims access inventory?

Start with the people and systems that can touch a claim, not the vendor list in procurement. The NAIC model defines a third-party service provider as a person that contracts with a licensee to maintain, process, store, or otherwise is permitted access to nonpublic information through services provided to the licensee (NAIC Model #668). New York's regulation uses similar language for entities that maintain, process, or are permitted access to nonpublic information (23 NYCRR Part 500). A repair shop that uploads estimates and a firm that reviews injury files both fit that description, even though their risk differs.

For each outside party, record the claim lines it supports, the portal or interface it uses, whether access is by named person or by shared or integrated account, the data fields visible, and the business owner who can approve or end the relationship. Include subcontractors. An adjuster firm that passes work to an overflow contractor has extended your access path whether or not you contracted with that second party.

Shared logins make attribution impossible, and application-to-application integrations (such as estimate or photo upload services) often run with broad service credentials that nobody reviews after the project ends.

How do you limit access to only the claims someone needs?

New York's regulation requires covered entities, based on their risk assessment, to limit user access privileges to information systems providing access to nonpublic information to only those necessary to perform the user's job, and to limit the use of privileged accounts to when they are needed (23 NYCRR 500.7). Applied to a claims portal, we recommend three layers.

• Assignment-based visibility. The user sees only the claims assigned to that user or that firm, not the whole catastrophe-event queue. If the portal cannot enforce this, treat the portal as a material finding in your vendor review.
• Role-based fields. A body shop needs vehicle photos and estimates. It generally does not need the claimant's full medical or banking details. Mask or omit fields rather than relying on instructions.
• Time-bound assignment. Access should end when the assignment closes or after a fixed period without activity. Surge periods after a storm are when temporary access gets created quickly and left open longest, so set the expiry at provisioning.

The same regulation requires periodic review of user access privileges, at a minimum annually, and removal or disabling of access that is no longer necessary (23 NYCRR 500.7). For high-turnover outside parties, we suggest monthly or per-assignment attestation by the sponsoring claims owner.

What authentication should outside users meet?

Individual accounts come first. The text of 23 NYCRR 500.12 requires multi-factor authentication for any individual accessing any information systems of a covered entity, with a limited-exemption pathway described in the rule (23 NYCRR 500.12). Even where your organization is not subject to that rule, a claims portal that accepts only a password from an outside party is hard to defend to underwriters or customers. Our guide to what cyber insurance underwriters expect in 2026 covers the same control family from the cyber-coverage side.

Also decide how a person's credentials end when they leave a vendor. The access-privilege rule above includes promptly terminating access following departures for the covered entity's own users (23 NYCRR 500.7). For outside users, your contract should require the vendor to notify you of departures within a stated period, and your process should verify against activity records rather than trust the notice alone.

What should the vendor review and contract cover?

The NAIC model asks licensees to exercise due diligence in selecting a third-party service provider and to require appropriate administrative, technical, and physical measures to protect information systems and nonpublic information accessible to or held by that provider (NAIC Model #668). The model gives a longer implementation period for this provision than for its other information-security-program sections (NAIC Model #668).

New York spells the expectation out in more detail. A covered entity's written policies must address identification and risk assessment of providers, minimum cybersecurity practices, due diligence, and periodic assessment, and should include guidelines on provider access controls including multi-factor authentication, encryption, notice of a cybersecurity event, and representations and warranties (23 NYCRR Part 500, section 500.11). Those four contract topics make a sound starting list for a claims-vendor addendum even outside New York.

The NAIC's examination mapping goes one step further on how regulators may read the model. It describes a formal process in which the company ranks vendors, uses the ranking to set the depth and frequency of review, determines appropriate access rights from the risk assessment, and designs mitigation such as network monitoring specific to third-party service providers and access controls (NAIC mapping). A small appraisal firm and a claims administrator integrated into your core system should not get the same questionnaire.

What activity records do you need to keep?

Work backward from what you will need on a bad day. We suggest the record answer these questions for every outside user: who signed in, from where, which claims were opened, which documents were downloaded, which fields changed, and which payment or contact details were edited. If your portal logs only sign-in events, you can tell that someone arrived but not what they took.

Send those records to a monitored location outside the portal's own administrator control. Our U.S.-based security operations center (SOC) can monitor and investigate within the authority an insurer agrees to, using managed detection and response and SOC as a service. The detection logic should be simple and reviewable, such as unusual download volume for a single user, access outside the assigned claim set, or edits to payment instructions by an account that does not normally make them.

Payment-detail changes are worth a separate rule. A compromised outside account that can edit a payee or contact number turns a data event into a financial one. Require out-of-band confirmation with the claims owner for any change in payment instructions initiated by an outside party.

How should an incident with an outside party work?

The NAIC model addresses a related scenario: if the licensee learns a cybersecurity event has or may have occurred in a system maintained by a third-party service provider, the licensee completes the investigation steps itself or confirms and documents that the provider has completed them (NAIC Model #668). That language implies you need to ask the provider specific questions quickly and receive records in a usable form.

Put three items into the runbook before you need them: a named contact at the vendor with after-hours reach, authority for your team to suspend a user or an entire firm without waiting for the vendor, and a list of claims touched by the account in question. Our guides on healthcare vendor remote support and manufacturing vendor session approval use the same pattern in other sectors, and the FTC Safeguards vendor evidence guide covers the evidence side.

A 10-question review for your claims portal

• Can every outside user be identified as a named person, with no shared logins?
• Is multi-factor authentication enforced for every outside user, and can we show it?
• Does each user see only assigned claims and only the fields needed?
• Does every account have an expiry or an assignment-close trigger?
• Who attests monthly or per assignment that each account is still needed?
• Do integrations use scoped credentials with a named owner?
• Do logs show downloads, field changes, and payment-detail edits by user?
• Can we suspend one user, one firm, or one integration without affecting other claims?
• Does the contract require departure notices, event notices, and cooperation with an investigation?
• Have we tested the process on a sample vendor in the last year?

If several answers are unknown, treat that as the finding. Our insurance security page and the insurance security assessment are practical places to begin scoping the work.

What else should insurers know about claims portal access?

Does the NAIC model law require a specific claims portal design?

No. It requires licensees to exercise due diligence in selecting third-party service providers and to require appropriate protective measures for information systems and nonpublic information accessible to them (NAIC Model #668). Design choices follow your risk assessment.

Is multi-factor authentication required for outside adjusters?

Under New York's 23 NYCRR 500.12, multi-factor authentication applies to any individual accessing any information systems of a covered entity, subject to the limited exemption the rule describes (23 NYCRR 500.12). Other jurisdictions differ, so confirm which rules apply to you. We recommend it for all outside users regardless.

How often should outside user access be reviewed?

New York's rule requires a periodic review of user access privileges, at a minimum annually (23 NYCRR 500.7). For high-turnover outside parties, we recommend a monthly or per-assignment attestation by the sponsoring claims owner.

What should a claims vendor contract say about cybersecurity?

Section 500.11 lists guideline topics for provider due diligence or contract protections: access controls including multi-factor authentication, encryption, notice of a cybersecurity event, and representations and warranties (23 NYCRR Part 500). Add departure notices and cooperation with investigations.

Should repair networks and appraisers get the same review as a claims administrator?

Not necessarily. The NAIC examination mapping describes ranking vendors and using the ranking to set the depth and frequency of review (NAIC mapping). A vendor with an integration into a core system or broad claim access should receive deeper review than one with a narrow assignment.

Who monitors outside-party activity in the claims portal?

Responsibility should be written down. Many insurers route portal and identity records to a monitored security operations function, whether internal or managed, with defined authority to suspend accounts. Cyberuptive's SOC can operate within the authority an insurer agrees to.

What is the next step for your organization?

Bring your claims portal, current vendor list, and unresolved ownership questions to a focused discussion. Schedule a security review or Call 833-92-CYBER to clarify the next practical actions.