Data Security for Remote Insurance Staff

Your remote insurance staff will handle policyholder names, policy numbers, Social Security numbers, and financial data. That is regulated information under the Gramm-Leach-Bliley Act — and working remotely does not disqualify anyone from handling it safely. What matters is whether you have the right controls in place before your hire logs in for the first time. This guide covers every item, whether you source through a referral, a staffing agency, or a marketplace like Sourced.

What Does the Law Actually Require?

The Gramm-Leach-Bliley Act requires all insurance agencies — including independent agents — to protect Non-Public Personal Information (NPI). The FTC's updated Safeguards Rule, which became fully effective in June 2023, adds three specific requirements on top of GLBA: a written information security program, multi-factor authentication for every user who accesses customer information, and documented access controls that limit each user to what their role requires.

On top of federal requirements, the NAIC Insurance Data Security Model Law has been enacted in more than 25 states. It adds breach notification timelines and incident response requirements to the GLBA baseline. If your state has adopted it, your information security program needs to satisfy both — but implementing the Safeguards Rule well generally covers the NAIC requirements too.

Does Remote Hiring Increase Your Risk?

Not inherently. The risk factors that cause data incidents — weak passwords, overly broad access, unclear onboarding, no incident-reporting process — exist whether your hire works in your office or across the country. What remote work removes is the informal oversight that in-office environments provide: a co-worker notices a screen left unattended, a supervisor catches a question before it becomes an error. Remove that ambient layer, and your written controls need to be explicit rather than assumed.

A rigorous pre-hire process reduces exposure before onboarding even starts. How to Vet a Remote Insurance Hire covers the background and reference checks worth running before you grant system access. Vetting and access controls work in tandem: one filters who gets in, the other limits what they can reach.

Five Controls to Put in Place Before Day One

These five controls align with the FTC Safeguards Rule and address the most common gaps agencies discover after a data incident. Every item should be complete before your remote hire logs in for the first time — not during their first week.

1. Least-privilege access. Provision access only to the systems and data the role requires. A policy coordinator needs AMS read access and carrier portals — not billing admin rights or coverage-binding permissions. Review what an unlicensed insurance VA can legally do to map task scope to system permissions before you start provisioning.
2. Multi-factor authentication. The FTC Safeguards Rule mandates MFA for anyone accessing customer information on your systems. This covers your AMS, carrier portals, any email account that carries policy documents, and any CRM holding policyholder data. No exceptions, including for part-time or contract staff.
3. No shared credentials. Each staff member gets their own login — remote or in-office. Shared credentials make breach attribution impossible and directly violate the Safeguards Rule's requirement to identify and authenticate users. If a carrier portal only offers one agent login, contact your carrier rep before onboarding a remote hire.
4. NDA and data handling agreement, signed before Day 1. Cover: confidentiality of policyholder NPI, no storage on personal devices, no forwarding of policy documents to personal email, and an obligation to notify you within 24 hours of any suspected unauthorized access. Also specify how access is revoked at the end of the engagement.
5. VPN or VDI for carrier portal access. Several major carriers now require or strongly recommend VPN for remote users. A virtual desktop infrastructure (VDI) goes further — it keeps the data environment off the remote hire's local machine so no policyholder information ever touches their personal computer. Confirm each carrier's remote-access policy before Day 1.

Setting Up Secure Carrier Portal Access

Before your remote hire can log into carrier portals, confirm three things: whether the carrier allows remote access at all, what authentication they require, and whether a VPN is mandatory. This varies by carrier and can take several business days to configure — factor it into your onboarding timeline before your hire's start date.

Some carriers issue separate remote-access credentials or require a dedicated VDI session. Others require MFA and accept a standard VPN. In all cases, access setup should go through your principal agent or office administrator — not through the remote hire self-provisioning their own credentials. Self-provisioned access creates attribution gaps and is difficult to audit or revoke cleanly. If you're sourcing through Sourced's insurance staffing program, you can confirm AMS-tool familiarity during screening — but carrier portal setup is always the agency's responsibility.

How to Structure Ongoing Access Reviews

Access should be reviewed whenever a remote hire's responsibilities change — and at least quarterly regardless. The goal is removing permissions that are no longer needed before they become an exposure. A simple audit: pull the user access list from your AMS, compare it to the current role description, and revoke anything that has drifted out of scope. When the baseline is documented, this takes about 15 minutes.

When you bring a remote hire on for back-office tasks, document the specific systems and access levels in their onboarding record. That document becomes your quarterly review baseline — compare live permissions against it and reconcile any drift. If a remote hire has accumulated access beyond their current role, that is the signal to act before the next quarterly cycle ends.

What Your Remote Hire Should Never Do

Include this list in your onboarding packet alongside the NDA, and have your hire sign acknowledgment of each item.

• Download policyholder documents — policies, applications, loss runs — to a personal device or personal cloud storage.
• Share policy numbers, Social Security numbers, or financial data over unencrypted channels — including personal email, SMS, or messaging apps not approved by your agency.
• Screenshot AMS screens or carrier portals for personal reference files.
• Access carrier portals or your AMS on public Wi-Fi without an active VPN.
• Accept verbal instructions to bind or modify coverage — all changes go through the licensed agent with a written record in the AMS.

Your Pre-Access Onboarding Checklist

Whether you are adapting an insurance VA job description template or building your onboarding from scratch, complete every item on this checklist before granting live system access.

• Written information security policy shared and signed by the new hire
• NDA and data handling agreement executed
• MFA enabled on AMS, carrier portals, and agency email before first login
• Access provisioned at minimum necessary level; excess permissions removed or withheld
• Carrier portal remote-access requirements confirmed; VPN or VDI configured if required
• Incident notification procedure reviewed and emergency contact information exchanged

Remote insurance staff are not a security liability in themselves — they are the same operational responsibility as your in-office team, with the informal safeguards made explicit. Get the controls in place before Day 1, review them quarterly, and your data security posture stays intact whether your hire is down the hall or in a different time zone.