382.625.  Third-party consultants permitted, when — limitation on scope of authority — confidentiality — conflict of interest — written agreement, contents. — 1.  The director may retain, at the insurer's expense, third-party consultants, including attorneys, actuaries, accountants, and other experts not otherwise a part of the director's staff, as may be reasonably necessary to assist the director in reviewing the CGAD and related information or the insurer's compliance with sections 382.600 to 382.640.

  2.  Any persons retained under subsection 1 of this section shall be under the direction and control of the director and shall act in a purely advisory capacity.

  3.  The NAIC and third-party consultants shall be subject to the same confidentiality standards and requirements as the director.

  4.  As part of the retention process, a third-party consultant shall verify to the director, with notice to the insurer, that it is free of a conflict of interest and that it has internal procedures in place to monitor compliance with a conflict and to comply with the confidentiality standards and requirements of sections 382.600 to 382.640.

  5.  A written agreement with the NAIC or a third-party consultant governing sharing and use of information provided under sections 382.600 to 382.640 shall contain the following provisions and expressly require the written consent of the insurer prior to making public information provided under sections 382.600 to 382.640:

  (1)  Specific procedures and protocols for maintaining the confidentiality and security of CGAD-related information shared with the NAIC or a third-party consultant under sections 382.600 to 382.640;

  (2)  Procedures and protocols for sharing by the NAIC only with other state regulators from states in which the insurance group has domiciled insurers.  The agreement shall provide that the recipient agrees in writing to maintain the confidentiality and privileged status of the CGAD-related documents, materials, or other information and has verified in writing the legal authority to maintain confidentiality;

  (3)  A provision specifying that ownership of the CGAD-related information shared with the NAIC or a third-party consultant remains with the department of commerce and insurance, and the NAIC's or third-party consultant's use of the information is subject to the direction of the director;

  (4)  A provision that prohibits the NAIC or a third-party consultant from storing the information shared under sections 382.600 to 382.640 in a permanent database after the underlying analysis is completed;

  (5)  A provision requiring the NAIC or a third-party consultant to provide prompt notice to the director and to the insurer or insurance group regarding any subpoena, request for disclosure, or request for production of the insurer's CGAD-related information; and

  (6)  A provision requiring the NAIC or a third-party consultant to consent to intervention by an insurer in any judicial or administrative action in which the NAIC or a third-party consultant may be required to disclose confidential information about the insurer shared with the NAIC or a third-party consultant under sections 382.600 to 382.640.