40 Pa.C.S. § 4516: Certification.

(a) Requirement.--No later than the April 15 that is at least one year after the effective date of this section, and each April 15 thereafter, each insurer domiciled in this Commonwealth shall submit to the commissioner, in the form and manner prescribed by the department, a written statement certifying that the insurer is in compliance with the requirements of sections 4512 (relating to risk assessment), 4513 (relating to information security program), 4514 (relating to corporate oversight) and 4515 (relating to oversight of third-party service provider arrangements).

(b) Documentation.--

(1) Each insurer shall maintain all records, schedules and data supporting the certification under this section for a period of five years and shall make that information available for examination by the department.

(2) To the extent that an insurer has identified areas, systems or processes that require material improvement, updating or redesign, the insurer shall document the identification and the remedial efforts planned and underway to address the areas, systems or processes. The documentation shall be available for inspection by the department.