Access
Staff desk is team-email only. A consumer sees only their own portal file. Share codes are revocable and open only inside ops.
NAIC 673 · BAA
Information security.
The written program for this website, portal, and staff desk. Not a certificate. Not the agency’s office-network binder — that lives with the Privacy Official.
- Coordinator
- Privacy Official
info@team-iia.com - Entity
- INSUREitALL LLC · NPN 20114179
- Last reviewed
- August 25, 2026
- Call
- +1 908-827-6223
Purpose
NAIC Model 673 requires a licensee to have a written information security program for customer information. This page is that program for the public site, the consumer portal, and the BRIDGEt Console. The HIPAA and GLBA notices are the consumer-facing maps. This is the internal-facing one, published so a carrier can read it.
Customer information we hold
- Callback requests: name, phone, email, zip, window, notes
- Needs analysis / portal file: optional doctor names, medication names, budget
- Account sign-in for the consumer portal and the staff desk
- Call recordings (disclosed on the line)
Safeguards
Identifiers
No Social Security or Medicare-number fields. Free text that looks like either is rejected.
Transit
Production is HTTPS. Scripted cross-site requests are blocked. Security headers include nosniff.
Minimum necessary
Team lead alerts carry name, phone, email, zip, and window only. Doctors and medications stay on the desk.
AI wall
Live BRIDGEt chat cannot open the needs file. Training or site improvement uses a service-provider contract, de-identified data, or authorization.
Vendors
Categories, not a signed-vendor roster. A name goes on a roster only after the contract is executed.
Hosting and database
The public site and data store. PHI stays in the agency database, not in marketing tools.
Communications
Phone, email, and optional lead-alert webhooks. Alerts are minimum-necessary.
AI processing
BRIDGEt voice/chat vendors, if enabled, process a live turn. They do not receive the needs file unless a BAA and a service-provider contract are in place.
Business Associate Agreements
- We execute a Business Associate Agreement before a vendor creates, receives, maintains, or transmits PHI for us.
- A BAA is a contract, not a badge. We do not list a vendor as signed until the paper is executed.
- Workforce (INSUREitALL team emails) is not a business associate.
- Carriers receive PHI only when you ask us to enroll or service — that is plan administration, not a website dump.
- Request or send a BAA: info@team-iia.com.
If something goes wrong
- Tell the Privacy Official the same day — info@team-iia.com or the phone on this site.
- Contain: rotate credentials, lock the desk if needed, preserve logs.
- HIPAA: notify affected people and HHS without unreasonable delay, no later than 60 days after discovery if unsecured PHI is breached.
- Florida FIPA: notify as required when name is combined with medical or health-insurance data.
- States that adopted NAIC 668: notify the department of insurance as that statute requires (often 72 hours after a cybersecurity event).
Evaluation
The Privacy Official reviews this program at least annually, and after a material system change or a security event. Last reviewed August 25, 2026.
Last reviewed August 25, 2026. 3550 Buschwood Park Dr, Ste 180, Tampa, FL 33618.