Insurance compliance communications are the messages your producers, adjusters, and service teams send to policyholders about policies and claims, whether by email, text, chat, or phone.
State regulators can ask for any of them during a market conduct exam, and they expect you to produce them quickly, even when the conversation happened on an agent’s personal phone.
Email is often archived already. The gaps tend to show up in texts from independent agents, WhatsApp threads with claimants, and recorded sales calls.
The following blog post covers the retention rules that apply to insurance compliance communications, where those records usually slip through, and what to ask archiving vendors before you sign.
What Counts as Insurance Compliance Communications
Insurance compliance communications are any messages that sell, explain, service, or settle an insurance policy, on any channel the business uses:
- Who: carriers, MGAs and MGUs, captive and independent agents and brokers, third-party administrators (TPAs), claims adjusters, and call-center staff.
- Channels: email, SMS and iMessage from producers’ phones, WhatsApp, Teams, Slack, Zoom, recorded calls, and social media.
- Typical records: annuity suitability conversations, coverage explanations, claim updates, complaints, and renewal or cancellation notices sent by email or text.
Communications archiving is also a separate category from the other tools sold as insurance compliance software, such as customer communications management (CCM) platforms that generate policy documents, contact compliance tools that manage TCPA consent, and licensing tools that track producer appointments. Carriers with broker-dealer affiliates usually need financial services archiving that covers the insurance and securities sides in one place.
Insurance Record Retention Requirements That Reach Communications
No single federal rule governs insurance communications. Most insurance record retention requirements come from state market conduct rules, with federal and program rules added for products such as Medicare plans and variable annuities.
State market conduct record retention rules
The NAIC’s Market Conduct Record Retention and Production Model Regulation (#910) lists the general, policy, claim, licensing, and complaint records insurers must keep for examiners, plus a producer file for each policy sold.
The model sets a baseline of the current year plus three years and lets states align it with their exam authority. It also requires electronic records that can’t be altered after storage and answers to examiner requests within five working days.
In New Hampshire, RSA 400-B:3 extends the duty to producers. Where the insurer doesn’t keep producer records itself, the producer of record keeps a file per policy with “all work papers and written communications” about it for the current year plus five years.
Retention periods by state
Set retention to the longest period among the states where you write business, separately for each line, and confirm the final schedule with counsel.
The NAIC tracks retention periods for every state in its chart of state laws on insurance records maintenance, and the table below pulls out the rules most relevant to communications.
| State | Citation | Records covered | Retention period |
| New Hampshire | RSA 400-B:3 | Market conduct records; producer file, including written communications | Current year plus 5 years |
| New York | 11 NYCRR 243.2 (Regulation 152) | Policy, claim, and complaint files | 6 calendar years after the policy ends or the file closes |
| Pennsylvania | Notice 2009-07 | General records, including policyholder and claimant correspondence | 7 years from execution, unless a specific guideline applies |
| California | 10 CCR § 2190.2 | Agent and broker transaction records | 5 years after the policy expires or is canceled |
| Florida | Fla. Stat. § 626.748 | Agent policy records | 5 years after the policy expires |
Federal and program rules that add communications obligations
- CMS Medicare marketing rules (42 CFR 422.2274 and 423.2274): agents and brokers selling Medicare Advantage and Part D plans must record marketing, sales, and enrollment calls in full. CMS’s CY 2027 changes to the Medicare marketing rules cut retention from 10 years to six, with transcripts allowed in years four to six, starting Oct. 1, 2026.
- GLBA and state data security laws: insurers count as financial institutions under GLBA, so archived customer data needs the safeguards listed in a GLBA compliance checklist. States that adopted NAIC Model #668, along with New York’s 23 NYCRR 500, add their own security rules.
- HIPAA: health insurers need a business associate agreement (BAA) with the archive vendor.
- SEC Rule 17a-4 and FINRA Rule 4511: when variable products are sold through a broker-dealer, SEC Rule 17a-4 and FINRA Rule 4511 books and records requirements apply on top of state rules.
Where Insurance Communications Records Go Missing
Most gaps come from how insurance is distributed, with independent producers, outsourced adjusters, and acquired agencies each bringing their own phones and systems.
- Producers text from personal phones. The archive holds only email, while quotes and renewal reminders go out by SMS and iMessage. These are the same off-channel communications regulators already penalize in financial services, and capturing them requires text message archiving for insurance agents.
- Insurance email archiving stops at email. Claim photos and statements that adjusters collect over WhatsApp never reach the claim file, which becomes a problem if the claim ends up in a bad-faith suit.
- Medicare sales calls sit in a dialer whose retention settings may not match the CMS rule.
- An acquisition brings a legacy archive and extraction fees before records can be consolidated.
- A producer leaves, and their business texts stay on a phone the agency no longer controls.
How to Evaluate Insurance Archiving Vendors
The nine criteria below cover what matters most when you compare insurance archiving vendors, and each one comes with a question you can bring to the vendor call.
Archiving in this context means emails, texts, calls, and chats, which a document management system won’t capture.
Most of the criteria also apply when you compare the best data archiving software in other industries, and the details here reflect how insurance is sold and serviced.
Channel coverage that matches how producers work
Policyholders decide how they want to talk to their agent, so producers and adjusters end up on SMS, iMessage, WhatsApp, Teams, and social media as well as email.
What matters most is how each of those channels reaches the archive. When a vendor relies on a partner feed for some of them, a second company enters the chain of custody, and edits or deleted messages are often lost along the way. Jatheon captures iMessage and WhatsApp natively with no wrapper app, including edits and deleted messages, as part of its communications capture across 25+ channels.
Question to ask the vendor: “Which of our channels do you capture natively, and do you keep edits and deleted messages?”
Retention policies that map to states and lines of business
Carriers that write several lines in several states rarely have one retention period that fits every record. The archive needs to handle retention by group, delete records automatically once their period ends, and pause that deletion whenever a legal hold applies.
Jatheon sets retention by user, department, region, or content type, and keeping records longer doesn’t change the price.
Question to ask the vendor: “Can we set retention by state, line, or producer group, and does a longer period cost more?”
Tamper-evident storage and a defensible chain of custody
Model #910 expects electronic records that can’t be altered once they’re stored, and examiners and opposing counsel will want proof that nothing was. That proof comes from
WORM-compliant storage or an equivalent immutable format, together with an audit log of every access and export. If you have a broker-dealer affiliate, SEC Rule 17a-4 alignment belongs on the list too.
Question to ask the vendor: “Can you show us the audit log for one exported message?”
Supervision and review built for sampling-based exams
Market conduct examiners review samples of files, and a communication surveillance program that works the same way is easier to defend.
For insurers, that usually means random sampling, lexicons tuned to risks such as rebating and replacement language in annuity sales, alerts, and a record of every review, all of which Jatheon covers with compliance archiving and supervision.
Question to ask the vendor: “How would we set a sampling rate and keyword policy for annuity sales?”
Search and production speed for exams, complaints, and claims litigation
Model #910 gives insurers five working days to answer an examiner’s request, and complaints and bad-faith suits move on similar timelines.
In practice, you need to find everything about one policyholder, producer, policy, or claim number in a single search across every channel, then export it in a format counsel can use.
Question to ask the vendor: “How long would it take to produce every communication about one claim across email, text, and calls?”
Privacy and security controls for policyholder data
Archived messages hold policyholders’ nonpublic personal information and, on health lines, protected health information.
A vendor should be able to share SOC 2 Type II and ISO 27001 reports, sign a BAA, and explain how role-based access, multifactor authentication, and encryption protect that data. Where the data lives matters as well, and Jatheon runs single-tenant on AWS with region geofencing.
Question to ask the vendor: “Is our data in a dedicated tenant, and can we choose the region?”
Voice and meeting capture
Recorded Medicare sales calls, claims calls, and meetings with policyholders carry the same retention duty as written messages.
Some vendors record calls themselves, while others depend on a separate recording provider, which adds one more system to manage. Transcription is worth checking too, since reviewers can only search spoken content once it’s been turned into text.
Question to ask the vendor: “Do you record carrier calls directly, or do we need a separate recording provider?”
Migration in and exit terms out
Agency roll-ups turn migration into a recurring cost, both when you bring a legacy archive in and when you eventually move on.
Before signing, it helps to know which archives the vendor imports from, whether ingestion is billed separately, and what a full export would cost if you leave. Jatheon brings legacy archives in through automated archive migration.
Question to ask the vendor: “What would it cost to take all our data out in year five?”
Pricing that stays predictable as data grows
Volume-based pricing can climb quickly once call recordings and claim photos start piling up. Storage overages, charges for inactive users, and AI features sold as add-ons are the line items most likely to push the final bill above the original quote.
Question to ask the vendor: “Which features in the demo are licensed separately?”
Insurance Compliance Communications Vendor Scorecard
The scorecard below lets you compare vendors for insurance compliance communications side by side.
You can paste it into an RFP, send the nine questions before demos, and score each criterion from 0 to 2. During the demo, ask each vendor to run the claim-number search from criterion 5 live.
| Criterion | What good looks like | Red flag |
| 1. Channel coverage | Native capture of email, SMS, iMessage, WhatsApp, collaboration tools, and social, with edits and deletions | Mobile capture only through a partner or a wrapper app producers must switch to |
| 2. Retention by state and line | Policies by group, legal hold overrides disposal, no surcharge for longer periods | One global retention period for every record |
| 3. Tamper-evident storage | WORM or equivalent immutable storage, full audit log per message | No audit log for exports |
| 4. Supervision | Random sampling, insurance-specific lexicons, alerts, documented review | Keyword alerts only, no sampling or review record |
| 5. Search and production | One search by policy or claim number across all channels, exports in standard formats | Separate searches per channel or vendor |
| 6. Privacy and security | SOC 2 Type II, ISO 27001, BAA, dedicated tenant, region choice | Shared multi-tenant storage with no region choice |
| 7. Voice and meetings | Calls and meetings captured with searchable transcripts | Recordings left in a dialer or meeting app |
| 8. Migration and exit | Imports from your legacy archive, written exit terms and costs | Per-GB or per-item extraction fees |
| 9. Pricing | Fixed, published price drivers, AI features itemized | Key demo features licensed separately |
How Jatheon Handles Communications Archiving for Insurance
Jatheon provides communications archiving for insurance carriers, MGAs, and agencies in one platform.
It captures iMessage and WhatsApp natively from producers’ own phones, along with email, collaboration tools, and social media, and keeps every message in single-tenant AWS storage with retention and legal hold set by group.
For market conduct exams and claims litigation, these features matter most.
- Unified Search: One search across email, text, chat, social, files, and websites by policyholder, producer, or claim number, with Cases, legal hold, and non-destructive redaction.
- Exports counsel accepts: PST, EML, PDF, HTML, CSV, RSMF, and Relativity load files.
- Supervision: Sampling from 0.001% to 100%, keyword and pattern policies, and alerts, with optional AI sentiment and classification to cut false positives.
- Meeting capture: Zoom audio and video transcribed and translated so spoken content is searchable
- Migration: Moves from 30+ legacy archives with no ingestion or migration fees.
Conclusion
State retention rules apply to the record itself, regardless of the channel it was sent on.
Insurance compliance communications programs run into trouble when producer texts, claimant WhatsApp threads, or Medicare sales calls sit outside the archive, so weigh native capture, retention by state and line, and exit terms most heavily when you compare vendors.
Insurers with advisory or fund affiliates can apply the same criteria to RIA recordkeeping requirements and hedge fund recordkeeping rules.
