Section 535B.21 - Remote workA licensee may authorize work at a remote location provided all of the following requirements are met:
1. In-person customer interaction does not occur at the residence of an employee or an independent contractor.2. The licensee's physical records are not maintained at a remote location.3. The licensee establishes, supervises, and enforces written policies and procedures to ensure that all employees and independent contractors working from a remote location comply with all applicable state and federal laws and rules.4. The licensee maintains the computer system used to enable employees and independent contractors to work from a remote location, and all customer information is maintained in accordance with the licensee's written information technology security plan and all applicable state and federal laws and rules.5. Employees and independent contractors who work from a remote location only access the licensee's secure systems directly from an out-of-office device using a virtual private network or comparable system that requires a password or other form of authentication to access, and ensures a secure connection.6. The licensee has the ability to remotely lock or erase the licensee-related contents of any out-of-office device, or otherwise remotely limit access to the licensee's secure systems.7. The licensee ensures the installation and maintenance of all appropriate security updates, patches, or other alterations to the security of all devices used at remote locations to access the licensee's computer system.8. The licensee ensures that all customer interactions and communications regarding customers comply with federal and state information security requirements, including but not limited to the federal Gramm-Leach-Bliley Act of 1999, 15 U.S.C. § 6801 et seq., and the federal standards for safeguarding customer information in 16 C.F.R. pt. 314.9. The licensee annually certifies that all employees and independent contractors working from a remote location comply with this section. The licensee shall make written documentation of the certification available to the administrator upon request.10. The record of a mortgage loan originator working from a remote location that is contained in the nationwide mortgage licensing system and registry designates a licensed location as the mortgage loan originator's official work location.Added by 2024 Iowa HF 2392,s 7, eff. 7/1/2024.