HB 1334

Abstract

Insurance data security; required programs and notifications. Establishes standards for insurance data security and for the investigation of a cybersecurity event and the notification to the Commissioner of Insurance and affected consumers of a cybersecurity event. The bill requires insurers to develop, implement, and maintain a comprehensive written information security program based on an assessment of its risk and that contains administrative, technical, and physical safeguards for the protection of nonpublic information and its information system. The bill requires investigation of potential cybersecurity events and prescribes standards for such investigations. The bill requires that the notification of the occurrence of a cybersecurity event provided by an insurer or other entity to the Commissioner and affected consumers to include certain information prescribed by the bill. The bill requires the Commissioner to adopt rules and regulations regarding data security and authorizes the Commissioner to investigate potential violations.

Insurance data security; required programs and notifications. Establishes standards for insurance data securityand for the investigation of a cybersecurity event and the notificationto the Commissioner of Insurance and affected consumers of a cybersecurityevent. The bill requires insurers to develop, implement, and maintaina comprehensive written information security program based on anassessment of its risk and that contains administrative, technical,and physical safeguards for the protection of nonpublic informationand its information system. The bill requires investigation of potentialcybersecurity events and prescribes standards for such investigations.The bill requires, in the event of a cybersecurity event, that aninsurer or other entity notify the Commissioner and affected consumerswith certain information prescribed by the bill. The bill requiresthe Commissioner to adopt rules and regulations regarding data securityand authorizes the Commissioner to investigate potential violations.