07/20/2021 11:3225:745F752A-B00F-4F2A-A4DF-BC3CA6B7324D4507FINSURANCE DATA SECURITY507F.1Title.This chapter may be cited as the “Insurance Data Security Act”.2021 Acts, ch 79, §1, 17507F.2Purpose and scope.1Notwithstanding any provision of law to the contrary, this chapter establishes the exclusive state standards for data security, and the investigation and notification of cybersecurity events, applicable to licensees.2This chapter shall not be construed to create or imply a private cause of action for a violation of its provisions, and shall not be construed to curtail a private cause of action that otherwise exists in the absence of this chapter.2021 Acts, ch 79, §2, 17507F.3Definitions.As used in this chapter, unless the context otherwise requires:1“Authorized individual” means an individual known to and screened by a licensee and determined to be necessary and appropriate to have access to nonpublic information held by the licensee and the licensee’s information system.2“Commissioner” means the commissioner of insurance.3“Consumer” means an individual, including but not limited to an applicant, policyholder, insured, beneficiary, claimant, or certificate holder, who is a resident of this state and whose nonpublic information is in a licensee’s possession, custody, or control.4“Cybersecurity event” means an event resulting in unauthorized access to, or the disruption or misuse of, an information system or of nonpublic information stored on an information system. “Cybersecurity event” does not include any of the following:aThe unauthorized acquisition of encrypted nonpublic information if the encryption, process, or key is not also acquired, released, or used without authorization.bAn event for which a licensee has determined that the nonpublic information accessed by an unauthorized person has not been used or released, and the nonpublic information has been returned or destroyed.5“Delivered by electronic means” means delivery to an electronic mail address at which a consumer has consented to receive notices or documents.6“Encrypted” means the transformation of data into a form that results in a low probability of assigning meaning to the data without the use of a protective process or key.7“Gramm-Leach-Bliley Act” means the Gramm-Leach-Bliley Act of 1999, 15 U.S.C. §6801 et seq., including amendments thereto and regulations promulgated thereunder.8“Health Insurance Portability and Accountability Act” or “HIPAA” means the Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191, including amendments thereto and regulations promulgated thereunder.9“Home state” means the same as defined in section 522B.1.10“Information security program” means the administrative, technical, and physical safeguards that a licensee uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle nonpublic information.11“Information system” means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of electronic nonpublic information, and any specialized system such as an industrial or process controls system, a telephone switching and private branch exchange system, or an environmental control system.12“Insurer” means the same as defined in section 521A.1.13“Licensee” means a person licensed, authorized to operate, or registered, or a person required to be licensed, authorized to operate, or registered pursuant to the insurance laws of this state. “Licensee” does not include a purchasing group or a risk retention group chartered and licensed in a state other than this state, or a person acting as an assuming insurer that is domiciled in another state or jurisdiction.14“Multi-factor authentication” means authentication through verification of at least two of the following types of authentication factors:aA knowledge factor, such as a password.bA possession factor, such as a token or text message on a mobile phone.cAn inherence factor, such as a biometric characteristic.15“Nonpublic information” means electronic information that is not publicly available information and that is any of the following:aBusiness-related information of a licensee the tampering of which, or unauthorized disclosure, access, or use of which, will cause a material adverse impact to the business, operations, or security of the licensee.bInformation concerning a consumer which can be used to identify the consumer due to a name, number, personal mark, or other identifier, used in combination with any one or more of the following data elements:1A social security number.2A driver’s license number or a nondriver identification card number.3A financial account number, a credit card number, or a debit card number.4A security code, an access code, or a password that will permit access to a consumer’s financial accounts.5A biometric record.cInformation or data, except age or gender, in any form or medium created by or derived from a health care provider or a consumer, and that relates to any of the following:1The past, present, or future physical, mental or behavioral health or condition of a consumer, or a member of the consumer’s family.2The provision of health care services to a consumer.3Payment for the provision of health care services to a consumer.16“Person” means an individual or a nongovernmental entity, including but not limited to a nongovernmental partnership, corporation, branch, agency, or association.17“Publicly available information” means information that a licensee has a reasonable basis to believe is lawfully made available to the general public from federal, state, or local government records, by widely distributed media, or by disclosure to the general public as required by federal, state, or local law. For purposes of this definition, a licensee has a reasonable basis to believe that information is lawfully made available to the general public if the licensee has determined all of the following:aThat the information is of a type that is available to the general public.bThat if a consumer may direct that the information not be made available to the general public, that the consumer has not directed that the information not be made available to the general public.18“Risk assessment” means the assessment that a licensee is required to conduct pursuant to section 507F.4, subsection 3.19“Third-party service provider” means a person that is not a licensee that contracts with a licensee to maintain, process, store, or is otherwise permitted access to nonpublic information through the person’s provision of services to the licensee.2021 Acts, ch 79, §3, 17507F.4Information security program.1aCommensurate with the size and complexity of a licensee, the nature and scope of a licensee’s activities including the licensee’s use of third-party service providers, and the sensitivity of nonpublic information used by the licensee or that is in the licensee’s possession, custody, or control, the licensee shall develop, implement, and maintain a comprehensive written information security program based on the licensee’s risk assessment conducted pursuant to subsection 3. bThis section shall not apply to any of the following: 1A licensee that meets any of the following criteria:aHas fewer than twenty individuals on its workforce, including employees and independent contractors.bHas less than five million dollars in gross annual revenue.cHas less than ten million dollars in year-end total assets.2An employee, agent, representative, or designee of a licensee, and the employee, agent, representative, or designee is also a licensee, if the employee, agent, representative, or designee is covered by the information security program of the other licensee.cA licensee shall have one hundred eighty calendar days from the date the licensee no longer qualifies for exemption under paragraph “b” to comply with this section.2A licensee’s information security program must be designed to do all of the following:aProtect the security and confidentiality of nonpublic information and the security of the licensee’s information system.bProtect against threats or hazards to the security or integrity of nonpublic information and the licensee’s information system.cProtect against unauthorized access to or the use of nonpublic information, and minimize the likelihood of harm to any consumer.dDefine and periodically reevaluate a schedule for retention of nonpublic information and a mechanism for the destruction of nonpublic information if retention is no longer necessary for the licensee’s business operations, or is no longer required by applicable law.3A licensee shall conduct a risk assessment that accomplishes all of the following:aDesignates one or more employees, an affiliate, or an outside vendor to act on behalf of the licensee and that has responsibility for the information security program.bIdentifies reasonably foreseeable internal or external threats that may result in unauthorized access, transmission, disclosure, misuse, alteration, or destruction of nonpublic information, including nonpublic information that is accessible to, or held by, a third-party service provider.cAssesses the probability of, and the potential damage caused by, the threats identified in paragraph “b”, taking into consideration the sensitivity of nonpublic information.dAssesses the sufficiency of policies, procedures, information systems, and other safeguards in place to manage the threats identified in paragraph “b”. This assessment must include consideration of threats identified in each relevant area of the licensee’s operations, including all of the following:1Employee training and management.2Information systems, including network and software design; and information classification, governance, processing, storage, transmission, and disposal.3Detection, prevention, and response to an attack, intrusion, or other system failure.eImplements information safeguards to manage threats identified in the licensee’s ongoing risk assessments and, at least annually, assesses the effectiveness of the information safeguards’ key controls, systems, and procedures.4Based on the risk assessment conducted pursuant to subsection 3, a licensee shall do all of the following:aDevelop, implement, and maintain an information security program as described in subsections 1 and 2.bDetermine which of the following security measures are appropriate and implement each appropriate security measure:1Place access controls on information systems, including controls to authenticate and permit access only to authorized individuals to protect against the unauthorized acquisition of nonpublic information.2Identify and manage the data, personnel, devices, systems, and facilities that enable the licensee to achieve its business purposes in accordance with the data, personnel, devices, systems, and facilities relative importance to the licensee’s business objectives and risk strategy.3Restrict access of nonpublic information stored in or at physical locations to authorized individuals only.4Protect by encryption or other appropriate means, all nonpublic information while the nonpublic information is transmitted over an external network, and all nonpublic information that is stored on a laptop computer, a portable computing or storage device, or portable computing or storage media.5Adopt secure development practices for in-house developed applications utilized by the licensee, and procedures for evaluating, assessing, and testing the security of externally developed applications utilized by the licensee.6Modify information systems in accordance with the licensee’s information security program.7Utilize effective controls, which may include multi-factor authentication procedures for authorized individuals accessing nonpublic information.8Regularly test and monitor systems and procedures to detect actual and attempted attacks on, or intrusions into, information systems.9Include audit trails within the information security program designed to detect and respond to cybersecurity events, and designed to reconstruct material financial transactions sufficient to support the normal business operations and obligations of the licensee.10Implement measures to protect against the destruction, loss, or damage of nonpublic information due to environmental hazards, natural disasters, catastrophes, or technological failures.11Develop, implement, and maintain procedures for the secure disposal of nonpublic information that is contained in any format.cInclude cybersecurity risks in the licensee’s enterprise-wide risk management process.dMaintain knowledge and understanding of emerging threats or vulnerabilities and utilize reasonable security measures, relative to the character of the sharing and the type of information being shared, when sharing information.eProvide the licensee’s personnel with cybersecurity awareness training that is updated as necessary to reflect risks identified by the licensee’s risk assessment. 5aIf a licensee has a board of directors, the board or an appropriate committee of the board shall at a minimum require the licensee’s executive management or the executive management’s delegates to:1Develop, implement, and maintain the licensee’s information security program.2Provide a written report to the board, at least annually, that documents all of the following:aThe overall status of the licensee’s information security program and the licensee’s compliance with this chapter.bMaterial matters related to the licensee’s information security program including issues such as risk assessment; risk management and control decisions; third-party service provider arrangements; results of testing, cybersecurity events, or violations; management’s response to cybersecurity events or violations; and recommendations for changes in the licensee’s information security program.bIf a licensee’s executive management delegates any of its responsibilities under this section the executive management shall oversee the delegate’s development, implementation, and maintenance of the licensee’s information security program, and shall require the delegate to submit an annual written report to executive management that contains the information required under paragraph “a”, subparagraph (2). If the licensee has a board of directors, the executive management shall provide a copy of the report to the board.6A licensee shall monitor, evaluate, and adjust the licensee’s information security program consistent with relevant changes in technology, the sensitivity of the licensee’s nonpublic information, changes to the licensee’s information systems, internal or external threats to the licensee’s nonpublic information, and the licensee’s changing business arrangements, including but not limited to mergers and acquisitions, alliances and joint ventures, and outsourcing arrangements.7As part of a licensee’s information security program, a licensee shall establish a written incident response plan designed to promptly respond to, and recover from, a cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in the licensee’s possession, the licensee’s information systems, or the continuing functionality of any aspect of the licensee’s operations. The written incident response plan must address all of the following:aThe licensee’s internal process for responding to a cybersecurity event.bThe goals of the licensee’s incident response plan.cThe assignment of clear roles, responsibilities, and levels of decision-making authority for the licensee’s personnel that participate in the incident response plan.dExternal communications, internal communications, and information sharing related to a cybersecurity event.eThe identification of remediation requirements for weaknesses identified in information systems and associated controls.fDocumentation and reporting regarding cybersecurity events and related incident response activities.gThe evaluation and revision of the incident response plan, as appropriate, following a cybersecurity event.8An insurer domiciled in this state shall annually submit to the commissioner on or before April 15 a written certification that the insurer is in compliance with this section. Each insurer shall maintain all records, schedules, documentation, and data supporting the insurer’s certification for five years. To the extent an insurer has identified an area, system, or process that requires material improvement, updating, or redesign, the insurer shall document the process used to identify the area, system, or process, and the remediation that has been implemented, or will be implemented, to address the area, system, or process. All records, schedules, documentation, and data described in this subsection shall be made available for inspection by the commissioner, or the commissioner’s representative, upon request of the commissioner.9Licensees shall comply with this section no later than January 1, 2023.2021 Acts, ch 79, §4, 17507F.5Third-party service provider arrangements.1A licensee shall exercise due diligence in the selection of third-party service providers, conduct oversight of all third-party service provider arrangements, and require all third-party service providers to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the licensee’s third-party service providers.2Licensees shall comply with this section no later than January 1, 2024.2021 Acts, ch 79, §5, 17507F.6Cybersecurity event investigation.1If a licensee discovers that a cybersecurity event has occurred, or that a cybersecurity event may have occurred, the licensee, or the outside vendor or third-party service provider the licensee has designated to act on behalf of the licensee, shall conduct a prompt investigation of the event.2During the investigation, the licensee, outside vendor, or third-party service provider the licensee has designated to act on behalf of the licensee, shall, at a minimum, determine as much of the following as possible:aConfirm that a cybersecurity event has occurred.bAssess the nature and scope of the cybersecurity event.cIdentify all nonpublic information that may have been compromised by the cybersecurity event.dPerform or oversee reasonable measures to restore the security of any compromised information systems in order to prevent further unauthorized acquisition, release, or use of nonpublic information that is in the licensee’s possession, custody, or control.3If a licensee learns that a cybersecurity event has occurred, or may have occurred, in an information system maintained by a third-party service provider of the licensee, the licensee shall complete an investigation in compliance with this section, or confirm and document that the third-party service provider has completed an investigation in compliance with this section.4A licensee shall maintain all records and documentation related to the licensee’s investigation of a cybersecurity event for a minimum of five years from the date of the event, and shall produce the records and documentation upon demand of the commissioner.2021 Acts, ch 79, §6, 17507F.7Cybersecurity event notification and report to the commissioner.1A licensee shall notify the commissioner no later than three business days from the date of the licensee’s confirmation of a cybersecurity event if any of the following conditions apply:aThe licensee is an insurer who is domiciled in this state, or is a producer whose home state is this state, and any of the following apply:1The laws of this state or federal law requires that notice of the cybersecurity event be given by the licensee to a government body, self-regulatory agency, or other supervisory body.2The cybersecurity event has a reasonable likelihood of causing material harm to a material part of the normal business, operations, or security of the licensee.bThe licensee reasonably believes that nonpublic information compromised by the cybersecurity event involves two hundred fifty or more consumers and either of the following apply:1State or federal law requires that notice of the cybersecurity event be given by the licensee to a government body, self-regulatory agency, or other supervisory body.2The cybersecurity event has a reasonable likelihood of causing material harm to a consumer, or to a material part of the normal business, operations, or security of the licensee.2A licensee’s notification to the commissioner pursuant to subsection 1 shall provide, in the form and manner prescribed by the commissioner by rule, as much of the following information as is available to the licensee at the time of the notification:aThe date and time of the cybersecurity event.bA description of how nonpublic information was exposed, lost, stolen, or breached, including the specific roles and responsibilities of the licensee’s third-party service providers, if any.cHow the licensee discovered or became aware of the cybersecurity event.dIf any lost, stolen, or breached nonpublic information has been recovered and if so, how the recovery occurred.eThe identity of the source of the cybersecurity event.fThe identity of any regulatory, governmental, or law enforcement agencies the licensee has notified, and the date and time of each notification.gA description of the specific types of nonpublic information that were lost, stolen, or breached. hThe total number of consumers affected by the cybersecurity event. The licensee shall provide the best estimate of affected consumers in the licensee’s initial report to the commissioner and shall update the estimate in each subsequent report to the commissioner under subsection 3.iThe results of any internal review conducted by the licensee that identified a lapse in the licensee’s automated controls or internal procedures, or that confirmed the licensee’s compliance with all automated controls or internal procedures.jA description of the licensee’s efforts to remediate the circumstances that allowed the cybersecurity event.kA copy of the licensee’s privacy policy.lA statement outlining the steps the licensee is taking to identify and notify consumers affected by the cybersecurity event.mThe contact information for the individual authorized to act on behalf of the licensee and who is also knowledgeable regarding the cybersecurity event.3A licensee shall have a continuing obligation to update and supplement the licensee’s initial notification to the commissioner as material changes to information previously provided to the commissioner occur. 2021 Acts, ch 79, §7, 17507F.8Cybersecurity event notification to consumers.1In the event of a cybersecurity event involving nonpublic information a licensee shall comply with the notification requirements pursuant to section 715C.2, and all other applicable notification requirements pursuant to federal or state law.2If a licensee is required to provide notice of a cybersecurity event to the commissioner pursuant to section 507F.7, subsection 1, the licensee shall submit to the commissioner a copy of the consumer notices provided by the licensee to consumers under this section.2021 Acts, ch 79, §8, 17507F.9Cybersecurity event third-party service providers.1If a licensee becomes aware of a cybersecurity event in an information system maintained by a third-party service provider of the licensee, the licensee shall comply with section 507F.7, or the licensee may obtain a written certification from the third-party service provider that the provider is in compliance with section 507F.7. If the third-party provider fails to provide written certification to the licensee, the licensee shall comply with section 507F.7. The computation of the licensee’s deadlines pursuant to section 507F.7 shall begin on the business day after the date on which the licensee’s third-party service provider notifies the licensee of a cybersecurity event, or the date on which the licensee has actual knowledge of the cybersecurity event, whichever date is earlier.2This section shall not be construed to prohibit or abrogate an agreement between a licensee and another licensee, a third-party service provider, or any other party for the other licensee, third-party service provider, or other party to execute the requirements under section 507F.6 or section 507F.7 on behalf of the licensee.2021 Acts, ch 79, §9, 17507F.10Cybersecurity event reinsurers.1If a cybersecurity event involves nonpublic information used by, or that is in the possession, custody, or control of, a licensee that is acting as an assuming insurer and that does not have a direct contractual relationship with consumers affected by the cybersecurity event, the assuming insurer shall notify each of the assuming insurer’s affected ceding insurers and the commissioner of the assuming insurer’s state of domicile within three business days of determining that a cybersecurity event has occurred. A ceding insurer that has a direct contractual relationship with a consumer affected by the cybersecurity event shall comply with the applicable provisions of section 715C.2, and all other applicable notification requirements pursuant to federal or state law.2If a cybersecurity event involves nonpublic information that is in the possession, custody, or control of a third-party service provider of a licensee that is acting as an assuming insurer, the assuming insurer shall notify each of the assuming insurer’s affected ceding insurers and the commissioner of the assuming insurer’s state of domicile within three business days of the date the assuming insurer receives notice from the assuming insurer’s third-party service provider that a cybersecurity event involving nonpublic information has occurred. A ceding insurer that has a direct contractual relationship with a consumer affected by the cybersecurity event shall comply with the applicable provisions of section 715C.2, and all other applicable notification requirements pursuant to federal or state law.3Notwithstanding any law to the contrary, a licensee acting as an assuming insurer shall have no other notice obligations related to a cybersecurity event or other data breach than the notice requirements pursuant to subsections 1 and 2.2021 Acts, ch 79, §10, 17507F.11Cybersecurity event producers of record.If a cybersecurity event involves nonpublic information that is in the possession, custody, or control of a licensee that is an insurer, or in the possession, custody, or control of the insurer’s third-party service provider, and for which a consumer accessed the insurer’s services through an independent insurance producer, the insurer shall notify the insurance producer of record of each consumer affected by the cybersecurity event no later than the date on which notice is provided to affected consumers pursuant to section 507F.7. An insurer shall not be required to notify an insurance producer that is not authorized by law or contract to sell, solicit, or negotiate on behalf of the insurer, or in a circumstance in which the insurer does not have current contact information for the producer of record for a specific affected consumer.2021 Acts, ch 79, §11, 17507F.12Confidentiality.1Documents, materials, and other information in the control or possession of the commissioner that are furnished by a licensee, or by an employee or agent of the licensee acting on behalf of the licensee, or that are obtained by the commissioner in an investigation or examination, shall be confidential by law and privileged, shall not constitute a public record under chapter 22, shall not be subject to subpoena or discovery, and shall not be admissible as evidence in a private civil action. The commissioner, however, shall be authorized to use the documents, materials, and other information in the furtherance of a regulatory or legal action brought as part of the commissioner’s official duties. The commissioner shall not otherwise make the documents, materials, and other information public without the prior written consent of the licensee.2The commissioner, or an individual who receives documents, materials, or other information under the authority of the commissioner, shall not be permitted or required to testify in a private civil action concerning any documents, materials, or other information subject to subsection 1.3In order to assist in the performance of the commissioner’s duties under this chapter, the commissioner may:aShare documents, materials, and other information, including documents, materials, and other information subject to subsection 1, with state, federal, and international regulatory agencies; the national association of insurance commissioners, its affiliates and subsidiaries; and with state, federal, and international law enforcement authorities, provided that the recipient certifies in writing that the recipient will maintain the confidentiality or privileged status of any documents, materials, or other information to which confidentiality or privileged status applies.bReceive documents, materials, and other information, including confidential and privileged documents, materials, and other information from the national association of insurance commissioners, its affiliates and subsidiaries; and regulatory and law enforcement officials of foreign and domestic jurisdictions. The commissioner shall maintain as confidential or privileged any document, material, or other information received by the commissioner that is confidential or privileged, or that is received with notice or the understanding that it is confidential or privileged, under the laws of the jurisdiction that is the source of the document, material, or other information.cShare documents, materials, or other information subject to subsection 1 with a third-party consultant or vendor provided that the third-party consultant or vendor certifies in writing that the consultant or vendor will maintain the confidentiality and privileged status of the document, material, or other information.dEnter into an agreement governing the sharing and use of documents, materials, or other information that is consistent with this subsection.4No waiver of an applicable privilege or claim of confidentiality in a document, material, or other information shall occur as a result of disclosure of the document, material, or other information to the commissioner under this chapter, or as a result of the sharing of the document, material, or other information as authorized under this section.5This chapter shall not prohibit the commissioner from releasing final, adjudicated actions that are open to public inspection pursuant to chapter 22, to a database or other clearinghouse service maintained by the national association of insurance commissioners, or its affiliates and subsidiaries.6Documents, materials, and other information received by the commissioner under this chapter and shared pursuant to subsection 3, shall be confidential by law and privileged, shall not constitute a public record under chapter 22, shall not be subject to subpoena or discovery, and shall not be admissible as evidence in a private civil action.7Ownership of documents, materials, and other information shared under this chapter with the national association of insurance commissioners, its affiliates and subsidiaries, or a third-party consultant or vendor, remains with the commissioner, and use of the documents, materials, and other information by the national association of insurance commissioners, its affiliates and subsidiaries, or a third-party consultant or vendor is subject to the direction of the commissioner.2021 Acts, ch 79, §12, 17507F.13Applicability.1This chapter shall not apply to a licensee that is subject to, and in compliance with, the Health Insurance Portability and Accountability Act. The licensee shall annually submit to the commissioner a written certification of the licensee’s compliance with HIPAA.2This chapter shall not apply to a licensee that is owned or controlled by a federally insured depository institution that is subject to, and in compliance with, the Gramm-Leach-Bliley Act or comparable federal law and corresponding regulations.3A licensee shall have one hundred eighty days from the date the licensee no longer qualifies for exemption under subsection 1 or 2 to comply with this chapter.2021 Acts, ch 79, §13, 17507F.14Penalties.A licensee that violates this chapter shall be subject to penalties pursuant to section 505.7A and chapter 507B. 2021 Acts, ch 79, §14, 17507F.15Rules and enforcement.1The commissioner may adopt rules pursuant to chapter 17A as necessary to administer this chapter.2The commissioner may take any enforcement action under the commissioner’s authority to enforce compliance with this chapter.2021 Acts, ch 79, §15, 17507F.16Severability.If any provision of this chapter or its application to any person or circumstance is held invalid, the invalidity shall not affect other provisions or applications of this chapter which can be given effect without the invalid provision or application, and to this end the provisions of this chapter are severable.2021 Acts, ch 79, §16, 17