Provides financial services, in Connecticut

Conn. Gen. Stat. §§ 38a-975 to 38a-998 · Read the law's page

• If you are an insurance institution, agent or insurance-support organization, do not use or authorize a pretext interview to obtain information in connection with an insurance transaction, except to investigate a claim where specific information available for review by the commissioner gives a reasonable basis for suspecting criminal activity, fraud, material misrepresentation or material nondisclosure, and then only to interview a person or institution with no recognized privileged relationship with the person the information concerns (section 38a-978).
• If you are an insurance institution or agent, give all applicants and policyholders a written notice of information practices at the times section 38a-979 sets, stating whether personal information may be collected from persons other than the individual, the types of information and investigative techniques and sources, the disclosures made without prior authorization, the access and correction rights and how to use them, and that an insurance-support organization may retain and disclose its report. An abbreviated notice may replace the full notice (section 38a-979).
• Do not prepare or request an investigative consumer report for an application, renewal, reinstatement or change in benefits unless you inform the individual that the individual may ask to be interviewed and is entitled to receive a copy of the report on request (section 38a-982).
• Within thirty business days of a written request, after proper identification, tell the individual the nature and substance of recorded personal information, let the individual see and copy it or obtain a copy by mail, disclose to whom it was disclosed within the previous two years, and summarize the procedures for requesting correction, amendment or deletion. Supply medical-record information directly or through a medical professional the individual designates (section 38a-983).
• Not later than thirty business days after a written request to correct, amend or delete recorded personal information, either do so and notify the individual and the recipients the section names, or notify the individual of the refusal, the reasons and the right to file a statement of disagreement, then file that statement with the disputed information and pass it on with later disclosures (section 38a-984).
• After an adverse underwriting decision, give the applicant, policyholder or individual proposed for coverage the specific reason in writing, or advise that it may be had on written request, with a summary of the rights in sections 38a-983 to 38a-985. On a written request within ninety business days, furnish within twenty-one business days the specific reason, the specific items of personal and privileged information that support it, and the names and addresses of the institutional sources (section 38a-985).
• Do not disclose personal or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure is made with the individual's written authorization or falls within one of the other grounds section 38a-988 lists (section 38a-988).
• Do not knowingly and wilfully obtain information about an individual from an insurance institution, agent or insurance-support organization under false pretenses (section 38a-997).

Conn. Gen. Stat. § 38a-988a · Read the law's page

• Do not sell or offer for sale individually identifiable medical record information, whether you are an insurance institution, agent, insurance support organization, health care professional, medical care center, pharmacy, pharmaceutical company, school or university, or a person's agent, contractor or employee (section 38a-988a(a)).
• Do not disclose individually identifiable medical record information for marketing purposes without the prior written consent of the individual or, for a minor, of the minor's parent or guardian. The section does not bar a disclosure permitted by section 38a-988 or other law, a transfer by a health care provider for research, utilization review, quality review, billing or direct patient care functions on the terms stated, or a transfer as part of a consummated sale or merger (section 38a-988a(a)).

Conn. Gen. Stat. § 38a-999 · Read the law's page

• If you are an insurance institution, agent or insurance support organization that regularly collects, uses or discloses medical record information, develop and implement written policies, standards and procedures for its management, transfer and security, including protections against unauthorized collection, use or disclosure by you or your employees or agents (section 38a-999(a)).
• Include in those policies a limit on access to people who need it for their jobs, training for authorized employees, disciplinary measures, the job titles authorized to use or disclose the information, procedures for authorizing and restricting collection, use and disclosure, methods for handling, disclosing, storing and disposing of it, periodic monitoring of compliance, and additional protection for sensitive health information on sexually transmitted diseases, mental health, substance abuse, HIV and AIDS, and genetic testing, including the fact that an individual has undergone a genetic test (section 38a-999(a)(1) to (8)).
• Make the policies, standards and procedures available for review by the Insurance Commissioner, and make a summary available to enrollees on enrollment and on request (section 38a-999(b) and (c)).

Conn. Gen. Stat. § 38a-38(d)(4) · Read the law's page

• If you are a licensee under the Connecticut insurance laws and learn that a cybersecurity event has, or may have, occurred, maintain records concerning each cybersecurity event for at least five years from the date of the event (section 38a-38(d)(4)).
• Produce those cybersecurity event records to the Insurance Commissioner upon the commissioner's demand (section 38a-38(d)(4)).

Conn. Gen. Stat. § 38a-38(e) · Read the law's page

• If you are a licensee under the Connecticut insurance laws, notify the Insurance Commissioner as promptly as possible, and no later than three business days after you first determine that a cybersecurity event has occurred, when you are an insurer domiciled in Connecticut or a producer whose home state is Connecticut and the event is reasonably likely to materially harm a Connecticut consumer or a material part of your normal operations (section 38a-38(e)(1)(A)).
• Give the same notice when you reasonably believe the nonpublic information involved in a cybersecurity event is of 250 or more Connecticut consumers and state or federal law requires notice to a government body or supervisory body, or the event is reasonably likely to materially harm a Connecticut consumer or a material part of your normal operations (section 38a-38(e)(1)(B)).
• In an electronic form the commissioner prescribes, give as much as possible of the information section 38a-38(e)(2)(A) lists, including the date and discovery of the event, how the information was exposed, the types of information involved, the number of affected Connecticut consumers, the results of an internal review, remediation efforts, a copy of your privacy policy and a contact person, and keep updating and supplementing it (section 38a-38(e)(2)).
• Comply with section 36a-701b on notice to consumers and give the commissioner a copy of the notice you send consumers, if you are required to notify the commissioner (section 38a-38(e)(3)).

Conn. Gen. Stat. § 38a-833 · Read the law's page

• If you are an insurer, health care center or fraternal benefit society doing business in Connecticut, do not request, require, purchase or use information obtained from an entity providing direct-to-consumer genetic testing, in connection with issuing, withholding, extending or renewing an annuity or a life, credit life, disability, long-term care, accidental injury, specified disease, hospital indemnity or credit accident insurance policy, without the informed written consent of the individual who was tested (section 38a-833(1)).
• Do not condition insurance rates, the provision or renewal of coverage or benefits, or other conditions of insurance for an individual on a requirement or agreement that the individual undergo genetic testing, or on the results of genetic testing of a member of the individual's family unless the results are contained in the individual's medical record (section 38a-833(2)).

Insurance Data Security Law, Conn. Gen. Stat. sec. 38a-38(c) · Read the law's page

• Applies to a licensee under Connecticut insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate or registered, or required to be, under the insurance laws of Connecticut, other than a purchasing group or risk retention group chartered and licensed in another state or an assuming insurer domiciled in another state.
• Develop, implement and maintain a comprehensive written information security program, based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information systems, commensurate with your size and complexity, your activities (including your use of third-party service providers) and the sensitivity of the nonpublic information.
• Designate the person responsible for the program, identify the reasonably foreseeable internal and external threats to nonpublic information, and assess the effectiveness of your safeguards' key controls, systems and procedures at least annually.
• Based on your risk assessment, determine which of the security measures the law lists are appropriate and implement them, which include access controls, secure development practices for applications you build, effective controls such as multifactor authentication, regular testing and monitoring of systems to detect attacks and intrusions, and audit trails designed to detect and respond to cybersecurity events.
• Establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information, your information systems or the continuing functionality of any aspect of your business or operations.
• Conduct a prompt investigation if you learn that a cybersecurity event has, or may have, occurred, and, where the event occurred in a system a third-party service provider maintains, complete the investigation steps or confirm and document that the provider has completed them.
• Exercise due diligence in selecting your third-party service providers and, not later than October 1, 2022, require each of them to implement appropriate administrative, technical and physical measures to protect and secure the information systems and nonpublic information accessible to, or held by, them.
• If you have a board of directors, have the board or an appropriate committee require executive management to develop, implement and maintain the program and to report to the board in writing, at least annually, on the program's overall status and your compliance with the section.
• If you are an insurer, health care center or fraternal benefit society domiciled in Connecticut, submit to the Insurance Commissioner by April 15 each year a written statement certifying that you comply with the program requirements, and keep the supporting records, schedules and data for five years.
• A licensee with fewer than ten employees (counting independent contractors with access to the nonpublic information) is exempt on and after October 1, 2022, and a licensee that maintains a program under the federal health privacy rules, or under 23 NYCRR Part 500, is deemed to comply if it complies and submits an annual written statement of compliance by April 15.

Conn. Gen. Stat. § 36a-44a(c) · Read the law's page

• If you are a licensee under title 36a of the Connecticut General Statutes, a Connecticut bank or a Connecticut credit union, file an initial notification with the Department of Banking, in the form and manner the Banking Commissioner prescribes, not later than three business days after you know, or have reason to know, of a data security incident that may materially impact your ability to operate in a safe and sound manner or comply with applicable laws and regulations, cause significant disruption in customer services, or involve unauthorized access to the personal information of any individual (section 36a-44a(c)).

Conn. Gen. Stat. § 38a-988(9) · Read the law's page

• If you are an insurance institution, agent or insurance-support organization, disclose personal or privileged information about an individual for an actuarial or research study only if no individual may be identified in any actuarial or research report (section 38a-988(9)(A)).
• Make sure materials in which the individual may be identified are returned or destroyed as soon as they are no longer necessary (section 38a-988(9)(B)).
• Have the actuarial or research organization agree not to disclose the information unless the disclosure would otherwise be permitted by section 38a-988 if made by an insurance institution, agent or insurance-support organization (section 38a-988(9)(C)).