Provides financial services, in Michigan

MCL 500.2403(1)(d) · Read the law's page

• If you set insurance rates subject to section 2403 of the Insurance Code, do not use rates that are excessive, inadequate, or unfairly discriminatory, whatever method produced them (MCL 500.2403(1)(d)).
• Justify a rate differential for the same coverage by differences in losses, expenses, or both, or in the uncertainty of loss, supported by a reasonable classification system, sound actuarial principles when applicable, and actual and credible loss and expense statistics (MCL 500.2403(1)(d)).

MCL 37.2101 to 37.2804 · Read the law's page

• It reaches you if you operate as a place of public accommodation or public service, meaning a business, facility or institution whose goods, services, facilities, privileges, advantages, or accommodations are made available to the public (section 301): do not deny an individual the full and equal enjoyment of them because of religion, race, color, national origin, age, sex, sexual orientation, gender identity or expression, or marital status (section 302(a)).
• Do not print, circulate, post, mail, or otherwise publish a statement, advertisement, notice, or sign indicating that the full and equal enjoyment of the goods, services, facilities, privileges, advantages, or accommodations of a place of public accommodation or public service will be refused, withheld, or denied on those grounds (section 302(b)).
• If an application is made to you for financial assistance or financing in connection with a real estate transaction, or in connection with the construction, rehabilitation, repair, maintenance, or improvement of real property, do not discriminate against the applicant because of religion, race, color, national origin, age, sex, sexual orientation, gender identity or expression, familial status, or marital status of the applicant or an individual residing with the applicant (section 504(1)(a)).
• Do not use a form of application for financial assistance or financing, or make or keep a record or inquiry in connection with an application, that indicates, directly or indirectly, a preference, limitation, specification, or discrimination on those grounds, unless the form is one prescribed for the use of a lender regulated as a mortgagee under the national housing act or by a regulatory board or officer acting under the statutory authority of this state or the United States (section 504(1)(b) and (3)).
• If your business includes engaging in real estate transactions, do not discriminate on those grounds in purchasing loans for acquiring, constructing, improving, repairing, or maintaining a dwelling, or in making or purchasing loans or providing other financial assistance secured by residential real estate (section 504(2)).

Insurance Cybersecurity Event Notice, MCL 500.557 and 500.559 · Read the law's page

• This binds every licensee under Michigan's Insurance Code, a licensed insurer or producer or other person licensed, authorized or registered under it, but not a purchasing group or risk retention group chartered and licensed in another state or an assuming insurer domiciled in another state (reached by declaring that you are an insurer); the small-licensee exemption in section 500.565(1) lifts only section 555; a licensee subject to and in compliance with the HIPAA rules is exempt from the chapter except sections 559 and 561, so the section 557 investigation and record-keeping duties below do not bind it, but the section 559 notice does (sections 500.553(g) and 500.565(1) and (2)).
• When you learn that a cybersecurity event has or may have occurred, investigate it promptly yourself or through a vendor you designate: determine whether an event occurred, assess its nature and scope, identify the nonpublic information involved, and restore the security of the compromised information systems (section 500.557(1) and (2)).
• Keep records of all cybersecurity events for at least 5 years from the date of each event and produce them on the director's demand (section 500.557(3)).
• Notify the director as promptly as possible, and not later than 10 business days after you determine that a cybersecurity event involving nonpublic information in your possession has occurred, when Michigan is your state of domicile (insurer) or home state (insurance producer) and the event has a reasonable likelihood of materially harming a Michigan consumer or a material part of your normal operation (section 500.559(1)(a)).
• Give the same notice within the same 10 business days when you reasonably believe the nonpublic information involved is of 250 or more Michigan consumers and the event is one you must report to a government body under other law or has a reasonable likelihood of materially harming a Michigan consumer or a material part of your normal operation (section 500.559(1)(b)).
• Give the notice electronically as the director directs, include as much as possible of the information section 500.559(2) lists (the date of the event, how the information was exposed, the number of Michigan consumers affected, the results of your internal review and your remediation efforts), and update and supplement it as previously provided information materially changes (section 500.559(2)).
• Give the director a copy of any consumer notice you send under the chapter (section 500.559(3)).
• Treat a cybersecurity event at a third-party service provider as your own event, with your deadlines running from the day after the provider notifies you or you otherwise have actual knowledge of it, whichever is earlier (section 500.559(4)).
• If you are an assuming insurer, notify your affected ceding insurers and the director of your state of domicile within 10 business days after determining that a cybersecurity event has occurred (section 500.559(5)).

MCL 500.557 · Read the law's page

• As an insurance licensee, keep records concerning all cybersecurity events for at least 5 years from the date of each event, and produce those records when the director demands them.

Insurance Data Security Program, MCL 500.555 and 500.565 · Read the law's page

• This binds every licensee under Michigan's Insurance Code, a licensed insurer or producer or other person licensed, authorized or registered under it, but not a purchasing group or risk retention group chartered and licensed in another state or an assuming insurer domiciled in another state (reached by declaring that you are an insurer); a licensee with fewer than 25 employees, including independent contractors, is exempt from this program duty, as is an employee, agent, representative or designee that is itself a licensee, to the extent the other licensee's program covers it (sections 500.553(g) and 500.565(1) and (3)).
• Develop, implement and maintain a comprehensive written information security program, based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information system, sized to your size and complexity, activities and the sensitivity of the information (section 500.555(1) and (2)).
• Designate the employees, affiliate or outside vendor responsible for the program, identify reasonably foreseeable internal and external threats, assess their likelihood and potential damage and the sufficiency of your safeguards, and assess the effectiveness of your key controls, systems and procedures at least annually (section 500.555(3)).
• Based on that risk assessment, determine which of the listed security measures are appropriate and implement them: access controls, encryption of nonpublic information in transit over an external network and on portable devices, secure development practices, effective controls that may include multi-factor authentication, testing and monitoring, audit trails and secure disposal, and give your personnel cybersecurity awareness training (section 500.555(4)).
• If you have a board of directors, have the board or an appropriate committee require executive management to develop, implement and maintain the program and report to it in writing at least annually (section 500.555(5)).
• Exercise due diligence in selecting each third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it can reach; you have until January 20, 2023 to implement this duty (sections 500.555(6) and 500.565(5)).
• Monitor, evaluate and adjust the program for changes in technology, the sensitivity of your nonpublic information, threats, and your own business arrangements (section 500.555(7)).
• Establish a written incident response plan that covers the internal response process, its goals, roles and decision-making authority, communications, remediation of weaknesses, documentation and reporting, and revision of the plan after a cybersecurity event (section 500.555(8)).
• If you are an insurer domiciled in Michigan, submit to the director by February 15 each year a written statement certifying your compliance with section 555, and keep the supporting records for 5 years (section 500.555(9)).
• Implement section 555 by January 20, 2022 (section 500.565(5)).