Provides financial services, in Mississippi

Medicare Supplement Insurance Minimum Standards regulation, 19 Miss. Admin. Code Pt. 3, R. 10.24 · Read the law's page

• If you issue a Medicare supplement policy or certificate in Mississippi, or act for or on behalf of an issuer as a third-party administrator or other person, do not deny or condition the issuance or effectiveness of the policy or certificate, including by imposing an exclusion of benefits based on a pre-existing condition, on the basis of an individual's genetic information (Rule 10.24(A)(1) and (J)(1)).
• Do not discriminate in the pricing of the policy or certificate, including the adjustment of premium rates, on the basis of an individual's genetic information (Rule 10.24(A)(2)).
• Do not request or require an individual or a family member of the individual to undergo a genetic test (Rule 10.24(C)).
• Do not request, require or purchase genetic information for underwriting purposes, or with respect to an individual before the individual's enrollment under the policy in connection with that enrollment (Rule 10.24(G) and (H)).
• If you ask an individual or a family member to undergo a genetic test for research, make the request pursuant to research that complies with Part 46 of Title 45 of the Code of Federal Regulations or equivalent Federal regulations, never require the test, tell each individual that compliance is voluntary and that non-compliance has no effect on enrollment status or premium or contribution amounts, do not use the information collected for underwriting, eligibility, premium rates or the issuance, renewal or replacement of a policy or certificate, notify the Secretary of Health and Human Services in writing of the activities, and meet any other conditions the Secretary requires by regulation (Rule 10.24(F)).

Insurance Data Security Law, sections 4 and 9, Senate Bill 2831 (2019) · Read the law's page

• Applies to a licensee under Mississippi insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate or registered, or required to be, under the insurance laws of Mississippi, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state.
• Notwithstanding any other provision of law, the Act is the exclusive state standard applicable to licensees for data security, the investigation of a cybersecurity event and notification to the Commissioner of Insurance.
• Develop, implement and maintain a comprehensive written information security program based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information system, sized to your size and complexity, the nature and scope of your activities, your use of third-party service providers and the sensitivity of the information.
• Design the program to define and periodically reevaluate a schedule for retention of nonpublic information and a mechanism for its destruction when no longer needed.
• Designate one or more employees, an affiliate or an outside vendor to be responsible for the program, identify reasonably foreseeable internal and external threats, and no less than annually assess the effectiveness of the safeguards' key controls, systems and procedures.
• Determine which of the listed security measures are appropriate for your risk assessment and implement them, including access controls, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices, multi-factor authentication where appropriate, testing and monitoring, audit trails, and secure disposal; include cybersecurity risks in your enterprise risk management and train your personnel.
• Establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information, your information systems or the continuing functionality of your business.
• Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it can access; licensees have two years from July 1, 2019 to implement this requirement and one year to implement the rest of the program section.
• If you have a board of directors, the board or an appropriate committee must require executive management to develop, implement and maintain the program and to report in writing at least annually on its status, your compliance and material matters.
• If you are an insurer domiciled in Mississippi, submit to the Commissioner of Insurance by February 15 each year a written statement certifying compliance with the program section, and keep the supporting records for five years.
• If you are an insurer, document any areas, systems or processes you have identified as requiring material improvement, updating or redesign, with the remedial efforts planned and underway, and make the documentation available for the Commissioner's inspection.
• You are exempt from the program section if you have fewer than 50 employees, less than $5,000,000 in gross annual revenue or less than $10,000,000 in year-end total assets, or if you are an insurance producer or adjuster, and an employee, agent, representative or designee of a licensee who is also a licensee is exempt to the extent the other licensee's program covers it; a licensee that maintains a HIPAA information security program and certifies compliance in writing, or is affiliated with a depository institution that meets the Interagency Guidelines, is considered to meet the program section.
• If you cease to qualify for an exception, you have 180 days to comply with the Act.

Insurance Data Security Law, sections 5 and 6, Senate Bill 2831 (2019) · Read the law's page

• Applies to a licensee under Mississippi insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate or registered, or required to be, under the insurance laws of Mississippi, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state.
• A cybersecurity event does not include the unauthorized acquisition of encrypted nonpublic information if the encryption, process or key is not also acquired, released or used without authorization, or an event after which you determine that the nonpublic information accessed by an unauthorized person has not been used or released and has been returned or destroyed.
• Notify the Commissioner of Insurance as promptly as possible, and no later than three business days after you determine that a cybersecurity event involving nonpublic information in your possession has occurred, when Mississippi is your state of domicile (insurer) or home state (producer) and the event has a reasonable likelihood of materially harming a consumer residing in Mississippi or any material part of your normal operations.
• Notify the Commissioner within the same three business days when you reasonably believe the nonpublic information involved is of 250 or more consumers residing in Mississippi and the event requires notice to a government body, self-regulatory agency or other supervisory body under state or federal law, or has a reasonable likelihood of materially harming a consumer or a material part of your normal operations.
• Give the Commissioner as much as possible of the 13 listed items of information, in electronic form as directed, and keep updating and supplementing the notification as material changes occur.
• Conduct a prompt investigation when you learn that a cybersecurity event has or may have occurred, determining as much as possible of whether an event occurred, its nature and scope and the nonpublic information involved, and performing or overseeing reasonable measures to restore the security of the compromised information systems; keep records of every cybersecurity event for at least five years and produce them on the Commissioner's demand.
• Give the Commissioner a copy of the notice sent to consumers under the state's breach notification statute when you must notify the Commissioner.
• Treat a cybersecurity event in a system maintained by a third-party service provider as you would one in your own system, unless the provider gives the Commissioner the notice, and complete the investigation steps yourself or confirm and document that the provider has completed them; the clock starts the day after the provider notifies you or you otherwise have actual knowledge.
• You are exempt from the third-party service provider investigation and notification provisions if you have fewer than 50 employees, less than $5,000,000 in gross annual revenue or less than $10,000,000 in year-end total assets, or if you are an insurance producer or adjuster.
• As an assuming insurer that has no direct contractual relationship with the affected consumers, notify your affected ceding insurers and the Commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred, or of receiving notice of one from your third-party service provider; you then have no other notice obligations relating to the event or data breach under this section or any other law of this state.
• As an insurer whose consumer accessed your services through an independent insurance producer, notify the producers of record of all affected consumers no later than the time consumer notice is given, when consumer notice is required.

Miss. Code Ann. §§ 83-5-801 to 83-5-825, SB 2831 §§ 4, 5 · Read the law's page

• If you are a licensee under the Mississippi insurance laws, maintain records concerning all cybersecurity events for at least five years from the date of each event (section 5(4)).
• Produce those cybersecurity event records upon the Commissioner of Insurance's demand (section 5(4)).
• If you are an insurer domiciled in Mississippi, maintain for examination by the department all records, schedules and data supporting your annual certificate for five years (section 4(9)).

Data Security for Money Transmitters Act, section 5, House Bill 1596 (2026) · Read the law's page

• Applies to a licensee under the Data Security for Money Transmitters Act, which you declare by stating that you are a payment provider (a money transmitter) or a crypto-asset provider (a virtual currency kiosk): a money transmitter or virtual currency kiosk licensed under Mississippi's Money Transmission Modernization Act.
• Notify the Commissioner of Banking and Consumer Finance as soon as possible, and no later than 72 hours after discovery, of a notification event (the acquisition of unencrypted customer information without the authorization of the affected individual) that involves the information of any consumers in Mississippi, in the format the Commissioner specifies.
• Treat unauthorized access to unencrypted customer information as an acquisition unless you have reliable evidence that there has not been, or could not reasonably have been, unauthorized acquisition, and treat customer information as unencrypted if its encryption key was accessed by an unauthorized person.
• Include in the notice your name and contact information, the types of information involved, the date or date range of the event if it can be determined, the number of consumers affected or potentially affected, a general description of the event, and whether a law enforcement official has determined in writing that public notice would impede a criminal investigation or damage national security.
• Treat an event as discovered on the first day it is known to you, which includes knowledge of any of your employees, officers or other agents other than the person committing the event.
• If a notification event occurs in a system a service provider maintains, treat it as you would under the 72-hour notice requirement, with your deadlines running from the day after the service provider notifies you or you otherwise have actual knowledge, whichever is sooner.

Data Security for Money Transmitters Act, sections 2 to 4 and 6, House Bill 1596 (2026) · Read the law's page

• Applies to a licensee under the Data Security for Money Transmitters Act, which you declare by stating that you are a payment provider (a money transmitter) or a crypto-asset provider (a virtual currency kiosk): a money transmitter or virtual currency kiosk licensed under Mississippi's Money Transmission Modernization Act.
• Develop, implement and maintain a comprehensive, written information security program with administrative, technical and physical safeguards appropriate to your size and complexity, the nature and scope of your activities, and the sensitivity of the customer information at issue.
• Designate a qualified individual, who may be employed by you, an affiliate or a service provider, to oversee, implement and enforce the program; you remain responsible for compliance, and you must designate a senior member of your personnel to direct and oversee that individual if the individual works for an affiliate or service provider, and you must require that affiliate or service provider to maintain an information security program that protects you as the Act requires.
• Base the program on a written risk assessment, and periodically perform additional risk assessments that reexamine the risks and reassess the sufficiency of your safeguards.
• Design and implement safeguards that include access controls, encryption of all customer information in transit over external networks and at rest (or effective alternative compensating controls approved by your qualified individual where encryption is infeasible), secure development practices for in-house applications and procedures for evaluating, assessing or testing the security of externally developed applications you use to transmit, access or store customer information, multi-factor authentication for anyone accessing an information system unless your qualified individual approves in writing a reasonably equivalent or more secure control, change management procedures, and monitoring and logging of authorized users' activity.
• Securely dispose of customer information in any format no later than two years after it was last used to provide a financial product or service to the customer, unless it is necessary for business operations or other legitimate business purposes, required to be retained by law, or targeted disposal is not reasonably feasible; periodically review your data retention policy.
• Test or monitor the effectiveness of your safeguards; absent effective continuous monitoring, conduct annual penetration testing of your information systems and vulnerability assessments at least every six months and whenever there are material changes to your operations or circumstances that may materially affect the program.
• Provide security awareness training, use qualified information security personnel, and take reasonable steps to select and retain service providers that can maintain appropriate safeguards, requiring them by contract to implement those safeguards and periodically assessing them.
• Establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity or availability of customer information in your control, and a written business continuity and disaster recovery plan.
• Have your qualified individual report in writing at least annually to your board of directors or equivalent governing body (or, if none exists, a senior officer responsible for the program) on the status of the program, your compliance and material matters.
• If you maintain customer information concerning fewer than 5,000 consumers, the requirement that the risk assessment be written and include the listed criteria, the continuous monitoring or penetration testing and vulnerability assessment requirement, the incident response plan requirement and the annual board report requirement do not apply to you.