Provides financial services, in New Hampshire

RSA 141-H:4, 141-H:5 · Read the law's page

• If you are a health insurer, do not require or request, directly or indirectly, any individual or member of the individual's family to undergo genetic testing, or to reveal whether the individual or a family member has undergone genetic testing or the results (RSA 141-H:4, I and II).
• Do not condition health insurance coverage or health care benefits on whether an individual or a family member has undergone genetic testing or the results, and do not consider that in the determination of rates or any other aspect of coverage or benefits (RSA 141-H:4, III and IV).
• If you provide life, disability income or long-term care insurance and obtain information about genetic testing of an individual or a family member, do not use that information in writing a type of insurance coverage other than life, disability income or long-term care insurance (RSA 141-H:5, II).

N.H. Code Admin. R. Ins 3001 to Ins 3007 · Read the law's page

• If you are an insurance licensee, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices not later than when you establish the customer relationship, and not less than annually during the relationship (Ins 3002.01 and Ins 3002.02).
• Give a consumer who is not a customer the same notice before you disclose any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as Ins 3004.02 and Ins 3004.03 authorize (Ins 3002.01(a)(2)).
• Before you disclose nonpublic personal financial information about a consumer to a nonaffiliated third party, give an opt-out notice and a reasonable opportunity to opt out; a mailed notice allows 30 days (Ins 3002.04 and Ins 3003.01).
• Do not disclose nonpublic personal health information about a consumer or customer without an authorization from that person, except for the insurance functions Ins 3005.01(b) lists (Ins 3005.01).
• Do not unfairly discriminate against a consumer or customer because that person has opted out of the disclosure of nonpublic personal financial information (Ins 3006.02).

Insurance Data Security Law information security program, RSA 420-P:4 · Read the law's page

• Applies to a licensee under New Hampshire insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate or registered, or required to be licensed, authorized or registered, under the insurance laws of New Hampshire, other than a purchasing group or a risk retention group chartered and licensed in another state or a person acting as an assuming insurer domiciled in another state or jurisdiction.
• Develop, implement and maintain a comprehensive written information security program based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information system, in proportion to your size and complexity, the nature and scope of your activities, including your use of third-party service providers, and the sensitivity of the nonpublic information.
• Designate one or more employees, an affiliate or an outside vendor as responsible for the program, identify reasonably foreseeable internal and external threats, including threats to information held by third-party service providers, and at least annually assess the effectiveness of your safeguards' key controls, systems and procedures.
• Determine which of the security measures RSA 420-P:4, IV lists are appropriate and implement them, including access controls, encryption of nonpublic information in transit over an external network and on laptops and portable media, multi-factor authentication where effective, regular testing and monitoring, audit trails and secure disposal.
• Include cybersecurity risks in your enterprise risk management process, stay informed of emerging threats or vulnerabilities, and give your personnel cybersecurity awareness training that is updated to reflect the risks in your risk assessment.
• Establish a written incident response plan designed to promptly respond to and recover from any cybersecurity event that compromises nonpublic information, your information systems or the continuing functionality of your business.
• If you learn that a cybersecurity event has or may have occurred, conduct a prompt investigation or have a designated outside vendor or service provider conduct it, and keep records of all cybersecurity events for at least 5 years and produce them on the commissioner's demand.
• Exercise due diligence in selecting each third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it can access or holds.
• If you are an insurer domiciled in New Hampshire, submit to the commissioner by March 1 each year a written statement certifying compliance with RSA 420-P:4, and keep the supporting records for 5 years.
• A licensee with fewer than 20 employees, including independent contractors, a continuing care retirement community, a life settlement provider, and a bank or credit union that meets the Gramm-Leach-Bliley safeguards, are exempt from RSA 420-P:4.
• A licensee that complies with HIPAA is considered to meet the chapter with respect to protected health information, and one that complies with 23 NYCRR Part 500 and certifies that in writing to the commissioner is considered to meet the chapter, but each remains bound by the commissioner notification duties of RSA 420-P:6, I and II, and the second also by RSA 420-P:5 and RSA 420-P:6, III.

RSA 420-P:5 · Read the law's page

• If you are a licensee (a person licensed, authorized to operate or registered, or required to be, under the insurance laws of New Hampshire, other than a purchasing group or a risk retention group chartered in another state or an assuming insurer domiciled elsewhere) and learn that a cybersecurity event has or may have occurred, conduct, or have an outside vendor or service provider designated to act for you conduct, a prompt investigation (RSA 420-P:5, I).
• Where the event occurs in a system a third-party service provider maintains, complete the investigation steps or confirm and document that the provider has completed them (RSA 420-P:5, III).
• Maintain records concerning all cybersecurity events for at least 5 years from the date of each event, and produce those records upon the commissioner's demand (RSA 420-P:5, IV).

RSA 420-P:6 · Read the law's page

• If you are an insurance licensee, notify the insurance commissioner within 3 business days of a determination that a cybersecurity event has occurred, when New Hampshire is your state of domicile as an insurer or your home state as a producer and the event has a reasonable likelihood of materially harming a consumer residing in New Hampshire or a material part of your normal operations (RSA 420-P:6, I(a)).
• Also notify the commissioner within 3 business days when you reasonably believe the nonpublic information involves 250 or more consumers residing in New Hampshire and the event requires notice to a government body, self-regulatory agency or other supervisory body, or has a reasonable likelihood of materially harming a consumer residing in New Hampshire or a material part of your normal operations (RSA 420-P:6, I(b)).
• Give as much as possible of the information RSA 420-P:6, II(a) to (m) lists, in electronic form as the commissioner directs, and update and supplement the notice for material changes (RSA 420-P:6, II).
• Notify consumers by complying with RSA 359-C:20, I(a) and (c), II-IV and VI, and give the commissioner a copy of the consumer notice, when you must notify the commissioner (RSA 420-P:6, III).

N.H. 2026, HB 1406-FN (pending in Senate Commerce Committee)

• This measure is in committee and binds nobody yet; what follows is what it would require if it is enacted in this form.
• Do not use artificial intelligence to conduct code audits.
• Do not use artificial intelligence to alter the clinical judgment of a treating provider in utilization review.
• Maintain records of AI tool use in claims processing.
• Make records of AI tool use in claims processing available to the state insurance department on audit.