Provides financial services, in Pennsylvania

31 Pa. Code §§ 146a.1 to 146a.44 · Read the law's page

• If you are an insurer, producer or other licensee of the Insurance Department (health maintenance organizations included), give each customer a clear and conspicuous notice of your privacy policies and practices not later than when the customer relationship begins, and give each consumer one before you disclose nonpublic personal financial information about the consumer to a nonaffiliated third party other than as sections 146a.32 and 146a.33 authorize.
• Give customers a clear and conspicuous notice of your privacy policies and practices not less than annually, meaning at least once in any 12 consecutive months, while the customer relationship continues.
• Include in each privacy notice the categories of nonpublic personal financial information you collect and disclose and the categories of affiliates and nonaffiliated third parties to whom you disclose it.
• Do not disclose nonpublic personal financial information about a consumer to a nonaffiliated third party, directly or through an affiliate, unless you gave the consumer the initial notice and the opt out notice, a reasonable opportunity to opt out before the disclosure (for example 30 days from mailing the notices), and the consumer did not opt out. Subchapter D lists exceptions.
• Do not unfairly discriminate against a consumer or customer because that person opted out of the disclosure.

31 Pa. Code §§ 146b.1 to 146b.24 · Read the law's page

• If you are an insurer, producer or other licensee of the Insurance Department, do not disclose nonpublic personal health information about a consumer unless you obtain an authorization from that consumer, except where disclosure is necessary for an insurance function the section lists, such as claims administration, claims adjustment, fraud detection, underwriting or utilization review.
• Do not unfairly discriminate against a consumer because that consumer has not granted authorization for the disclosure.

40 Pa.C.S. § 4518 · Read the law's page

• If you are an insurer, insurance producer or other licensee under Pennsylvania insurance law, notify the Insurance Commissioner as promptly as possible, and no later than five business days from your determination that a cybersecurity event involving nonpublic information in your possession has occurred, when the event has a reasonable likelihood of materially harming a consumer residing in Pennsylvania or a material part of your normal operations and Pennsylvania is your state of domicile (insurer) or home state (producer), or when you reasonably believe the information involves 250 or more Pennsylvania consumers and the event triggers a notice to another governmental or supervisory body or has that reasonable likelihood of harm.
• Give the commissioner as much as possible of the thirteen listed items of information, in electronic form, including the date of the event, how the information was exposed, the types of information involved, the number of Pennsylvania consumers affected, your remediation efforts, a copy of your privacy policy and a contact person, and update and supplement the notice as material changes occur.
• Whenever you must notify the commissioner, comply with section 3 of the Breach of Personal Information Notification Act as applicable and give the commissioner a copy of the notice you send consumers.
• If the event occurs in a system maintained by a third-party service provider, treat it as you would an event under section 4518(a) unless the provider notifies the commissioner directly; your deadlines run from the day after the provider notifies you or you otherwise have actual knowledge.
• If you are an assuming insurer, notify your affected ceding insurers and the commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred.

40 Pa.C.S. §§ 4516(b), 4517(d) · Read the law's page

• If you are a licensee under Pennsylvania insurance law, maintain records concerning all cybersecurity events for at least five years from the date of each event (section 4517(d)).
• Produce those cybersecurity event records upon the Insurance Commissioner's demand (section 4517(d)).
• If you are an insurer domiciled in Pennsylvania, maintain all records, schedules and data supporting your annual certification for five years and make that information available for examination by the Insurance Department (section 4516(b)(1)).

Insurance Data Security chapter, 40 Pa.C.S. §§ 4512 to 4517 · Read the law's page

• Applies to a licensee under Pennsylvania insurance law, which you declare by stating that you are an insurer: a person that is or is required to be licensed, authorized to operate or registered under the insurance laws of Pennsylvania, other than a purchasing group or risk retention group chartered and licensed in another state or an assuming insurer domiciled in another state.
• Conduct a risk assessment that identifies reasonably foreseeable internal or external threats to nonpublic information, assesses their likelihood and potential damage, and assesses the sufficiency of your policies, procedures, information systems and safeguards, and assess the effectiveness of the safeguards' key controls, systems and procedures at least annually.
• Develop, implement and maintain a comprehensive written information security program, based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information systems, commensurate with your size, your activities, your use of third-party service providers and the sensitivity of the information.
• Determine which security measures are appropriate and implement them, including access controls, encryption of nonpublic information in transit over an external network and on portable devices, effective controls for employees accessing nonpublic information (which may include multifactor authentication), and regular testing and monitoring of systems.
• Establish and maintain a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information.
• Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect and secure the information systems and nonpublic information it holds.
• If you are an insurer domiciled in Pennsylvania, submit to the commissioner each April 15 a written statement certifying compliance with sections 4512 to 4515, and keep the supporting records for five years.
• Conduct a prompt investigation if you discover that a cybersecurity event has or may have occurred, and keep records concerning all cybersecurity events for at least five years, producing them on the commissioner's demand.
• A licensee with fewer than 10 employees, less than $5,000,000 in gross revenue or less than $10,000,000 in year-end total assets is exempt from sections 4512 to 4516 (risk assessment, program, oversight, certification), but not from the investigation duty in section 4517.