Provides financial services, in Rhode Island

R.I. Gen. Laws secs. 27-19-44(b), 27-20-39(b), 27-41-53(b) · Read the law's page

• As a nonprofit health service corporation, nonprofit health insurer or health maintenance organization, do not use a genetic test, a request for a genetic test or the results of a genetic test to reject, deny, limit, cancel, refuse to renew, increase the rates of, affect the terms or conditions of, or otherwise affect a group or individual health insurance policy, contract or plan (sections 27-19-44(b)(1), 27-20-39(b)(1) and 27-41-53(b)(1)).
• Do not request or require a genetic test to decide whether to issue or renew health benefits coverage, to set reimbursement or copay levels, or to determine covered benefits and services (sections 27-19-44(b)(2), 27-20-39(b)(2) and 27-41-53(b)(2)).
• Do not release the results of a genetic test without the individual's prior written authorization, except in a format with individual identifiers removed, encrypted or encoded; a recipient may use or disclose the information only to carry out the purpose for which it was disclosed, and each redisclosure needs authorization (sections 27-19-44(b)(3), 27-20-39(b)(3) and 27-41-53(b)(3)).
• Do not request or require information as to whether an individual has ever had a genetic test or participated in genetic testing of any kind, whether for clinical or research purposes (sections 27-19-44(b)(4), 27-20-39(b)(4) and 27-41-53(b)(4)).

R.I. Gen. Laws sec. 27-18-52(b) · Read the law's page

• Under an individual or group health insurance contract, plan or policy that you deliver, issue for delivery or renew in Rhode Island and that provides medical coverage including physician services in a physician's office, or any major medical or comprehensive-type policy (excluding disability income, long-term care and supplemental policies), do not use a genetic test, a request for genetic tests or the results of a genetic test to reject, deny, limit, cancel, refuse to renew, increase the rates of or otherwise affect the policy (section 27-18-52(b)(1)).
• Do not request or require a genetic test to decide whether to issue or renew an individual's health benefits coverage, to set reimbursement or copay levels, or to determine covered benefits and services (section 27-18-52(b)(2)).
• Do not release the results of a genetic test without the individual's prior written authorization, except in a format with individual identifiers removed, encrypted or encoded; a recipient may use or disclose the information only to carry out the purpose for which it was disclosed, and each redisclosure needs authorization (section 27-18-52(b)(3)).
• Do not request or require information as to whether an individual has ever had a genetic test or participated in genetic testing of any kind, whether for clinical or research purposes (section 27-18-52(b)(4)).

R.I. Gen. Laws secs. 27-18-52(a), 27-18-52.1(a), 27-19-44(a), 27-19-44.1(a), 27-20-39(a), 27-20-39.1(a), 27-41-53(a), 27-41-53.1(a) · Read the law's page

• As an insurance administrator, health plan or provider, do not release genetic information without the individual's prior written authorization, required for each disclosure and stating to whom the disclosure is made; research settings governed by the Common Rule are excepted (subsection (a) of sections 27-18-52, 27-18-52.1, 27-19-44, 27-19-44.1, 27-20-39, 27-20-39.1, 27-41-53 and 27-41-53.1).

R.I. Gen. Laws secs. 27-18-52.1(b), 27-19-44.1(b), 27-20-39.1(b), 27-41-53.1(b) · Read the law's page

• Under an individual or group health insurance contract, plan or policy that you deliver, issue for delivery or renew in Rhode Island and that provides medical coverage including physician services in a physician's office, or any major medical or comprehensive-type policy (excluding disability income, long-term care and supplemental policies), do not use genetic information or a request for it to reject, deny, limit, cancel, refuse to renew, increase the rates of or otherwise affect the policy (subsection (b)(1) of sections 27-18-52.1, 27-19-44.1, 27-20-39.1 and 27-41-53.1).
• Do not request or require genetic information to decide whether to issue or renew an individual's health benefits coverage, to set reimbursement or copay levels, or to determine covered benefits and services (subsection (b)(2) of those sections).
• Do not release genetic information without the individual's prior written authorization, except in a format with individual identifiers removed, encrypted or encoded; a recipient may use or disclose it only to carry out the purpose for which it was disclosed, and each redisclosure needs authorization (subsection (b)(3) of those sections).
• Do not request or require information as to whether an individual has genetic information, whether for clinical or research purposes (subsection (b)(4) of those sections).

R.I. Gen. Laws sec. 23-17.17-10(a), (b) · Read the law's page

• Remove all personal identifiers from the data you submit to the director under chapter 17.17 of title 23; if you are an insurer, assign to each subscriber record a unique identifier not linked to any personally identifiable information (R.I. Gen. Laws sec. 23-17.17-10(b)).

R.I. Gen. Laws sec. 5-37.3-12 · Read the law's page

• As a health insurer, permit an insured individual or authorized representative to submit a confidential communications request form, and accommodate requests in the form and format requested if it is readily producible (section 5-37.3-12(b)(1)).
• Communicate confidential healthcare information to the specific mail or email address or telephone number the insured individual or authorized representative designates (section 5-37.3-12(b)(1)).
• Implement a confidential communications request within ten calendar days of receiving it by electronic transmission, telephone or first-class mail, acknowledge receipt, and advise the insured individual or authorized representative of the status of implementation when contacted (section 5-37.3-12(b)(4)).
• Create a confidential communications request form that is easily readable and prominently displayed on your website, and do not condition coverage on the waiver of these rights (section 5-37.3-12(c) and (d)).

R.I. Gen. Laws sec. 27-1-46 · Read the law's page

• Applies to a domestic insurance company in Rhode Island, which you declare by stating that you are an insurer.
• Develop, implement and maintain a comprehensive written information security program, based on your risk assessment and commensurate with your size and complexity, the nature and scope of your activities including your use of third-party service providers, and the sensitivity of the nonpublic information you hold, with administrative, technical and physical safeguards that protect the security and confidentiality of nonpublic information and your information system.
• Designate one or more employees, an affiliate or an outside vendor responsible for the program, identify reasonably foreseeable internal and external threats to nonpublic information, assess their likelihood and potential damage, assess the sufficiency of your safeguards, and at least annually assess the effectiveness of the key controls, systems and procedures of those safeguards.
• Based on the risk assessment, determine which of the security measures the law lists are appropriate and implement each one that is, which include access controls, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices, multi-factor authentication where effective, regular testing and monitoring of systems, audit trails, and secure disposal of nonpublic information.
• Include cybersecurity risks in your enterprise risk management process and give your personnel cybersecurity awareness training that is updated to reflect the risks your risk assessment identifies.
• If you have a board of directors, have the board or an appropriate committee require executive management to develop, implement and maintain the program and to report to it in writing at least annually on the program's overall status, your compliance with the chapter and material matters such as risk assessment, third-party service provider arrangements, test results and cybersecurity events.
• Exercise due diligence in selecting a third-party service provider and take reasonable steps to request the provider to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it can access or holds.
• Establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information in your possession, your information systems or the continuing functionality of any aspect of your business, covering the internal response process, goals, roles and decision-making authority, communications, remediation of identified weaknesses, documentation and reporting, and revision of the plan after an event.
• If you learn that a cybersecurity event has or may have occurred, conduct a prompt investigation, or have an outside vendor or service provider designated to act for you do so, to determine whether an event has occurred, its nature and scope and the nonpublic information involved, and to restore the security of the compromised information systems; keep records of all cybersecurity events for at least five years and produce them on demand of the commissioner.
• Submit to the commissioner by April 15 each year a written statement certifying that you comply with the section, keep the supporting records for examination for five years, and document the areas, systems or processes you have identified as needing material improvement and the remedial efforts planned and under way; if your program is prepared for and complies with the Health Insurance Portability and Accountability Act, you can rely on it to certify.

R.I. Gen. Laws sec. 27-1-46(h)(3), (i) · Read the law's page

• If you are a domestic insurance company and learn that a cybersecurity event has or may have occurred, conduct, or have an outside vendor or service provider designated to act for you conduct, a prompt investigation (R.I. Gen. Laws sec. 27-1-46(h)(3)).
• Maintain records concerning all cybersecurity events for at least five years from the date of each event, and produce those records upon the commissioner's demand (R.I. Gen. Laws sec. 27-1-46(h)(3)(iii)).
• If you are an insurer domiciled in Rhode Island, submit to the commissioner by April 15 each year a written statement certifying your compliance, and maintain the records, schedules and data supporting it for five years for examination by the department (R.I. Gen. Laws sec. 27-1-46(i)).

R.I. Gen. Laws sec. 27-1-47 · Read the law's page

• As a domestic insurer, notify the commissioner as promptly as possible, and no later than three business days from a determination that a cybersecurity event has occurred, when you must give notice of the event to any government body, self-regulatory agency or other supervisory body under state or federal law, or the event has a reasonable likelihood of materially harming any consumer residing in Rhode Island or any material part of your normal operations (section 27-1-47(a)).
• Provide the notice in electronic form as the commissioner directs, with as much as possible of the listed information (the date of the event, how the information was exposed, lost, stolen or breached, how the event was discovered, whether the information was recovered, the source of the event, any police report or notice to regulators, the types of information acquired, the period of compromise, the best estimate of affected Rhode Island consumers, the results of your internal review, your remediation efforts, a copy of your privacy policy and your plan to investigate and notify consumers, and a contact person), and keep updating and supplementing the notice (section 27-1-47(b)).
• Comply with chapter 49.3 of title 11 as applicable, and give the commissioner a copy of the notice sent to consumers when you are required to notify the commissioner (section 27-1-47(c)).
• Treat a cybersecurity event involving your nonpublic information in a system maintained by a third-party service provider as you would under subsection (a); your deadlines begin the day after the provider notifies you or you otherwise have actual knowledge, whichever is sooner (section 27-1-47(d)).
• As an assuming insurer, notify your affected ceding insurers and the commissioner of your state of domicile within seventy-two hours of determining that a cybersecurity event has occurred, or of receiving notice from your third-party service provider (section 27-1-47(e)).
• Notify the producers of record of all affected consumers who accessed your services through an independent insurance producer as soon as practicable as the commissioner directs, unless you lack current producer of record information for an individual consumer (section 27-1-47(f)).

R.I. Gen. Laws sec. 27-2-29 · Read the law's page

• Applies to a foreign insurance company, which you declare by stating that you are an insurer.
• Develop, implement and maintain a comprehensive written information security program, based on your risk assessment and commensurate with your size and complexity, the nature and scope of your activities including your use of third-party service providers, and the sensitivity of the nonpublic information you hold, with administrative, technical and physical safeguards that protect the security and confidentiality of nonpublic information and your information system.
• Designate one or more employees, an affiliate or an outside vendor responsible for the program, identify reasonably foreseeable internal and external threats to nonpublic information, assess their likelihood and potential damage, assess the sufficiency of your safeguards, and at least annually assess the effectiveness of the key controls, systems and procedures of those safeguards.
• Based on the risk assessment, determine which of the security measures the law lists are appropriate and implement each one that is, which include access controls, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices, multi-factor authentication where effective, regular testing and monitoring of systems, audit trails, and secure disposal of nonpublic information.
• Include cybersecurity risks in your enterprise risk management process and give your personnel cybersecurity awareness training that is updated to reflect the risks your risk assessment identifies.
• If you have a board of directors, have the board or an appropriate committee require executive management to develop, implement and maintain the program and to report to it in writing at least annually on the program's overall status, your compliance with the chapter and material matters such as risk assessment, third-party service provider arrangements, test results and cybersecurity events.
• Exercise due diligence in selecting a third-party service provider and take reasonable steps to request the provider to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it can access or holds.
• Establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information in your possession, your information systems or the continuing functionality of any aspect of your business, covering the internal response process, goals, roles and decision-making authority, communications, remediation of identified weaknesses, documentation and reporting, and revision of the plan after an event.
• If you learn that a cybersecurity event has or may have occurred, conduct a prompt investigation, or have an outside vendor or service provider designated to act for you do so, to determine whether an event has occurred, its nature and scope and the nonpublic information involved, and to restore the security of the compromised information systems; keep records of all cybersecurity events for at least five years and produce them on demand of the commissioner.

R.I. Gen. Laws sec. 27-2-29(h)(3) · Read the law's page

• If you are a foreign insurance company and learn that a cybersecurity event has or may have occurred, conduct, or have an outside vendor or service provider designated to act for you conduct, a prompt investigation (R.I. Gen. Laws sec. 27-2-29(h)(3)).
• Maintain records concerning all cybersecurity events for at least five years from the date of each event, and produce those records upon the commissioner's demand (R.I. Gen. Laws sec. 27-2-29(h)(3)(iii)).

R.I. Gen. Laws sec. 27-2-30 · Read the law's page

• As an insurer, notify the commissioner as promptly as possible, and no later than three business days from a determination that a cybersecurity event has occurred, when you reasonably believe that the nonpublic information involved affects 250 or more consumers residing in Rhode Island and either you must give notice of the event to a government body, self-regulatory agency or other supervisory body under state or federal law, or the event has a reasonable likelihood of materially harming any consumer residing in Rhode Island or any material part of your normal operations (section 27-2-30(a)).
• Provide the notice in electronic form as the commissioner directs, with the listed information (the date of the event, how the information was exposed, lost, stolen or breached, how the event was discovered, whether the information was recovered, the source of the event, any police report or notice to regulators, the types of information acquired, the period of compromise, the best estimate of affected Rhode Island consumers, the results of your internal review, your remediation efforts, a copy of your privacy policy and your plan to investigate and notify consumers, and a contact person), and keep updating and supplementing the notice (section 27-2-30(b)).
• Comply with chapter 49.3 of title 11 as applicable, and give the commissioner a copy of the notice sent to consumers when you are required to notify the commissioner (section 27-2-30(c)).
• Treat a cybersecurity event involving your nonpublic information in a system maintained by a third-party service provider as you would under subsection (a); your deadlines begin the day after the provider notifies you or you otherwise have actual knowledge, whichever is sooner (section 27-2-30(d)).
• As an assuming insurer, notify your affected ceding insurers and the commissioner of your state of domicile within seventy-two hours of determining that a cybersecurity event has occurred, or of receiving notice from your third-party service provider (section 27-2-30(e)).
• Notify the producers of record of all affected consumers who accessed your services through an independent insurance producer as soon as practicable as the commissioner directs, unless you lack current producer of record information for an individual consumer (section 27-2-30(f)).

R.I. Gen. Laws sec. 19-14-35 · Read the law's page

• Applies to a licensee under chapter 19-14 of the Rhode Island General Laws, which you declare by stating that you provide financial services: a person licensed to make or fund loans, broker loans, provide currency transmission, cash checks, provide debt-management services, perform the duties of a mortgage-loan originator or service a loan as a third-party loan servicer. A regulated institution as defined in section 19-1-1, its subsidiary, and a bank holding company or subsidiary of a bank holding company subject to federal bank holding company laws and regulations are outside the section.
• Develop, implement and maintain a comprehensive written information security program, in one or more readily accessible parts, with administrative, technical and physical safeguards appropriate to your size and complexity, the nature and scope of your activities including your use of third-party service providers, and the sensitivity of the customer information you hold.
• Designate a qualified individual, who may be employed by you, an affiliate or a service provider, to oversee, implement and enforce the program; where a service provider or affiliate fills that role, retain responsibility for compliance, designate a senior member of the licensee to direct and oversee the qualified individual, and require the provider or affiliate to maintain a program that protects you.
• Perform a written risk assessment that identifies reasonably foreseeable internal and external risks to the security, confidentiality and integrity of customer information, with criteria for evaluating and categorizing risks and for assessing the confidentiality, integrity and availability of information systems and customer information, and periodically perform additional risk assessments.
• Design and implement safeguards to control the identified risks, including access controls, encryption of customer information in transit over external networks and at rest (or effective alternative compensating controls approved by the qualified individual where encryption is infeasible), secure development practices, multi-factor authentication for any individual accessing any information system unless the qualified individual approves in writing reasonably equivalent or more secure controls, change management procedures, and policies, procedures and controls to monitor and log the activity of authorized users.
• Develop, implement and maintain procedures for the secure disposal of customer information in any format no later than two years after the last date the information is used in connection with the product or service to the customer, unless it is necessary for business operations or other legitimate business purposes, is required to be retained by law or regulation, or targeted disposal is not reasonably feasible, and periodically review data retention policies.
• Test the program: absent effective continuous monitoring, conduct annual penetration testing of your information systems determined each year by your risk assessment, and vulnerability assessments at least every six months and whenever there are material changes to operations or business arrangements or circumstances you know or have reason to know may materially affect the program.
• Provide personnel with security awareness training that is updated to reflect risks identified by the risk assessment, use qualified information security personnel sufficient to manage information security risks, and verify that key information security personnel keep their knowledge of threats and countermeasures current.
• Select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue, require them by contract to implement and maintain those safeguards, and periodically assess them based on the risk they present.
• Establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity or availability of customer information in your control, and a written plan addressing business continuity and disaster recovery.
• Require the qualified individual to report in writing, at least annually, to your board of directors or equivalent governing body, or to a senior officer responsible for the program if there is none, on the overall status of the program and your compliance and on material matters including risk assessment, service provider arrangements, test results and security events.

R.I. Gen. Laws sec. 19-14-36 · Read the law's page

• Applies to a licensee under chapter 19-14 of the Rhode Island General Laws, which you declare by stating that you provide financial services: a person licensed to make or fund loans, broker loans, provide currency transmission, cash checks, provide debt-management services, perform the duties of a mortgage-loan originator or service a loan as a third-party loan servicer. A regulated institution as defined in section 19-1-1, its subsidiary, and a bank holding company or subsidiary of a bank holding company subject to federal bank holding company laws and regulations are outside the section.
• Notify the director or the director's designee as promptly as possible, and in no event later than three business days from a determination that a security event has occurred, when you must give notice of the event to a governmental body, self-regulatory agency or other supervisory body under state or federal law, or the event has a reasonable likelihood of materially harming any consumer residing in Rhode Island or any material part of your normal operations.
• Give the notice in electronic form as the director directs, and keep updating and supplementing it with later notifications about the security event.
• Include in the notice your name and contact information, the types of information involved, the date or date range of the event if it is possible to determine, the total number of Rhode Island consumers affected or potentially affected (a best estimate in the initial report, updated with each later report), a general description of how the information was exposed, lost, stolen or breached and the roles of any third-party service providers, the efforts under way to remediate the situation, whether a law enforcement official has given you a written determination that notifying the public would impede a criminal investigation or damage national security, and a contact person familiar with the event.
• Comply with chapter 49.3 of title 11 as applicable, and give the director a copy of the notice sent to consumers when you are required to notify the director.

230-RICR-20-60-7 · Read the law's page

• As an insurance licensee, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices not later than when you establish the customer relationship, and give each consumer such a notice before you disclose any nonpublic personal financial information about the consumer to a nonaffiliated third party other than as sections 7.16 and 7.17 authorize (section 7.5(A)).
• Give each customer such a notice at least once in any period of twelve consecutive months during which the customer relationship continues (section 7.6(A)).
• Include in each initial, annual and revised notice the categories of nonpublic personal financial information you collect and disclose, the categories of affiliates and nonaffiliated third parties to whom you disclose it, an explanation of the consumer's right to opt out and how to exercise it, and your policies and practices for protecting the confidentiality and security of nonpublic personal financial information (section 7.7(A)).
• Do not, directly or through an affiliate, disclose a consumer's nonpublic personal financial information to a nonaffiliated third party unless you gave the initial notice and an opt out notice, gave the consumer a reasonable opportunity to opt out before the disclosure (for example, 30 days from mailing), and the consumer did not opt out (section 7.12(A)).
• Do not, directly or through an affiliate, disclose a policy number or similar access number or code for a consumer's policy or transaction account to a nonaffiliated third party for use in telemarketing, direct mail marketing or marketing through electronic mail, other than to a consumer reporting agency (section 7.14(A)).
• Do not disclose nonpublic personal health information about a consumer or customer unless you obtain an authorization in written or electronic form that identifies the consumer, describes the information and the recipients, is signed and dated, states how long it remains valid (no more than 24 months) and states the right to revoke; keep the authorization in the individual's record (sections 7.18(A) and 7.19).
• Do not unfairly discriminate against a consumer or customer because the consumer or customer opted out of the disclosure of nonpublic personal financial information or did not grant authorization for the disclosure of nonpublic personal health information (section 7.24).

S 2010, 2026 Regular Session, Rhode Island General Assembly

• This measure is in committee and binds nobody yet; what follows is what it would require if it is enacted in this form.
• If you are a health insurer, be transparent about your use of artificial intelligence in managing coverage decisions and claims.