Provides financial services, in Tennessee

Tenn. Comp. R. & Regs. 0780-01-72 · Read the law's page

• As an insurance licensee, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices not later than when you establish the customer relationship, and give each consumer such a notice before you disclose any nonpublic personal information about the consumer to a nonaffiliated third party other than as rules .15 and .16 authorize (rule 0780-1-72-.05(1)).
• Give each customer such a notice not less than annually during the continuation of the customer relationship (rule 0780-1-72-.06(1)).
• Include in each initial, annual and revised notice the categories of nonpublic personal information you collect and disclose, the categories of affiliates and nonaffiliated third parties to whom you disclose it, an explanation of the consumer's right to opt out and how to exercise it, and your policies and practices for protecting the confidentiality and security of nonpublic personal information (rule 0780-1-72-.07(1)).
• Give each consumer a clear and conspicuous opt out notice that states you disclose or reserve the right to disclose nonpublic personal information about the consumer to a nonaffiliated third party, that the consumer has the right to opt out of that disclosure, and a reasonable means to exercise the right (rule 0780-1-72-.08(1)).
• Do not, directly or through an affiliate, disclose a consumer's nonpublic personal information to a nonaffiliated third party unless you gave the initial notice and an opt out notice, gave the consumer a reasonable opportunity to opt out before the disclosure (for example, 30 days from mailing), and the consumer did not opt out (rule 0780-1-72-.11(1)).
• Do not, directly or through an affiliate, disclose a policy number or similar access number or code for a consumer's policy or transaction account to a nonaffiliated third party for use in telemarketing, direct mail marketing or marketing through electronic mail, other than to a consumer reporting agency (rule 0780-1-72-.13(1)).
• Do not unfairly discriminate against a consumer or customer because the consumer or customer opted out of the disclosure of nonpublic personal information (rule 0780-1-72-.23).

Insurance Data Security Law, Public Chapter 345 (2021), Tenn. Code Ann. secs. 56-2-1004 and 56-2-1005 · Read the law's page

• This binds a licensee, a person licensed, authorized to operate, or registered, or required to be, under Tennessee's insurance title (reached by declaring that you are an insurer, reinsurer or insurance producer). The Law does not apply to a licensee that employs fewer than 25 individuals, has less than $5,000,000 in gross annual revenue, or has less than $10,000,000 in year-end total assets (section 56-2-1009).
• Develop, implement, and maintain a comprehensive, written information security program, based on your risk assessment, that contains administrative, technical, and physical safeguards for nonpublic information and your information system. The duty applied by July 1, 2022 (section 56-2-1004(1)).
• Conduct a risk assessment: designate who is responsible for the program, identify reasonably foreseeable internal and external threats, assess their likelihood and potential damage and the sufficiency of your safeguards, and assess the effectiveness of key controls, systems, and procedures at least annually (section 56-2-1004(3)).
• Determine which of the listed security measures are appropriate and implement them, including access controls, encryption of nonpublic information sent over an external network or stored on portable devices, secure development practices for applications, effective controls that may include multi-factor authentication, regular testing and monitoring, audit trails, and secure disposal of nonpublic information (section 56-2-1004(4)).
• Establish a written incident response plan that addresses the internal response process, goals, roles and decision-making authority, communications, remediation of weaknesses, documentation and reporting, and revision after an event (section 56-2-1004(8)).
• Exercise due diligence in selecting a third-party service provider and, by July 1, 2023, require each one to implement appropriate administrative, technical, and physical measures to protect the information systems and nonpublic information it can reach (section 56-2-1004(6)).
• If you are an insurer domiciled in Tennessee, certify your compliance to the commissioner in writing by April 15 each year and keep the supporting records for five years (section 56-2-1004).
• When you learn that a cybersecurity event has or may have occurred, promptly investigate it, determine its nature and scope and the nonpublic information involved, take reasonable measures to restore security, and keep records of all cybersecurity events for at least five years (section 56-2-1005).

Tenn. Code Ann. sec. 56-2-1005(d), (e) · Read the law's page

• If you are a licensee under Tennessee insurance law, maintain records concerning all cybersecurity events for at least five years from the date of discovery of each event (section 56-2-1005(d)).
• Provide those cybersecurity event records to the commissioner upon request (section 56-2-1005(d)).
• If you investigate or review a potential or suspected cybersecurity event and determine that it is not one, put that determination in writing, keep the writing for at least five years from the date of discovery of the event, and provide it to the commissioner upon request (section 56-2-1005(e)).

Tenn. Code Ann. sec. 56-2-1006 · Read the law's page

• As a licensee, notify the commissioner as soon as practicable, and in no event more than three business days, following a determination that a cybersecurity event has occurred, if you are domiciled in Tennessee (an insurer) or Tennessee is your home state (a producer) and the event has a reasonable likelihood of materially harming a consumer residing in Tennessee or a material part of your normal operations (section 56-2-1006(a)(1)).
• Give the same notice if you reasonably believe that the nonpublic information of 250 or more consumers residing in Tennessee is involved and the event must be reported to a government body, self-regulatory agency or other supervisory body under state or federal law, or has a reasonable likelihood of materially harming a consumer residing in Tennessee or a material part of your normal operations (section 56-2-1006(a)(2)).
• Provide the commissioner, in a format the commissioner directs, as much as is available of the date of the event; how the nonpublic information was exposed, lost, stolen, or breached; how the event was discovered; whether the information was recovered; the source of the event; any police report or notice to regulators or law enforcement; the types of information acquired; the period of compromise; your best estimate of the number of affected Tennessee consumers; the results of your internal review; your remediation efforts; your privacy policy and your plan to investigate and notify affected consumers; a contact person; and a copy of the consumer notice, and continually provide material updates or supplements (section 56-2-1006(b)).
• After you determine that a cybersecurity event has a reasonable likelihood of materially harming a consumer, notify Tennessee consumers whose nonpublic information has been, or is reasonably believed to have been, acquired, no later than 45 days after the determination unless law enforcement needs a longer period, by written notice, electronic notice consistent with 15 U.S.C. 7001 or your primary method of communication with the consumer, or the substitute notice the section describes (section 56-2-1006(c)).
• Treat a cybersecurity event in an information system maintained by a third-party service provider as if it occurred in your own system; your time limits begin when the provider notifies you or you otherwise gain actual knowledge, whichever is sooner (section 56-2-1006(d)).
• As an assuming insurer with no direct contractual relationship with the affected consumers, notify the affected ceding insurers and the commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred, or of your third-party service provider's notice or your actual knowledge, whichever is sooner (section 56-2-1006(e)).
• As an insurer, notify the producers of record of all affected consumers, if known, as soon as practicable but not later than when notice is provided to the affected consumers, unless you do not have the current producer of record information for an individual consumer (section 56-2-1006(f)).
• Exception: the part does not apply to a licensee that employs fewer than 25 individuals, has less than $5,000,000 in gross annual revenue, or has less than $10,000,000 in year-end total assets (section 56-2-1009(a)(1)).
• Exception: a licensee subject to the federal HIPAA rules that maintains nonpublic information in the same manner as protected health information, or subject to Title V of the Gramm-Leach-Bliley Act, meets the consumer notice requirement of section 56-2-1006(c) if it is compliant with that federal law and submits a written statement certifying its compliance (section 56-2-1009(a)(2) and (3)).

Public Chapter 246 (2023), Tenn. Code Ann. title 56, chapter 7, part 27 · Read the law's page

• As a life insurance provider, do not cancel insurance coverage for an individual or a family member of an individual based solely on the individual's or family member's genetic information (section 8(a) of Public Chapter 246).
• Do not request or require an individual to whom you provide life insurance coverage, or an individual who applies for it, to take a genetic test as a precondition of insurability, and do not require the complete genome sequencing of an individual's DNA (section 8(b) of Public Chapter 246).
• Do not access sensitive medical information, including the genetic data of an individual, without first obtaining the individual's signed, written consent (section 8(c) of Public Chapter 246).