Provides financial services, in Texas

28 Tex. Admin. Code secs. 22.1 and 22.2 · Read the law's page

• If you are a covered entity under the Texas Department of Insurance's insurance consumer financial information privacy rule, give individuals notice of your privacy policies and practices (28 Texas Administrative Code Section 22.1(a)(1)).
• Do not disclose nonpublic personal financial information about an individual to a nonaffiliated third party except under the conditions the rule describes, and give the individual the methods the rule provides to prevent that disclosure (28 Texas Administrative Code Section 22.1(a)(2), (3)).

Tex. Ins. Code ch. 601 · Read the law's page

• If you receive an authorization from the Texas Department of Insurance (an insurance covered entity), comply with sections 6802 and 6803 of title 15 of the United States Code, as amended, in the same manner as a financial institution must, which covers the privacy notice and the limits on disclosing nonpublic personal information to nonaffiliated third parties (Tex. Ins. Code sec. 601.002(a)).
• If you are a nonaffiliated third party that receives nonpublic personal information from a covered entity, comply with section 6802(c) of title 15 of the United States Code, as amended, on reuse and redisclosure (Tex. Ins. Code sec. 601.002(b)).

7 Tex. Admin. Code sec. 17.5 · Read the law's page

• This binds a Texas state trust company, other than one exempt under Finance Code section 182.011; declare provides_financial_services if your organization is one.
• Notify the banking commissioner as soon as practicable but prior to customer notification, and not later than 15 days after you determine that a cybersecurity incident regarding your information system will likely require a notice to another state or federal regulator or a self-regulatory body, require a data breach notification to clients or beneficiaries under law such as Business and Commerce Code section 521.053, or substantively impact your ability to effect or report transactions or conduct your business.
• Include in the confidential notice, to the extent known, a description of the incident with its approximate date, discovery date and the data involved, a list of the regulators and bodies notified, and the name, address, telephone number and email address of an employee or agent who can give more information.
• Build the notice requirement into the written incident response plan you maintain as part of your information security program.

7 Tex. Admin. Code sec. 3.24 · Read the law's page

• This binds a Texas state-chartered bank; declare is_bank if your organization is one.
• Notify the banking commissioner of a computer-security incident that qualifies as a notification incident under 12 CFR Part 225, Subpart N, or Part 304, Subpart C, and submit the information those regulations require, no later than the time that information is due to your federal banking regulator; the Department of Banking states that this is 36 hours after you determine a notification incident has occurred.

7 Tex. Admin. Code sec. 33.30 · Read the law's page

• This binds a holder of a money transmission or currency exchange license issued under Finance Code chapter 152; declare provides_financial_services if your organization holds one.
• Notify the banking commissioner as soon as practicable but prior to customer notification, and not later than 15 days after you determine that a cybersecurity incident regarding your information system will likely require a notice or report to another state or federal regulatory or law enforcement agency or a self-regulatory body, require a data breach notification to customers under law such as Business and Commerce Code section 521.053, or substantively impact your ability to effect transactions for customers, report transactions accurately, or conduct your business.
• Include in the notice, to the extent known, a description of the incident with its approximate date, discovery date and the data involved, a list of the regulators and bodies notified (leaving out any suspicious activity report), and the name, address, telephone number and email address of your employee or agent who can give more information.
• Build the notice requirement into the written incident response plan you maintain as part of your information security program.

Tex. Ins. Code § 4201.156 · Read the law's page

• If you are a utilization review agent, do not use an automated decision system, including one that incorporates an AI system, to make an adverse determination wholly or partly; an algorithm, AI system or automated decision system may still be used for administrative support or fraud detection.
• Include in each notice of an adverse determination a description of and the source of the screening criteria and review procedures used as guidelines in making the adverse determination.

Tex. Ins. Code ch. 546 · Read the law's page

• If you are a health benefit plan issuer and ask an applicant to submit to a genetic test in connection with the application, notify the applicant that the test is required, disclose the proposed use of the results and obtain the applicant's written informed consent before the test is administered (Tex. Ins. Code sec. 546.051(a)).
• Do not use the results of that test to induce the purchase of coverage (Tex. Ins. Code sec. 546.051(c)).
• Do not use genetic information, or an applicant's refusal to submit to a genetic test, to reject, deny, limit, cancel, refuse to renew, increase the premiums for or otherwise adversely affect eligibility for or coverage under the plan (Tex. Ins. Code sec. 546.052).
• Destroy a sample of genetic material obtained for a genetic test promptly after the purpose for which it was obtained is accomplished, unless an exception in section 546.054 applies (Tex. Ins. Code sec. 546.054).
• On the written request of an individual who submitted to a genetic test, disclose the test results to the individual or to a physician the individual designates (Tex. Ins. Code sec. 546.101(a)).
• Do not disclose, or be compelled to disclose, genetic information about an individual unless the individual specifically authorized the disclosure by an authorization that meets section 546.104 or an exception in section 546.103 applies (Tex. Ins. Code secs. 546.102(b), 546.103, 546.104).

Tex. Ins. Code ch. 602 · Read the law's page

• If you hold or are required to hold a license, registration or certificate of authority under the Insurance Code (an insurance company, health maintenance organization or insurance agent), obtain authorization before you disclose nonpublic personal health information, unless a function listed in section 602.053 applies (Tex. Ins. Code secs. 602.051(a), 602.053).
• Make a request for authorization clear and conspicuous, in written or electronic form, stating the identity of the consumer or customer, each type of information, each recipient, the purpose, the use and the revocation procedure, with the signature and date and notice of how long the authorization is valid and of the right to revoke it at any time (Tex. Ins. Code secs. 602.051(b), 602.052(a)).
• Do not rely on an authorization that is valid for more than 24 months, and keep the original or a copy in the records of the individual who is the subject of the information (Tex. Ins. Code sec. 602.051(c), (e)).
• Comply with Subchapter D of Health and Safety Code chapter 181 and the standards adopted under section 182.108 of the Health and Safety Code (Tex. Ins. Code sec. 602.054).