Provides financial services, in Virginia

Va. Code Ann. § 38.2-508.4 · Read the law's page

• If you propose to issue, re-issue or renew a policy, contract or plan of accident and sickness insurance (other than disability income insurance) as an insurer providing hospital, medical and surgical or major medical coverage on an expense incurred basis, a health services plan corporation or a health maintenance organization, do not use genetic information obtained about an individual, or the individual's request for genetic services, to terminate, restrict, limit or condition coverage or restrict its sale, cancel or refuse to renew coverage, exclude the individual from coverage, impose a waiting period, require a rider excluding benefits or services, or establish differentials in premium rates.
• Do not discriminate in the fees or commissions of an agent or agency for an enrollment, subscription or renewal on the basis of a person's genetic characteristics that may be associated with disability in that person or that person's offspring.

Va. Code Ann. §§ 38.2-604.1 and 38.2-612.1 · Read the law's page

• If you are an insurance institution or agent, give an applicant a clear and conspicuous written (or, if the applicant agrees, electronic) notice of your financial information collection and disclosure practices before disclosing financial information about the applicant to a nonaffiliated third party other than as section 38.2-613 permits, and give a policyholder the notice no later than delivery or issuance of the policy and not less than once in each calendar year (title insurance policyholders excepted from the annual notice) (section 38.2-604.1(A)).
• State in the notice the types of financial information that may be collected and disclosed, the categories of persons to whom it may be disclosed, the right to direct that financial information not be disclosed to nonaffiliated third parties, your policies for protecting its confidentiality and security, any affiliate-sharing disclosure the federal Fair Credit Reporting Act requires, and the practices that apply to former policyholders, and send a revised notice before disclosing financial information in a way the earlier notice did not describe (section 38.2-604.1(B) and (F)).
• Do not disclose financial information about an individual to a nonaffiliated third party, directly or through an affiliate, other than as section 38.2-613 permits, unless the individual received a clear and conspicuous notice, had an opportunity of not less than 30 days from the notice to direct that it not be disclosed, was given a reasonable means to exercise that right, and the third party agrees not to disclose the information further except as the article would permit (section 38.2-612.1(A)).
• Do not disclose to a nonaffiliated third party, other than a consumer reporting agency, a policy number or similar access number or transaction account of a policyholder or applicant for use in telemarketing, direct mail marketing or other marketing through electronic mail, except to an agent or other person marketing your own products who cannot initiate charges to the account, or to a participant in a private label credit card, affinity or similar program identified to the policyholder or applicant (section 38.2-612.1(B)).
• Do not unfairly discriminate against an individual because the individual has directed that personal information not be disclosed under section 38.2-612.1(A), or has refused to authorize disclosure of privileged information or medical record information under section 38.2-613(A) (section 38.2-612.1(C)).

Va. Code Ann. § 38.2-624 · Read the law's page

• If you are a licensee (a person licensed, authorized to operate or registered, or required to be, under the insurance laws of the Commonwealth, other than a purchasing group or a risk retention group chartered in another state or an assuming insurer domiciled elsewhere) and learn that a cybersecurity event has or may have occurred, conduct, or have an investigator conduct, a prompt investigation (section 38.2-624(A)).
• In the investigation, determine as much as possible of whether a cybersecurity event has occurred, its nature and scope and the nonpublic information involved, and perform or oversee reasonable measures to restore the security of the compromised information systems (section 38.2-624(B)).
• Where the event occurs in a system a third-party service provider maintains, complete those steps or make reasonable efforts to confirm and document that the provider has completed them (section 38.2-624(C)).
• Maintain records concerning all cybersecurity events for at least five years from the date of each event, and produce those records upon the Commissioner's demand (section 38.2-624(D)).

Va. Code Ann. §§ 38.2-623 and 38.2-624 · Read the law's page

• This binds a licensee: any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered under the insurance laws of the Commonwealth, other than a purchasing group or a risk retention group chartered and licensed in another state or an assuming insurer domiciled in another state; declare is_insurer if your organization is one.
• Develop, implement, and maintain a comprehensive written information security program, based on your assessment of your risk, that contains administrative, technical, and physical safeguards for the protection of nonpublic information and your information system, commensurate with your size and complexity, the nature and scope of your activities including your use of third-party service providers, and the sensitivity of the nonpublic information.
• Design the program to protect the security and confidentiality of nonpublic information and the security of the information system, protect against reasonably foreseeable threats or hazards to their security or integrity, protect against unauthorized access to or use of nonpublic information, minimize the likelihood of harm to any consumer, and define and periodically reevaluate a schedule for retention of nonpublic information and a mechanism for its destruction.
• Designate one or more employees, an affiliate, or an outside vendor responsible for the program; place access controls on information systems; restrict access to physical locations containing nonpublic information to authorized persons; protect against destruction, loss, or damage of nonpublic information from environmental hazards or technological failures; maintain procedures for the secure disposal of nonpublic information in any format; stay informed of emerging threats or vulnerabilities; and provide personnel with cybersecurity awareness training.
• If you have a board of directors, the board or an appropriate committee must require executive management or its delegates to develop, implement, and maintain the program and to report to it in writing on the overall status of the program and your compliance with the article, and on material matters such as risk assessment, third-party service provider arrangements, testing results, and cybersecurity events.
• Beginning July 1, 2022, if you use a third-party service provider, exercise due diligence in selecting it and require it to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the provider.
• Monitor, evaluate, and adjust the program as relevant changes occur in technology, the sensitivity of your nonpublic information, internal or external threats, and your own business arrangements such as mergers, alliances, outsourcing, and changes to information systems.
• Establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information, your information systems, or the continuing functionality of your business or operations, addressing the internal response process, the plan's goals, roles and decision-making authority, external and internal communications, remediation of identified weaknesses, documentation and reporting, and evaluation and revision of the plan after an event.
• If you learn that a cybersecurity event has or may have occurred, conduct a prompt investigation, or have an investigator do so, determining whether an event occurred, its nature and scope, the nonpublic information involved, and performing or overseeing reasonable measures to restore the security of the compromised systems; where the event is in a third-party service provider's system, complete those steps or make reasonable efforts to confirm and document that the provider has completed them.
• Maintain records concerning all cybersecurity events for at least five years from the date of the event and produce them on the Commissioner's demand.
• If you are an insurer domiciled in the Commonwealth, submit to the Commissioner by February 15 each year, beginning in 2023, a written statement certifying that you are in compliance with section 38.2-623, any rules adopted under the article, and any requirements prescribed by the Commission, keep the supporting records for five years, and document any areas, systems, or processes that need material improvement together with the remedial efforts planned and underway.
• A licensee subject to HIPAA that maintains a program under it, certifies its compliance, and certifies that it will protect nonpublic information not subject to HIPAA in the same manner is considered to meet the program duty, and a licensee affiliated with a depository institution whose program complies with the Interagency Guidelines is considered to meet it on producing documentation the Commissioner finds satisfactory; a licensee that ceases to qualify for an exception has 180 days to comply.

Va. Code Ann. §§ 38.2-625 and 38.2-626 · Read the law's page

• If you are a licensee (a person licensed, authorized to operate or registered, or required to be, under the insurance laws of the Commonwealth, other than a purchasing group or a risk retention group chartered in another state or an assuming insurer domiciled elsewhere) and you determine that a cybersecurity event has actually occurred, notify the Commissioner in electronic form as promptly as possible and no later than three business days after the determination if you are a domestic insurance company, or a producer whose home state is Virginia and the event meets the Commission's thresholds, or you reasonably believe the nonpublic information involved is of 250 or more consumers residing in Virginia, or you must notify any government body, self-regulatory agency or supervisory body under federal law or another state's law (section 38.2-625(A)).
• Include in the notice to the Commissioner as much as possible of the date of the event, how the nonpublic information was exposed, how the event was discovered, whether information was recovered, the source, any police report or regulatory notice, the types of information, the period of compromise, the best estimate of the number of Virginia consumers affected, the results of any internal review, the remediation under way, a copy of your consumer privacy policy with a statement of the steps you will take to investigate and notify affected consumers, and a contact person, and keep updating and supplementing the notice (section 38.2-625(B) and (C)).
• Notify affected consumers without unreasonable delay after determining or receiving notice that a cybersecurity event occurred, where consumers' nonpublic information was accessed and acquired (or you reasonably believe it was) by an unauthorized person and the event has a reasonable likelihood of causing or has caused identity theft or other fraud, describing the incident, the type of information, your acts to protect it, a telephone number if one exists, and advice to review account statements and credit reports, and send the Commissioner a copy of the consumer notice (sections 38.2-626(A) and 38.2-625(D)).
• Give notice to consumers in writing to the last known postal address, by telephone or electronically, using substitute notice only where the cost exceeds $50,000, the class exceeds 100,000 consumers or you lack sufficient contact information or consent, and where you notify more than 1,000 consumers at one time, also notify without unreasonable delay all nationwide consumer reporting agencies of the timing, distribution and content of the notice (section 38.2-626(B) and (C)).
• Where the event occurs in a system a third-party service provider maintains, treat it as your own event unless the provider gives notice under the article, counting your deadlines from the day after the provider notifies you or you otherwise have actual knowledge; an assuming insurer must notify affected ceding insurers and the head of its domiciliary supervisory state agency within three business days, and an insurer must notify the producers of record of affected consumers as soon as practicable as the Commissioner directs (sections 38.2-625(E) to (G) and 38.2-626(F)).

14VAC5-430-40 and 14VAC5-430-50 (Virginia Administrative Code) · Read the law's page

• This binds a licensee as the Insurance Data Security Act defines the term: any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered under the insurance laws of Virginia, other than a purchasing group or a risk retention group chartered and licensed in another state or an assuming insurer domiciled in another state; declare is_insurer if your organization is one.
• Conduct a periodic risk assessment that identifies reasonably foreseeable internal or external threats to nonpublic information (including information held by third-party service providers), assesses the likelihood and potential damage of those threats and the sufficiency of your policies, procedures, information systems, and other safeguards, implements safeguards to manage the threats, and assesses the effectiveness of the key controls, systems, and procedures at least annually.
• Based on your risk assessments, implement appropriate security measures: manage your data, personnel, devices, systems, and facilities in accordance with identified risk; protect by encryption or other appropriate means all nonpublic information transmitted over an external network and all nonpublic information stored on portable computing or storage devices or media; adopt secure development practices for applications developed in-house and procedures for evaluating the security of externally developed applications; implement effective access controls, which may include multi-factor authentication; and use audit trails or audit logs designed to detect and respond to cybersecurity events and to reconstruct material financial transactions.
• If you use a third-party service provider, exercise due diligence in selecting it and require it to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the provider.
• Meet the risk assessment and security measure requirements on or before July 1, 2022.

Va. Code Ann. § 38.2-613(B)(8) · Read the law's page

• If you are an insurance institution, agent or insurance-support organization disclosing personal or privileged information about an individual for an actuarial or research study without the individual's written authorization, make sure no individual may be identified in any actuarial or research report, return or destroy the materials that allow the individual to be identified as soon as they are no longer needed, and get the actuarial or research organization to agree not to disclose the information unless the disclosure would otherwise be permitted by section 38.2-613 if made by an insurance institution, agent or insurance-support organization (section 38.2-613(B)(8)).

Va. Code Ann. §§ 38.2-600 to 38.2-619 · Read the law's page

• If you are an insurance institution, agent or insurance-support organization subject to the article, do not use or authorize a pretext interview to obtain information in connection with an insurance transaction, except to investigate a claim where there is a reasonable basis, shown by specific information available for review by the Commission, for suspecting criminal activity, fraud, material misrepresentation or material nondisclosure, and then only to interview a person or institution with no privileged relationship with the person the information concerns (section 38.2-603).
• If you are an insurance institution or agent, give each applicant or policyholder a written (or, if the person agrees, electronic) notice of insurance information practices at the times section 38.2-604 sets, stating whether personal information may be collected from persons other than the individual, the types of information, sources and investigative techniques, the disclosures made without authorization, the access and correction rights, and that an insurance-support organization may retain and disclose its report; an abbreviated notice may be given instead, with the full notice furnished on request (section 38.2-604).
• Clearly specify the questions designed to obtain information solely for marketing or research purposes, and use a disclosure authorization form only if it is in plain language, dated, and states the types of persons authorized to disclose, the nature of the information, the recipients, the purposes, how long it is valid, and the right to a copy (sections 38.2-605 and 38.2-606).
• Do not prepare or request an investigative consumer report for an application, renewal, reinstatement or change in benefits unless you inform the individual that the individual may request an interview and may receive a copy of the report (section 38.2-607).
• On an individual's written request after proper identification, within 30 business days tell the individual the nature and substance of recorded personal information, let the individual see and copy it, disclose to whom it was disclosed in the previous two years, and provide a summary of the correction procedures; supply medical-record information directly or through a medical professional the individual designates (section 38.2-608).
• Within 30 business days of a written request to correct, amend or delete recorded personal information, either do so and notify the individual and the designated recipients the section names, or notify the individual of the refusal, the reasons and the right to file a statement of disagreement, then file and pass on that statement with any later disclosure (section 38.2-609).
• After an adverse underwriting decision, give written notice with the specific reasons (or advise that they may be requested in writing) and a summary of the individual's rights, and on a written request within 90 business days furnish within 21 business days the specific reasons, the specific items of personal and privileged information that support them, and the names and addresses of the institutional sources (section 38.2-610).
• Do not seek information about a previous adverse underwriting decision or earlier residual market coverage unless the inquiry also asks for the reasons, and do not base an adverse underwriting decision on the fact of a previous adverse decision, earlier residual market coverage, personal information received from an insurance-support organization whose primary source is insurance institutions, or the fact of earlier coverage from a particular insurer or agent (sections 38.2-611 and 38.2-612).
• Do not disclose medical-record information or privileged information about an individual collected or received in connection with an insurance transaction without the individual's written authorization, and disclose other personal information only within the grounds section 38.2-613(B) and (C) list (section 38.2-613).
• If you issue accident and sickness insurance of the kind section 38.2-613(D) names, do not disclose genetic information about an individual or a family member collected or received in connection with an insurance transaction unless the individual authorizes it in writing (section 38.2-613(D)).
• Do not knowingly and willfully obtain information about an individual from an insurance institution, agent or insurance-support organization under false pretenses (section 38.2-619).