Provides financial services, in Vermont

18 V.S.A. sec. 9334; sec. 9335(a), (b) · Read the law's page

• If you offer or issue insurance in Vermont (a policy regulated under title 8, including health, life, disability and long-term care policies, hospital and medical service corporation contracts and health maintenance organization benefit plans), do not underwrite a policy or condition it on any requirement or agreement of the individual to undergo genetic testing, or on the results of genetic testing of a member of the individual's family. Section 9332(b) allows insurance genetic testing only within the limits of section 9334.

Vermont Insurance Data Security Law, 8 V.S.A. § 4728 · Read the law's page

• Applies to a licensee under Vermont insurance law, which you declare by stating that you are an insurer: a person licensed, authorized to operate or registered, or required to be licensed, authorized or registered, under the insurance laws of Vermont, other than a captive insurance company, a purchasing group or risk retention group, or a licensee domiciled elsewhere acting as an assuming insurer for a Vermont-domiciled licensee.
• Develop, implement and maintain a comprehensive written information security program based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information system, in proportion to your size and complexity, the nature and scope of your activities, including your use of third-party service providers, and the sensitivity of the nonpublic information.
• Designate one or more employees, an affiliate or an outside vendor as responsible for the program, identify reasonably foreseeable internal and external threats, including threats to information held by third-party service providers, and at least annually assess the effectiveness of your safeguards' key controls, systems and procedures.
• Implement the security measures your risk assessment makes appropriate, including access controls, encryption of nonpublic information in transit over an external network and on laptops and portable media, multi-factor authentication where effective, regular testing and monitoring, audit trails and secure disposal.
• Establish a written incident response plan designed to promptly respond to and recover from any cybersecurity event that compromises nonpublic information, your information systems or the continuing functionality of your business.
• If you learn that a cybersecurity event has or may have occurred, conduct a prompt investigation or have a designated outside vendor or service provider conduct it, and keep records of all cybersecurity events for at least 5 years and produce them on the commissioner's demand.
• Exercise due diligence in selecting each third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it can access or holds. This duty applied from two years after January 1, 2023, and the rest of subsection (d) from one year after that date.
• If you are an insurer domiciled in Vermont, submit to the commissioner on or before April 15 each year a written statement certifying compliance with subsection (d), and keep the supporting records for 5 years.
• A licensee with fewer than 20 employees, including independent contractors, is exempt from subsection (d). A licensee in compliance with 23 NYCRR Part 500 is considered to meet the section if it certifies that in writing to the commissioner.