Is an insurer, in Alabama

Ala. Admin. Code r. 482-1-122-.05 to 482-1-122-.16 and 482-1-122-.18 · Read the law's page

• As an insurance licensee, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices not later than when you establish the customer relationship.
• Give each consumer such a notice before you disclose any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than a disclosure authorized by sections 15 and 16 of the regulation.
• Give each customer such a notice at least once in any period of twelve consecutive months during which the customer relationship continues.
• Include in each initial, annual and revised notice the categories of nonpublic personal financial information you collect and disclose, the categories of affiliates and nonaffiliated third parties to whom you disclose it, the consumer's right to opt out and how to exercise it, and your policies and practices for protecting the confidentiality and security of nonpublic personal information.
• Before you disclose nonpublic personal financial information to a nonaffiliated third party other than as your initial notice described, give the consumer a clear and conspicuous revised notice and a new opt out notice, and a reasonable opportunity to opt out.
• Deliver each required notice so that each consumer can reasonably be expected to receive actual notice in writing or, if the consumer agrees, electronically.
• Do not, directly or through an affiliate, disclose a consumer's nonpublic personal financial information to a nonaffiliated third party unless you gave the initial notice and an opt out notice, gave the consumer a reasonable opportunity to opt out before the disclosure (for example, 30 days from mailing), and the consumer did not opt out.
• Give each consumer a clear and conspicuous opt out notice that states you disclose or reserve the right to disclose nonpublic personal financial information to a nonaffiliated third party, that the consumer has the right to opt out, and a reasonable means to exercise it.
• Do not, directly or through an affiliate, disclose a policy number or similar access number or code for a consumer's policy or transaction account to a nonaffiliated third party for use in telemarketing, direct mail marketing or marketing through electronic mail, other than to a consumer reporting agency.
• When you give nonpublic personal financial information to a nonaffiliated third party to perform services for you, give the initial notice and enter into a contract that prohibits the third party from disclosing or using the information other than to carry out the purposes for which you disclosed it.
• Limit your disclosure and use of nonpublic personal financial information you receive from a nonaffiliated financial institution under an exception to the disclosure and use the exception allows.
• Do not unfairly discriminate against a consumer or customer because the person has opted out of the disclosure of his or her nonpublic personal financial information.

Ala. Code secs. 8-35-1 to 8-35-3 · Read the law's page

• If you are a consumer credit reporting agency, place a security freeze on an Alabama consumer's credit report no later than three business days after receiving the consumer's written request sent by certified mail, and send the consumer written confirmation, with a unique personal identification number or password other than the consumer's Social Security number, within 10 business days of placing it.
• Do not release a frozen credit report or credit score without the consumer's prior express authorization, except to a person or for a use the section exempts.
• Lift a freeze temporarily within 15 minutes of a qualifying telephone or electronic request received during normal business hours, or no later than three business days after a written request, and remove a freeze within three business days of the consumer's request.
• Require proper identification of anyone who asks to place, temporarily lift or remove a freeze, and charge no more than $10 for each placement, permanent removal or temporary lifting, and nothing for placement to a person age 65 or over or to an identity theft victim with a qualifying law enforcement report.
• While a freeze is in place, send the consumer written confirmation within 30 days of a change to the name, date of birth, Social Security number or address on the report, to both the new and former address for an address change.
• Give a consumer who must receive the federal summary of rights the Alabama security freeze notice in section 8-35-3.

Insurance Data Security Law, Ala. Code sec. 27-62-4 · Read the law's page

• Applies to a licensee under Alabama insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate or registered, or required to be, under the insurance laws of Alabama, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state.
• Develop, implement and maintain a comprehensive written information security program, based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information system, commensurate with your size and complexity, your activities (including your use of third-party service providers) and the sensitivity of the nonpublic information.
• Designate the person responsible for the program, identify and assess the reasonably foreseeable internal and external threats to nonpublic information, and implement information safeguards to manage them, assessing the effectiveness of the key controls, systems and procedures at least annually.
• Determine which of the security measures the law lists are appropriate and implement them, which include access controls, encryption of nonpublic information in transit over an external network and on portable devices, multi-factor authentication for employees accessing nonpublic information, regular testing and monitoring of systems, audit trails, and secure disposal of nonpublic information.
• Establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information, your information systems or the continuing functionality of your business.
• Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it holds.
• If you have a board of directors, have the board or a committee require executive management to develop, implement and maintain the program and to report to the board in writing at least annually on the program's overall status, your compliance with the chapter and material matters such as risk assessment, third-party arrangements and cybersecurity events.
• If you are an insurer domiciled in Alabama, submit to the Commissioner of Insurance by February 15 each year a written statement certifying that you comply with the chapter, and keep the supporting records for five years.
• A licensee with fewer than 25 employees, less than $5 million in gross annual revenue or less than $10 million in year-end total assets is exempt from the program duty, and a licensee that meets the HIPAA or Gramm-Leach-Bliley conditions in section 27-62-9 is treated as meeting it.

Ala. SB 63, 2026 Regular Session · Read the law's page

• If you are a health benefit plan provider using artificial intelligence to make medical-necessity determinations on prior-authorization requests, base each determination on the enrollee's own medical history, the clinical circumstances the treating provider presents, and other clinical information in the enrollee's record, not a group dataset.when it serves a financial business
• Certify annually to the Alabama Department of Insurance that the artificial intelligence does not rely on a group dataset, is applied fairly and equitably consistent with applicable federal guidance, and does not discriminate against any subscriber group or enrollee.when it serves a financial business
• Have a licensed physician or other health care professional competent to evaluate the artificial intelligence's recommendation make the final determination to deny, delay, or modify a prior-authorization request based on medical necessity.when it serves a financial business
• Make prominent written disclosure of your use of artificial intelligence in utilization review in your policies and procedures, review its outcomes periodically for accuracy, and keep patient data used in that review within its stated purpose under HIPAA.when it serves a financial business

Ala. Code secs. 27-53-1 to 27-53-4 · Read the law's page

• As a health benefit plan, do not require, as a condition of insurability, that a person take a genetic test to determine whether the person has a predisposition for cancer.
• Do not use the results of a genetic test that may show a person's predisposition for cancer to determine insurability or to otherwise discriminate against the person in rates or benefits based on the results.

Insurance Data Security Law, Ala. Code sec. 27-62-5 · Read the law's page

• As an insurance licensee, keep records concerning all cybersecurity events for at least five years from the date of each event, and produce those records when the Commissioner of Insurance demands them.
• When a cybersecurity event has or may have occurred in a system a third-party service provider maintains, complete the investigation steps in section 27-62-5(b) or confirm and document that the provider has completed them.

Insurance Data Security Law, Ala. Code sec. 27-62-6 · Read the law's page

• As an insurance licensee, notify the Commissioner of Insurance as promptly as possible, and no later than three business days after you determine that a cybersecurity event involving nonpublic information in your possession has occurred, where Alabama is your state of domicile (an insurer) or home state (a producer) and the event has a reasonable likelihood of materially harming an Alabama consumer or any material part of your normal operation.
• Give the same notice where you reasonably believe the nonpublic information involves 250 or more Alabama consumers and the event is one you must report to a government body, self-regulatory agency or other supervisory body under state or federal law, or is reasonably likely to materially harm an Alabama consumer or any material part of your normal operation.
• Give the Commissioner, in electronic form as the Commissioner directs, as much as possible of: the date of the event; how the information was exposed, lost, stolen or breached, including the roles of third-party service providers; how it was discovered; whether it was recovered; the source of the event; any police report or notice to regulators or law enforcement; the specific types of information acquired; the period the system was compromised; your best estimate of the number of affected Alabama consumers, updated with each report; the results of your internal review of controls and procedures; your remediation efforts; a copy of your privacy policy and your plan to investigate and notify affected consumers; and a contact person.
• Keep updating and supplementing the notice for material changes to the information you provided.
• Comply with the Alabama Data Breach Notification Act of 2018, as applicable, and give the Commissioner a copy of the notice sent to consumers.
• When the event occurs in a system maintained by a third-party service provider, treat it as your own event unless the provider gives the Commissioner the notice; your deadlines begin the day after the provider notifies you or you otherwise have actual knowledge, whichever is sooner.
• As an assuming insurer, notify your affected ceding insurers and the Commissioner of your state of domicile within three business days of determining that an event occurred or of receiving notice from your third-party service provider; ceding insurers with a direct contractual relationship with affected consumers give the consumer notices under the Alabama Data Breach Notification Act of 2018.
• As an insurer whose consumer reached your services through an independent insurance producer, notify the producers of record of all affected consumers no later than the time you give notice to the consumers, where consumer notice is required by the Alabama Data Breach Notification Act of 2018.