Is an insurer, in Delaware

Del. Code Ann. tit. 18, §§ 7401 to 7405 · Read the law's page

• If you are an insurer, do not request or require that an applicant submit to an HIV test unless you first obtain the applicant's prior written informed consent, reveal to the applicant the use to which the HIV test results may be put and the entities to whom they may be disclosed, and give the applicant written information the Department of Health and Social Services approves.
• Do not use a positive ELISA test result for any purpose unless a Western Blot Assay or an equivalent or more accurate confirmatory test has confirmed it.
• Maintain strict confidentiality regarding HIV test results and do not disclose them outside your company except as sections 7404 and 7405 allow, which include disclosure on the applicant's written informed consent to your reinsurers and to retained medical personnel and affiliates, other than agents and brokers, involved in the underwriting or claims decision, and a report of a confirmed positive result to a medical information exchange agency in a form that identifies only an abnormal blood test result or uses a neutral identifier.
• If you do not issue a policy because of HIV test results, notify the applicant in writing of an adverse underwriting decision without disclosing the specific results to the applicant, tell the applicant the results will go to the physician the applicant designated, and ask the applicant to name a physician if none was named.

Del. Code Ann. tit. 18, § 8605 · Read the law's page

• As an insurance licensee, keep records concerning each cybersecurity event for at least 5 years from the date of the event, and produce those records when the Commissioner demands them.
• When a cybersecurity event has or may have occurred in a system a third-party service provider maintains, complete the investigation steps in section 8605(b) or make reasonable efforts to confirm and document that the provider has completed them.

Del. Code Ann. tit. 18, § 8606 · Read the law's page

• If you are a licensee under the Delaware Insurance Code, notify the Insurance Commissioner as promptly as possible, and no later than 3 business days after you determine that a cybersecurity event has occurred, where you are an insurer domiciled in Delaware or a producer whose home state is Delaware and the event results in a reasonable likelihood of materially harming a consumer or a material part of your normal operation or you must give notice to a government body, self-regulatory agency or other supervisory body under state or federal law, or where you reasonably believe the nonpublic information involved is about 250 or more consumers and the event requires such notice or has a reasonable likelihood of materially harming a consumer or a material part of your operations.
• Give the Commissioner the notice in the form the Commissioner directs, update and supplement it for material changes, and provide as much as possible of the information section 8606(b)(2) lists, including the date and cause of the event, the types of information acquired, the number of consumers in Delaware affected, the results of your internal review, your remediation efforts, a copy of your privacy policy and a statement of the steps you will take to investigate and notify consumers.
• Where the event has a reasonable likelihood of materially harming a consumer and you must notify the Commissioner, notify each affected consumer without unreasonable delay and no later than 60 days after you determine that the event occurred, subject to the exceptions in section 8606(c)(1), and send the Commissioner a copy of the notice.
• If the event includes a Social Security number, offer each consumer whose nonpublic information was breached, or is reasonably believed to have been breached, credit monitoring services at no cost for 1 year, with the information needed to enroll and on how to place a credit freeze, unless an appropriate investigation reasonably shows the event is unlikely to result in harm to the consumer.
• Treat an event in a system a third-party service provider maintains as your own event unless the provider notifies the Commissioner, with your deadline running from the first business day after the provider notifies you or you otherwise have actual knowledge of the event.
• If you are an assuming insurer and the event involves nonpublic information you use or hold without a direct contractual relationship with the affected consumer, notify your affected ceding insurers and the Commissioner of your state of domicile within 3 business days of determining that an event has occurred. If you are an insurer and consumer notice is required for an event involving a consumer who reached you through an independent producer, notify the producers of record reasonably concurrently with the consumer notice.

Del. Code Ann. tit. 18, §§ 8604, 8605 · Read the law's page

• Applies to a licensee under the Delaware Insurance Code, which you declare by stating that you are an insurer: a person who is licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered, under the insurance laws of Delaware, other than a purchasing group or risk retention group chartered and licensed in another state and a licensee acting as an assuming insurer domiciled in another state or jurisdiction.
• Develop, implement, and maintain a comprehensive, written information security program that is based on your risk assessment and contains administrative, technical, and physical safeguards for nonpublic information and your information system, commensurate with your size and complexity, the nature and scope of your activities, including your use of a third-party service provider, and the sensitivity of the nonpublic information.
• Designate one or more employees, an affiliate, or an outside vendor to manage and oversee the program, identify reasonably foreseeable internal and external threats, including threats to nonpublic information held by a third-party service provider, assess their likelihood and potential damage and the sufficiency of your safeguards, and at least annually assess the effectiveness of the key controls, systems, and procedures of your safeguards.
• Determine whether each security measure listed in section 8604(d)(2) is appropriate and implement each one that is: access controls on information systems, restricted physical access, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices for applications built in-house and procedures for evaluating or testing externally developed applications, effective authentication controls that may include multi-factor authentication, regular testing and monitoring, audit controls, protection against environmental hazards, and secure disposal of nonpublic information in any format.
• Include cybersecurity risks in your enterprise risk management process, stay informed regarding emerging threats or vulnerabilities, and give your personnel cybersecurity awareness training that is updated to reflect the risks identified in your risk assessment.
• If you have a board of directors, have the board or an appropriate committee require executive management or its delegates to develop, implement, and maintain the program and to report in writing at least annually on the overall status of the program, your compliance with the chapter, and material matters such as risk assessment, third-party service provider arrangements, testing results, and cybersecurity events.
• Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical, and physical measures to protect and secure the information system and nonpublic information it has access to or holds; the section 8604(f) duty took effect 2 years after the Act's effective date.
• Monitor, evaluate, and adjust the program consistent with relevant changes in technology, the sensitivity of your nonpublic information, internal or external threats, and your own changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to information systems.
• Establish a written incident response plan designed to promptly respond to, and recover from, a cybersecurity event that compromises the confidentiality, integrity, or availability of your nonpublic information, your information system, or the continuing functionality of any aspect of your business or operations, covering the internal response process, goals, roles and decision-making authority, communications, remediation of weaknesses, documentation and reporting, and revision after an event.
• If you learn that a cybersecurity event has or may have occurred, conduct a prompt investigation, or have an outside vendor or service provider designated to act on your behalf conduct one: determine whether an event occurred, assess its nature and scope, identify the nonpublic information involved, and perform or oversee reasonable measures to restore the security of the compromised information system.
• Keep records concerning a cybersecurity event for at least 5 years from the date of the event and produce them on the Commissioner's demand.
• If you are an insurer domiciled in Delaware, submit a written statement to the Commissioner by February 15 each year certifying that you comply with section 8604, keep the supporting records, schedules, and data for 5 years, and document any area, system, or process that requires material improvement together with the remedial effort planned and underway, available for the Commissioner's inspection.
• A licensee with fewer than 15 employees is exempt from section 8604, and a licensee covered by the federal health privacy law that has established and maintains an information security program under it is considered to meet section 8604 if it is compliant and submits a written statement certifying its compliance; a licensee that ceases to qualify for an exception has 180 days to comply.

Del. Code Ann. tit. 18, § 2317 · Read the law's page

• If you issue, deny, renew or price health insurance in Delaware (health insurance as section 3602 of title 18 defines it, not disability or long-term care insurance), do not discriminate against any individual in the issuance, denial or renewal of, or in the fixing of the rates, terms or conditions for, the insurance based on any genetic characteristic or genetic information.

Del. Code Ann. tit. 18, § 2317A · Read the law's page

• If you are in the business of life insurance, do not, based solely on a genetic characteristic or genetic information contained in the result of a genetic test, deny, refuse to issue, refuse to renew or reissue, cancel or otherwise terminate a policy or restrict coverage, add a surcharge or rating factor to a premium, or otherwise discriminate in offering, issuing, cancelling, the amount of coverage, price, payment of claims or any other condition of a policy without additional actuarial justification. Section 2317A(c) lifts this for a genetic characteristic, genetic information or test result that is in the individual's medical record or pertinent family history.
• Do not require or request that an individual or a member of the individual's family take a genetic test, and do not take into consideration the individual's refusal to take one.
• Do not require or request that an individual provide genetic information received from an entity providing direct-to-consumer genetic testing, or written consent for such an entity to share information about the individual, and do not take into consideration a refusal to provide either.
• Do not attempt to obtain, or obtain, information from an entity providing direct-to-consumer genetic testing without the individual's written informed consent as required under section 1202 of title 16.