Is an insurer, in Hawaii

Insurance Cybersecurity Event Notice, Haw. Rev. Stat. Secs. 431:3B-301 to 431:3B-306 · Read the law's page

• This binds every licensee under Hawaii's insurance code, a licensed insurer or producer or other person licensed, authorized or registered under chapter 431 or 432 or holding a certificate of authority under chapter 432D (reached by declaring that you are an insurer); the small-licensee exemption in section 431:3B-104(a)(1) lifts only part II, not these duties (HRS 431:3B-101, 431:3B-104).
• When you learn that a cybersecurity event has or may have occurred, investigate it promptly yourself or through a third-party service provider you designate: determine whether an event occurred, its nature and scope and the nonpublic information involved, and restore the security of the compromised information systems (HRS 431:3B-301(a) and (b)).
• Keep records of all cybersecurity events for at least five years from the date of each event and produce them on the commissioner's demand (HRS 431:3B-301(d)).
• Notify the commissioner as promptly as possible, and in no event later than three business days after you determine that a cybersecurity event impacting 250 or more consumers has occurred, when you are an insurer domiciled in Hawaii or an independent insurance producer whose home state is Hawaii (HRS 431:3B-302(a)(1)).
• Give the same notice when you reasonably believe the nonpublic information involved is of 250 or more consumers residing in Hawaii and the event has a reasonable likelihood of materially harming a consumer residing in Hawaii or a material part of your normal operation (HRS 431:3B-302(a)(2)).
• If law enforcement officials instruct you not to distribute information about the event, you need not notify the commissioner until they instruct you to (HRS 431:3B-302(a)).
• Give the commissioner as much as is possible and practicable of the information section 431:3B-302(b) lists (the date of the event, how the information was exposed, the number of Hawaii consumers affected, the results of your internal review and your remediation efforts) in electronic form as the commissioner directs, and update and supplement the notice as previously provided information materially changes (HRS 431:3B-302(b) to (d)).
• Comply with chapter 487N as applicable and give the commissioner a copy of the notice you send to consumers under it when you are required to notify the commissioner; this notice does not supersede any reporting requirement in chapter 487N (HRS 431:3B-302(e), 431:3B-303).
• Treat a cybersecurity event at a third-party service provider as your own event unless the provider gives the notice, with your deadlines running from the day after the provider notifies you or you otherwise have actual knowledge of the event, whichever is sooner (HRS 431:3B-304).
• If you are an assuming insurer, notify your affected ceding insurers and the commissioner of your state of domicile within three business days after you determine that a cybersecurity event has occurred (HRS 431:3B-305(a)).
• If you are an insurer and a consumer accessed your services through an independent insurance producer, notify the producers of record of all affected consumers as soon as practicable as the commissioner directs (HRS 431:3B-306(a)).

Insurance Data Security Law, Information Security Program, Haw. Rev. Stat. Secs. 431:3B-201 to 431:3B-208 · Read the law's page

• This binds every licensee under Hawaii's insurance code, a licensed insurer or producer or other person licensed, authorized or registered under chapter 431 or 432 or holding a certificate of authority under chapter 432D (reached by declaring that you are an insurer); a licensee with fewer than ten employees, including independent contractors, is exempt from this part (HRS 431:3B-101, 431:3B-104(a)(1)).
• Develop, implement and maintain a comprehensive written information security program, based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information system, sized to your size and complexity, activities and the sensitivity of the information (HRS 431:3B-201).
• Designate one or more employees, an affiliate or a third-party service provider responsible for the program, identify reasonably foreseeable internal and external threats, assess their likelihood and potential damage and the sufficiency of your safeguards, and assess the effectiveness of your key controls, systems and procedures at least annually (HRS 431:3B-202(b)).
• Based on that risk assessment, determine which of the listed security measures are appropriate and implement them: access controls, encryption of nonpublic information in transit over an external network and on portable devices, secure development practices, effective controls that may include multi-factor authentication, testing and monitoring, audit trails and secure disposal, and give your personnel cybersecurity awareness training (HRS 431:3B-203).
• If you have a board of directors, have the board or an appropriate committee require executive management to develop, implement and maintain the program and report to it in writing at least annually (HRS 431:3B-204).
• Exercise due diligence in selecting each third-party service provider and, where appropriate, require it to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it can reach; you had until July 1, 2023 to implement this duty (HRS 431:3B-205, Act 112 section 6).
• Monitor, evaluate and adjust the program for changes in technology, the sensitivity of your nonpublic information, threats, and your own business arrangements (HRS 431:3B-206).
• Establish a written incident response plan that covers the internal response process, its goals, roles and decision-making authority, communications, remediation of weaknesses, documentation and reporting, and revision of the plan after a cybersecurity event (HRS 431:3B-207).
• If you are an insurer domiciled in Hawaii, submit to the commissioner by March 31 each year a written statement certifying your compliance with this part, and keep the supporting records for five years (HRS 431:3B-208).
• Implement these duties, other than the third-party service provider oversight duty, by July 1, 2022 (Act 112 section 6(1)(A)).