Is an insurer, in Iowa

Iowa Admin. Code r. 191-90.2 · Read the law's page

• As an insurance licensee, treat information as outside personally identifiable financial information only if it does not identify a consumer, such as aggregate information or blind data that contains no personal identifiers like account numbers, names and addresses (Iowa Admin. Code 191-90.2).
• As an insurance licensee, treat health information that identifies an individual, or that you have a reasonable basis to believe could be used to identify an individual, as nonpublic personal health information (Iowa Admin. Code 191-90.2).

Iowa Admin. Code r. 191-90.3 to 191-90.7, 191-90.9, 191-90.11 and 191-90.23 · Read the law's page

• As an insurance licensee, do not disclose, directly or through an affiliate, nonpublic personal financial information about a consumer to a nonaffiliated third party, except as the rules authorize, unless you have given the consumer the initial notice, an opt-out notice and a reasonable opportunity to opt out, and the consumer does not opt out (Iowa Admin. Code 191-90.9(1)).
• Give the consumer a reasonable opportunity to opt out, for example by mailing the notices and allowing the consumer to opt out by mailing a form, calling a toll-free number or another reasonable means within 30 days from the date you mailed them (191-90.9(2)).
• Make the opt-out notice state that you disclose or reserve the right to disclose nonpublic personal financial information about the consumer to a nonaffiliated third party, that the consumer has the right to opt out of that disclosure, and a reasonable means by which the consumer may exercise the right (191-90.6(1)).
• Do not disclose a policy number or similar access number or code for a consumer's policy or transaction account to a nonaffiliated third party, other than a consumer reporting agency, for use in telemarketing, direct-mail marketing or marketing through electronic mail to the consumer (191-90.11(1)).
• Do not unfairly discriminate against a consumer or customer because the consumer or customer has opted out of the disclosure of nonpublic personal financial information (191-90.23).
• As an insurance licensee, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices not later than when you establish the customer relationship (Iowa Admin. Code 191-90.3(1)(a)).
• Give each consumer such a notice before you disclose any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than a disclosure that rules 191-90.13 and 191-90.14 authorize (191-90.3(1)(b)).
• Give each customer such a notice not less than annually, meaning at least once in any period of 12 consecutive months during which the customer relationship exists (191-90.4(1)).
• Include in each initial, annual and revised notice the categories of nonpublic personal financial information you collect and disclose, the categories of affiliates and nonaffiliated third parties to which you disclose it, the consumer's right to opt out and how to exercise it, and your policies and practices for protecting the confidentiality and security of the information (191-90.5(1)).
• Before you disclose nonpublic personal financial information to a nonaffiliated third party other than as your initial notice described, give the consumer a clear and conspicuous revised notice, a new opt-out notice and a reasonable opportunity to opt out (191-90.7(1)).

Iowa Admin. Code r. 191-90.17 and 191-90.18 · Read the law's page

• As an insurance licensee, do not disclose nonpublic personal health information about a consumer or customer unless you obtain an authorization from the consumer or customer whose information is sought to be disclosed (Iowa Admin. Code 191-90.17(1)).
• Use an authorization in written or electronic form that identifies the consumer or customer, generally describes the types of information, the parties to whom you disclose it, the purpose and how it will be used, carries the signature and date, and states how long it is valid, that it may be revoked at any time and how to revoke it (191-90.18(1)).
• Limit an authorization to no more than 24 months, honor a revocation made at any time, subject to the rights of one who acted in reliance on the authorization before notice, and keep the authorization or a copy in the individual's record (191-90.18(2) to (4)).

Insurance Data Security Act, Iowa Code secs. 507F.4 and 507F.5 · Read the law's page

• Applies to a licensee under Iowa insurance law, which you declare by stating that you are an insurer: a person licensed, authorized to operate, or registered, or required to be, under the insurance laws of Iowa, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state or jurisdiction.
• Develop, implement and maintain a comprehensive written information security program, based on your risk assessment, commensurate with your size and complexity, the nature and scope of your activities including your use of third-party service providers, and the sensitivity of the nonpublic information you hold.
• Conduct the risk assessment: designate who is responsible for the program, identify reasonably foreseeable internal and external threats to nonpublic information, assess their probability and potential damage, assess the sufficiency of your safeguards, and implement safeguards and assess the effectiveness of their key controls, systems and procedures at least annually.
• Based on the risk assessment, determine which of the security measures the law lists are appropriate and implement each one that is, which include access controls, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices, multi-factor authentication where effective, regular testing and monitoring of systems, audit trails, and secure disposal of nonpublic information.
• Include cybersecurity risks in your enterprise-wide risk management process and give your personnel cybersecurity awareness training that is updated to reflect the risks your risk assessment identifies.
• If you have a board of directors, have the board or an appropriate committee require executive management to develop, implement and maintain the program and to give the board a written report, at least annually, on the program's overall status and your compliance with the chapter.
• Exercise due diligence in selecting third-party service providers, oversee every third-party service provider arrangement, and require each provider to implement appropriate administrative, technical and physical measures to protect and secure the information systems and nonpublic information that it can access or holds (compliance with this duty was due by January 1, 2024).
• Conduct a prompt investigation if you discover that a cybersecurity event has occurred or may have occurred.
• A licensee with fewer than twenty individuals on its workforce, less than five million dollars in gross annual revenue or less than ten million dollars in year-end total assets is exempt from the program duty, a licensee that complies with the Health Insurance Portability and Accountability Act, or that is owned or controlled by a federally insured depository institution that complies with the Gramm-Leach-Bliley Act, is outside the chapter, and a licensee that relies on the Health Insurance Portability and Accountability Act exemption must annually certify its compliance to the commissioner.

Iowa Code § 507F.6 · Read the law's page

• As an insurance licensee, keep all records and documentation related to your investigation of a cybersecurity event for at least five years from the date of the event, and produce them when the commissioner demands them.
• When a cybersecurity event has or may have occurred in an information system a third-party service provider maintains, complete an investigation under section 507F.6 or confirm and document that the provider has completed one.

Iowa Code § 507F.7 · Read the law's page

• As an insurance licensee, notify the Commissioner of Insurance no later than three business days after you confirm a cybersecurity event if you are a domiciled insurer or a producer whose home state is Iowa and a law requires notice to a government body, self-regulatory agency or other supervisory body or the event has a reasonable likelihood of causing material harm to a material part of your normal business, operations or security (Iowa Code 507F.7(1)(a)).
• Notify the Commissioner within the same three business days if you reasonably believe the nonpublic information compromised involves 250 or more consumers and either a law requires notice to a government body, self-regulatory agency or other supervisory body or the event has a reasonable likelihood of causing material harm to a consumer or to a material part of your business, operations or security (507F.7(1)(b)).
• In the notice, give as much as is available of the information 507F.7(2) lists, including the date and time of the event, how the nonpublic information was exposed, the number of consumers affected, the results of any internal review, your remediation efforts, a copy of your privacy policy and your contact person.
• Update and supplement the notice to the Commissioner as material changes to the information occur (507F.7(3)).

Iowa Code § 228.7 · Read the law's page

• If you are a third-party payor or peer review organization receiving mental health information on the patient's prior written consent, first file with the commissioner of insurance a written statement agreeing to instruct your employees and agents to maintain confidentiality, to comply with the limits on use and disclosure, and to destroy the information when it is no longer needed (Iowa Code 228.7(1)).
• Do not allow an employee or agent to use or disclose mental health information except to administer claims, to conduct a utilization and quality control review, to audit claims paid, or as otherwise authorized by law (228.7(2)(a)).
• If you are a self-insured employer that has not filed the statement, do not grant your employees or agents routine or ongoing access to mental health information unless they have signed a statement that they are aware the information may not be used or disclosed except as the subsection provides and that they are aware of the penalty for unauthorized disclosure (228.7(2)(b)).

Iowa Code § 729.6(4) · Read the law's page

• If you are a third-party administrator or health insurer, do not release genetic information pertaining to an individual without the individual's prior written authorization, required for each disclosure and naming the person to whom the disclosure is made (Iowa Code 729.6(4)(a)(1)).
• If you are a health insurer, do not discriminate against an individual or a member of the individual's family on the basis of genetic information or genetic testing (729.6(4)(b)(1)).
• If you are a health insurer, do not consider a genetic propensity, susceptibility or carrier status a preexisting condition for limiting or excluding benefits, establishing rates or providing coverage (729.6(4)(b)(2)).
• If you are a health insurer, do not use genetic information or genetic testing for underwriting health insurance in the individual and group markets (729.6(4)(b)(3)).