Is an insurer, in Indiana

Ind. Code §§ 27-8-26-0.1 to 27-8-26-11 · Read the law's page

• If you are an insurer of health care services coverage, do not require an individual or a member of the individual's family seeking coverage to submit to genetic screening or testing when you process an application or determine insurability (Ind. Code 27-8-26-5(1)).
• Do not consider information from genetic screening or testing adversely to an applicant or covered individual or a family member, inquire directly or indirectly into the results, or decide adversely on entries about the results in medical records or other reports (27-8-26-5(2) to (4)).
• Do not ask an applicant for the results of genetic screening or testing, or questions designed to find out the results, when you develop medical history questions (27-8-26-6).
• Do not cancel, refuse to issue, refuse to renew or refuse to enter into a contract for coverage based on the results of genetic screening or testing (27-8-26-7).
• Do not deliver, issue, renew or execute a contract in Indiana that limits benefits or sets premiums based on the results of genetic screening or testing, and consider results only if the applicant or the individual seeking renewal voluntarily submits them and they are favorable (27-8-26-8 and 27-8-26-9).

Ind. Code § 27-2-27-21 · Read the law's page

• As an insurance licensee, notify the insurance commissioner as promptly as possible, and not later than three business days after you determine that a cybersecurity event involving nonpublic information in your possession has occurred, if Indiana is your state of domicile as an insurer or your home state as a producer and the event has a reasonable likelihood of materially harming a consumer residing in Indiana or a material part of your normal operations (Ind. Code 27-2-27-21(c)(1)).
• Notify the commissioner within the same three business days if you reasonably believe the nonpublic information of at least 250 consumers residing in Indiana was affected and either another state, federal or local law requires notice of the event or the event has a reasonable likelihood of materially harming a consumer residing in Indiana or a material part of your normal operations (27-2-27-21(c)(2)).
• Provide as much as possible of the information section 21(d) lists, in electronic form as the commissioner directs, including the date of the event, how the information was exposed, the types of information involved, the number of Indiana consumers affected, the results of any internal review, your remediation efforts, a copy of your privacy policy and a contact person (27-2-27-21(d)).
• Update and supplement your initial and later notices to the commissioner as material changes to the information occur (27-2-27-21(e)).
• Comply with IC 24-4.9, and send the commissioner a copy of the notice sent to consumers under IC 24-4.9 if you are required to notify the commissioner under subsection (c) (27-2-27-21(f)).

Indiana Insurance Data Security Law, Ind. Code secs. 27-2-27-16 to 27-2-27-20 and 27-2-27-26 · Read the law's page

• This binds a licensee, a person licensed, authorized to operate, or registered, or required to be, under Indiana's insurance title (reached by declaring that you are an insurer, reinsurer or insurance producer). A licensee with fewer than fifty employees, less than $5,000,000 in gross annual revenue, or less than $10,000,000 in year-end total assets is exempt from sections 16 through 20, a licensee governed by HIPAA that maintains a program under it is treated as meeting the chapter except for the notice requirements of section 21, and a licensee affiliated with a financial institution that keeps a program under the Gramm-Leach-Bliley Act interagency guidelines is treated as complying with sections 16 through 20 (section 26).
• Develop, implement, and maintain a comprehensive, written information security program, based on your risk assessment, with administrative, technical, and physical safeguards for nonpublic information and your information systems (section 16).
• Conduct a risk assessment: designate who is responsible for the program, identify reasonably foreseeable internal and external threats including those at third party service providers, assess their likelihood and potential damage and the sufficiency of your safeguards, and assess the effectiveness of key controls, systems, and procedures at least once each year (section 17).
• Based on the risk assessment, design the program to mitigate the identified risks and determine and implement appropriate security measures, which may include access controls, encryption of nonpublic information sent over an external network or stored on portable devices, secure development practices for in-house applications, multi-factor authentication, regular testing and monitoring, audit trails, and secure disposal; include cybersecurity risks in enterprise risk management and provide cybersecurity awareness training (section 18).
• Establish a written incident response plan that addresses the internal response process, goals, roles and decision-making authority, communications, remediation of weaknesses, documentation and reporting, and revision after an event (section 20).
• If you are an insurer domiciled in Indiana, submit a written statement to the commissioner certifying compliance by April 15 each year and keep the supporting records for five years (section 20(c)).

Ind. Code § 16-39-5-2(d), (e) · Read the law's page

• If you are an insurance company other than a life insurance company, do not obtain the results of any genetic screening or testing without a separate written consent by the individual at the time of application for insurance or at any other time (Ind. Code 16-39-5-2(d)).
• Use a consent form that indicates in at least 10 point boldface type that the individual need not consent to releasing the results of any genetic testing or screening, and that the commissioner has approved before use (16-39-5-2(d)(1) and (2)).
• If you inadvertently receive results of genetic testing or screening without the separate consent, do not use them in violation of IC 27-8-26 (16-39-5-2(e)).