Is an insurer, in Kentucky

1990 Ky. Acts ch. 443, sec. 54 · Read the law's page

• If you are an insurer writing life or health insurance delivered or issued for delivery in Kentucky, disclose in writing your intent to test an applicant for human immunodeficiency virus infection or a health condition derived from it, and obtain the applicant's written informed consent before testing (KRS 304.12-013(4)(b)).
• Give the written informed consent a fair explanation of the test, including its purpose, potential uses and limitations, the meaning of its results, and the right to confidential treatment of information (KRS 304.12-013(4)(b)).
• Do not inquire whether an applicant has been tested for or has received a negative result from a specific test for human immunodeficiency virus infection (KRS 304.12-013(4)(e)).
• Maintain strict confidentiality of the results of tests for human immunodeficiency virus infection, and disclose specific results only as required by law or pursuant to a written request or authorization by the applicant, and then only to the persons subsection (4)(f) lists (KRS 304.12-013(4)(f)).

KRS 304.12-085(2) to (4) · Read the law's page

• If you offer or administer a group or individual health benefit plan, do not deny, cancel or refuse to renew medical care benefits or coverage, or vary the premiums, terms or conditions, for a participant or beneficiary on the basis of a genetic test for which symptoms have not manifested, or because the participant or beneficiary requested or received genetic services (KRS 304.12-085(2)).
• If you offer a group or individual health benefit plan, health insurance in connection with a health benefit plan, or a disability income plan, do not request or require an applicant, participant or beneficiary to disclose any genetic test (KRS 304.12-085(3)).
• If you offer a group or individual health benefit plan, or health insurance in connection with a health benefit plan, do not disclose any genetic test about a participant or beneficiary without the participant's prior authorization, which you must obtain for each disclosure (KRS 304.12-085(4)).

KRS 304.17A-555 · Read the law's page

• If you are an insurer, request from a provider only such limited information from a patient's record as is necessary for determining covered services and benefits, medical necessity, appropriateness and quality of care for authorization or continuation of mental health and chemical dependency services, or for payment for those services (KRS 304.17A-555(1)).
• If a provider discloses a patient's records to you, do not redisclose or otherwise reveal the patient's mental health and chemical dependency records beyond the purpose for which the disclosure was made without first obtaining the patient's specific written consent to the redisclosure (KRS 304.17A-555(2)).

806 KAR 3:210 · Read the law's page

• If you are an insurance licensee, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices not later than when you establish the customer relationship, and not less than annually during the relationship (806 KAR 3:210 Sections 5 and 6).
• Give a consumer who is not a customer the same notice before you disclose any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as Sections 15 and 16 authorize (Section 5(1)(b)).
• Before you disclose nonpublic personal financial information about a consumer to a nonaffiliated third party, give an opt-out notice that states you disclose or reserve the right to disclose it, that the consumer may opt out, and a reasonable means to do so, and allow a reasonable opportunity to opt out; mailed notices allow 30 days (Sections 8 and 11).
• Do not disclose nonpublic personal health information about a consumer or customer without an authorization from that person, except for the insurance functions Section 18(2) lists (Section 18).
• Do not unfairly discriminate against a consumer or customer because that person has opted out or has not granted authorization for the disclosure of nonpublic personal financial information (Section 22(1)).

KRS 367.363 to 367.365 · Read the law's page

• If you are a consumer reporting agency, place a security freeze on a consumer's consumer report no later than ten business days after you receive the consumer's request with clear and proper identification, and within the same period give the consumer a unique personal identification number or password and a written explanation of how to place, remove and temporarily lift a freeze (KRS 367.365(1)(a), (2)).
• While a freeze is in place, do not release information from the consumer report to a third party without the consumer's prior express authorization, except to a person or for a purpose KRS 367.365(9) lists (KRS 367.365(1)(b), (9)).
• Comply with a request to temporarily lift a freeze no later than three business days after you receive it, and remove a freeze within three business days after you receive a removal request that carries clear and proper identification and the personal identification number or password (KRS 367.365(6), (8)).
• While a freeze is in place, send the consumer written confirmation within 30 days of posting a change to the consumer's name, date of birth, Social Security number or address, to both the new and the former address for an address change (KRS 367.365(11)).
• Charge no more than ten dollars, adjusted each January 1 under the consumer price index, for placing, temporarily lifting or removing a freeze (KRS 367.365(10)).

Insurance Data Security Law information security program, KRS 304.3-756 · Read the law's page

• Applies to a licensee under Kentucky insurance law, which you declare by stating that you are an insurer: any person who is, or is required to be, licensed, authorized to operate, or registered under the insurance laws of Kentucky, other than a purchasing group or a risk retention group chartered and licensed in another state, or a licensee acting as an assuming insurer domiciled in another state or jurisdiction.
• Develop, implement, and maintain a comprehensive written information security program based on your risk assessment, with administrative, technical, and physical safeguards for nonpublic information and your information system, in proportion to your size and complexity, the nature and scope of your activities, and the sensitivity of the nonpublic information.
• Designate one or more employees, an affiliate, or an outside vendor as responsible for the program, identify and assess reasonably foreseeable internal and external threats, including threats to nonpublic information held by third-party service providers, and at least annually assess the effectiveness of the key controls, systems, and procedures of your safeguards.
• Implement the security measures that are appropriate, including access controls, restricted physical access, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices for in-house applications and testing of externally developed ones, multi-factor authentication where effective, regular testing and monitoring, audit trails, and secure disposal of nonpublic information in any format.
• Include cybersecurity risks in your enterprise risk management process, stay informed regarding emerging threats or vulnerabilities, and give personnel cybersecurity awareness training that is updated to reflect the risks identified in your risk assessment.
• Establish a written incident response plan to promptly respond to and recover from a cybersecurity event, covering its goals, the internal response process, roles and decision-making authority, communications, remediation of weaknesses, documentation and reporting, and revision after an event.
• If you use a third-party service provider, exercise due diligence in selecting it and require it to implement appropriate administrative, technical, and physical measures to protect the information systems and nonpublic information it holds or can access.
• Have your executive management develop, implement, and maintain the program and, if you have a board of directors or other appropriate committee, report to it in writing at least annually on the status of the program, your compliance, and material matters.
• If you are an insurer domiciled in Kentucky, submit to the commissioner by February 15 each year a written statement certifying that you comply with this section, and keep the supporting records for five years.
• A licensee with fewer than fifty employees, including independent contractors, is exempt from KRS 304.3-750 to 304.3-768, and a licensee that meets the compliance conditions of KRS 304.3-766 for the federal health privacy rules or the Gramm-Leach-Bliley Act standards is deemed in compliance if it submits the annual written statement KRS 304.3-766 describes.

KRS 304.3-758 · Read the law's page

• Investigate promptly, as an insurance licensee, any cybersecurity event that has or may have occurred, including determining whether an event has occurred, its nature and scope, and the nonpublic information involved.
• Keep records concerning all cybersecurity events for at least five years from the date of each event, and produce them on the demand of the Commissioner of Insurance.

KRS 304.3-760 · Read the law's page

• If you are an insurer domiciled in Kentucky, an insurance producer whose home state is Kentucky, or a licensee that reasonably believes a cybersecurity event involves nonpublic information of 250 or more Kentucky consumers and requires notice to a governmental body or is reasonably likely to materially harm a consumer or your operations, notify the Commissioner of Insurance of the event as promptly as possible and no later than three business days from your determination that it occurred (KRS 304.3-760(1)).
• Give the Commissioner, in the electronic form it prescribes, the information subsection (2) lists, including the date and discovery of the event, how the information was exposed, the types of information acquired, the period of compromise, the results of your internal review, your remediation efforts, a copy of your privacy policy, and a contact person, and keep updating and supplementing the notice (KRS 304.3-760(2)).
• Comply with KRS 365.732 as applicable (KRS 304.3-760(3)).
• Treat a cybersecurity event in a system maintained by a third-party service provider as you would your own, counting your deadlines from the earlier of the day after the provider notifies you or the day you otherwise have actual knowledge (KRS 304.3-760(4)).
• If you are an assuming insurer with no direct contractual relationship with the affected consumers, notify your affected ceding insurers and the commissioner of your state of domicile within three business days of determining that an event occurred or of receiving notice from your third-party service provider (KRS 304.3-760(6)).
• If you are an insurer and a consumer accessed your services through an independent insurance producer, notify the producers of record at the same time as the affected consumers when you must notify consumers under KRS 365.732, unless you lack the current producer of record information for a consumer (KRS 304.3-760(7)).