Is an insurer, in Louisiana

La. R.S. 22:2505 · Read the law's page

• As an insurance licensee, keep records concerning all cybersecurity events for at least five years from the date of each event, and produce those records when the commissioner demands them.
• When a cybersecurity event has or may have occurred in a system a third-party service provider maintains, make reasonable efforts to complete the investigation steps in R.S. 22:2505(B) or to confirm and document that the provider has completed them.

La. R.S. 22:2506 · Read the law's page

• If you are an insurance licensee, notify the commissioner of insurance without unreasonable delay, and no later than three business days, after you determine that a cybersecurity event involving nonpublic information in your possession has occurred and either this state is your state of domicile (insurer) or home state (producer, adjuster or public adjuster) and the event is reasonably likely to materially harm a consumer residing here or a material part of your normal operations, or you reasonably believe the information involved is for 250 or more consumers residing here and a listed event has occurred.
• Provide as much as possible of the information the section lists, in electronic form as the commissioner directs, and keep updating and supplementing your notifications as material changes occur.
• Comply with the Database Security Breach Notification Law and give the commissioner a copy of the notice you send to consumers.
• If a cybersecurity event occurs in a system maintained by a third-party service provider you know of, treat it as you would an event under subsection A unless the provider gives the notice, and count your deadline from the day after the provider notifies you or you otherwise have actual knowledge.
• If you are an assuming insurer without a direct contractual relationship with the affected consumers, notify your affected ceding insurers and the commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred.
• If you are an insurer and a consumer accessed your services through an independent insurance producer and consumer notice is required, notify the producers of record of all affected consumers no later than the time you notify the consumers.

Insurance Data Security Law, La. R.S. 22:2504 · Read the law's page

• Applies to a licensee under Louisiana insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate or registered, or required to be, under the insurance laws of Louisiana, other than a purchasing group or risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state.
• Develop, implement and maintain a comprehensive, written information security program, based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information system, commensurate with your size and complexity, your activities (including your use of third-party service providers) and the sensitivity of the nonpublic information.
• Designate the person responsible for the program, identify and assess the reasonably foreseeable internal and external threats to nonpublic information, and implement information safeguards to manage them, assessing the effectiveness of the key controls, systems and procedures at least annually.
• Implement the security measures the law lists that you determine are appropriate, which include access controls, encryption of nonpublic information in transit over an external network and on portable devices, multifactor authentication for any individual accessing nonpublic information, regular testing and monitoring of systems, audit trails, and secure disposal of nonpublic information.
• Establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information, your information systems or the continuing functionality of your business.
• Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect and secure the information systems and nonpublic information it holds; this duty has applied since August 1, 2022.
• If you have a board of directors, have the board or a committee require executive management to develop, implement and maintain the program and to report in writing at least annually on the program's overall status, your compliance with the chapter and material matters such as risk assessment, third-party arrangements and cybersecurity events.
• If you are an insurer domiciled in Louisiana, submit to the commissioner by February 15 each year a written statement certifying that you comply with section 2504, and keep the supporting records for five years.
• A licensee with fewer than twenty-five employees, less than five million dollars in gross annual revenue or less than ten million dollars in year-end total assets is exempt from the program duty, and a licensee that meets the HIPAA, Gramm-Leach-Bliley or approved-other-jurisdiction conditions in section 2509 is also exempt.

La. R.S. 22:918 · Read the law's page

• If you are an insurer of life insurance, long-term care insurance or annuity contracts (including insurance agents and third-party administrators), do not take into consideration, in eligibility, premium or other underwriting decisions, that an individual or family member participated in genetic research or testing, unless the individual provides the results for your consideration.
• Do not require or request an individual or family member to take a genetic test.
• Do not cancel, limit, refuse to renew, deny coverage or increase premium rates on an existing policy because an individual or family member requested or received genetic services or participated in genetic research.
• Do not purchase genetic information about an individual without the individual's written consent.

La. Admin. Code tit. 37, pt. XIII, ch. 99, sections 9901 to 9955 (Regulation 76) · Read the law's page

• As a licensee of the Louisiana Department of Insurance, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices not later than when you establish the customer relationship, and give each consumer such a notice before you disclose any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as the regulation's exceptions authorize (La. Admin. Code tit. 37, section 9911(A)).
• Give each customer such a notice not less than annually during the continuation of the customer relationship, unless you have not changed your disclosure policies and practices since the most recent disclosure and provide information to nonaffiliated third parties only in accordance with the regulation (La. Admin. Code tit. 37, sections 9913(A) and (D)).
• Include in each initial, annual and revised notice the categories of nonpublic personal financial information you collect and disclose, the categories of affiliates and nonaffiliated third parties to whom you disclose it, an explanation of the consumer's right to opt out and how to exercise it, and your policies and practices for protecting the confidentiality and security of nonpublic personal information (La. Admin. Code tit. 37, section 9915(A)).
• Give each consumer an opt out notice that states you disclose or reserve the right to disclose nonpublic personal financial information about the consumer to a nonaffiliated third party, that the consumer has the right to opt out of that disclosure, and a reasonable means to exercise the right (La. Admin. Code tit. 37, section 9917(A)).
• Do not, directly or through any affiliate, disclose a consumer's nonpublic personal financial information to a nonaffiliated third party unless you gave the initial notice and the opt out notice, gave the consumer a reasonable opportunity to opt out before the disclosure (for example, 30 days from mailing), and the consumer did not opt out (La. Admin. Code tit. 37, section 9923(A)).
• Do not, directly or through an affiliate, disclose a policy number or similar access number or code for a consumer's policy or transaction account to a nonaffiliated third party for use in telemarketing, direct mail marketing or marketing through electronic mail, other than to a consumer reporting agency (La. Admin. Code tit. 37, section 9927(A)).
• Do not unfairly discriminate against a consumer or customer because the person opted out of the disclosure of nonpublic personal financial information (La. Admin. Code tit. 37, section 9947(A)).

La. R.S. 22:1023 · Read the law's page

• If you are an insurer, do not terminate, restrict, cancel, refuse to renew, deny or exclude coverage, impose an excluding rider, set premium or cost-sharing differentials, or otherwise discriminate against an individual or family member on the basis of genetic information or a request for or receipt of genetic services.
• Do not request, require or purchase genetic information of an individual or family member for underwriting purposes, or before enrollment in connection with enrollment, and do not request or require that an individual, family member or group member undergo a genetic test.
• Do not obtain genetic information from an insured or enrollee, or from their DNA sample, without first obtaining written informed consent, and make any authorization for disclosure meet the section's form: written, signed and dated, naming the discloser and recipient and the specific information and purpose, and expiring within 60 days.
• Do not retain an insured's or enrollee's genetic information without first obtaining their authorization, unless the section's exceptions apply, and treat the information as the insured's or enrollee's property.
• Provide each applicant or enrollee, in the application or enrollment information, a written statement of their rights under the section in a form noticeable and understandable to an average applicant or enrollee.