Is an insurer, in Maryland

COMAR 31.16.08 · Read the law's page

• As a licensee of the Maryland Insurance Administration, give each customer a clear and conspicuous notice that accurately reflects your privacy policies and practices for nonpublic financial information not later than when you establish the customer relationship, and give each consumer such a notice before you disclose any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as the chapter's exceptions authorize (COMAR 31.16.08.05A).
• Give each customer such a notice at least once in each annual notice period during the continuation of the customer relationship, unless you provide nonpublic personal information to nonaffiliated third parties only within the chapter's exceptions and have not changed your disclosure policies and practices since the most recent notice (COMAR 31.16.08.06A and B).
• Give each consumer an opt out notice that states you disclose or reserve the right to disclose nonpublic personal financial information about the consumer to a nonaffiliated third party, that the consumer has the right to opt out of that disclosure, and a reasonable means to exercise the right (COMAR 31.16.08.08A).
• Comply with a consumer's opt out direction as soon as reasonably practicable after you receive it (COMAR 31.16.08.08E).
• Do not, directly or through an affiliate, disclose a consumer's nonpublic personal financial information to a nonaffiliated third party unless you gave the initial notice and the opt out notice, gave the consumer a reasonable opportunity to opt out before the disclosure (for example, 30 days from mailing), and the consumer did not opt out (COMAR 31.16.08.11A and B).
• Do not, directly or through an affiliate, disclose a policy number or similar access number or code for a consumer's policy or transaction account to a nonaffiliated third party for use in telemarketing, direct mail marketing or marketing through electronic mail, other than to a consumer reporting agency (COMAR 31.16.08.13C).
• Do not disclose nonpublic personal health information about a consumer or customer unless you obtain an authorization from that person, except for the insurance functions the chapter lists (COMAR 31.16.08.17A and B).
• Make each authorization written or electronic, include the identity of the person, a general description of the information, the parties, the purpose and use, the signature and date, and notice of how long it is valid and that it may be revoked at any time, make it valid for no more than 24 months, and keep it or a copy in the individual's record (COMAR 31.16.08.18A, B and D).
• Do not unfairly discriminate against a consumer or customer because the person opted out of the disclosure of nonpublic personal financial information or did not grant authorization for the disclosure of nonpublic personal health information (COMAR 31.16.08.23).

Md. Code Ann., Ins. §§ 33-104, 33-105 (Title 33) · Read the law's page

• If you are a carrier (an authorized insurer, nonprofit health service plan, health maintenance organization, dental organization, managed general agent or third-party administrator), notify the Insurance Commissioner as promptly as possible and no later than 3 business days after you determine that a cybersecurity event has occurred, when Maryland is your state of domicile and the event has a reasonable likelihood of harming a consumer residing in the State or a material part of your normal operations, or when you reasonably believe the nonpublic information of 250 or more consumers residing in the State is involved and notice is owed to another government or supervisory body or the event is reasonably likely to materially harm a Maryland consumer or a material part of your normal operation (Ins. 33-105(a)).
• Give the Commissioner as much as reasonably possible of the information section 33-105(b) lists, including the date of the event, how the information was exposed, how the event was discovered, the types of information acquired, the period of compromise, the number of Maryland consumers affected, the results of any internal review, a copy of your privacy policy with the steps you will take to investigate and notify consumers, and a contact person, in electronic form as the Commissioner directs (Ins. 33-105(b)-(c)).
• Keep updating and supplementing your initial and later notifications to the Commissioner about the event (Ins. 33-105(d)).
• Comply with section 14-3504 of the Commercial Law Article as applicable and give the Commissioner a copy of the notice you send to consumers under that section (Ins. 33-105(e)).
• When you learn that a cybersecurity event has or may have occurred, conduct a prompt investigation, including where the event is in a system a third-party service provider maintains, either completing the investigation steps or confirming and documenting that the provider has (Ins. 33-104(a)-(c)).
• Keep records of all cybersecurity events for at least 5 years from the date of the event and produce them on the Commissioner's demand (Ins. 33-104(d)).
• If you are a managed care organization that investigates under your contract with the Maryland Department of Health and determines that a cybersecurity event occurred, give the Commissioner copies of all notices and reports you provide to that Department at the same time and in the same manner (Ins. 33-105(f)).

Md. Code Ann., Ins. section 33-103 (Maryland Insurance Data Security Act, Title 33) · Read the law's page

• This binds a carrier, which means an authorized insurer, nonprofit health service plan, health maintenance organization, dental organization, managed general agent or third-party administrator, and not a purchasing group or risk retention group chartered and licensed in another state or an assuming insurer domiciled in another state; declare is_insurer if your organization is one. A carrier subject to and compliant with the HIPAA privacy, security and breach notification rules, and holding nonpublic information the way it holds protected health information, is deemed to comply with this section.
• Develop, implement, and maintain a comprehensive written information security program based on your risk assessment, with administrative, technical, and physical safeguards for nonpublic information and your information system, commensurate with your size and complexity, your activities and the sensitivity of the information (33-103(a)).
• Designate who is responsible for the program, identify and assess reasonably foreseeable threats, assess the sufficiency of your safeguards, and at least annually assess the effectiveness of your key controls, systems and procedures (33-103(c)).
• Based on your risk assessment, determine which of the listed security measures are appropriate and implement them, including access controls, encryption of nonpublic information in transit over an external network and on portable devices, secure development practices, regular testing and monitoring, audit trails, and secure disposal (33-103(d)).
• Include cybersecurity risks in your enterprise risk management process, stay informed about emerging threats and vulnerabilities, and train your personnel on cybersecurity awareness (33-103(e) and (f)).
• If you have a board of directors, have it or an appropriate committee require management to develop, implement and maintain the program and to report to it in writing at least annually (33-103(g)).
• Require each third-party service provider to implement appropriate administrative, technical, and physical measures to protect the systems and nonpublic information it can access or holds, with an implementation date of October 1, 2024 for this item (33-103(h)).
• Establish a written incident response plan that addresses the areas the section lists (33-103(i)).
• On or before April 15 each year, submit to the Commissioner a written statement certifying your compliance with section 33-103 and keep the supporting records for five years, unless you are a carrier not domiciled in Maryland that meets the exemption conditions in subsection (k) (33-103(j) and (k)).

Md. Code Ann., Ins. § 27-909.1 · Read the law's page

• If you are an insurance carrier that offers, issues or delivers a life insurance or disability insurance policy or contract in Maryland, do not unfairly discriminate against an individual by conditioning insurance rates, the provision or renewal of coverage, or other conditions of insurance on medical information, including genetic test results, for which there is no relationship between the information and the cost of the insurance risk you would assume (Ins. 27-909.1(c)(1)).
• Do not access sensitive medical information, including an individual's genetic data, without first obtaining the individual's signed, written consent (Ins. 27-909.1(c)(3)(i)).
• Do not mandate existing or new genetic testing or full genome sequencing as a prerequisite for life insurance or disability insurance eligibility or coverage, and do not accept a waiver of this prohibition from the applicant or policy holder (Ins. 27-909.1(c)(3)(ii) and (c)(4)).

Md. Code Ann., Ins. §15-10B-05.1 · Read the law's page

• Base any determination an AI, algorithm, or other software tool makes in utilization review on the enrollee's own medical or clinical history, individual clinical circumstances, or other relevant clinical information in the enrollee's record, never solely on a group dataset.when it serves a financial business
• Keep a health care provider in the determination process; the tool may not replace that role.when it serves a financial business
• Ensure the tool is fairly and equitably applied and does not result in unfair discrimination or directly or indirectly cause harm to an enrollee.when it serves a financial business
• Make the tool available for audit or compliance review by the Insurance Commissioner, and review its performance, use, and outcomes at least quarterly.when it serves a financial business
• The tool may not itself deny, delay, or modify health care services.when it serves a financial business
• This applies to carriers, and to pharmacy benefits managers or private review agents that conduct utilization review on a carrier's behalf.

Md. Code Ann., Ins. § 27-909 · Read the law's page

• If you are an insurer, nonprofit health service plan or health maintenance organization, do not use a genetic test, the results of a genetic test, genetic information or a request for genetic services to reject, deny, limit, cancel, refuse to renew, increase the rates of, affect the terms or conditions of, or otherwise affect a health insurance policy or contract (Ins. 27-909(c)(1)).
• Do not request or require a genetic test, the results of a genetic test or genetic information for the purpose of determining whether to issue or renew health benefits coverage (Ins. 27-909(c)(2)).
• Do not release identifiable genetic information or the results of a genetic test to anyone other than your employees or a participating health care provider who provides medical services to your insureds or enrollees without the prior written authorization of the individual from whom it was obtained (Ins. 27-909(c)(3)).
• Obtain an authorization for each disclosure that describes who makes it, to whom it is made and the information disclosed, and disclose to an employee or health care provider only to provide medical care to patients or to conduct research approved by an institutional review board (Ins. 27-909(d)-(e)).

Md. Code Ann., Ins. § 4-403 · Read the law's page

• If you are an insurer, or an insurance service organization whose functions include the collection of medical data, do not disclose the contents of an insured's medical or claims records except to the insured, the insured's agent or representative or, on the insured's request, a physician of the insured's choice, with the insured's authorization, or in one of the cases listed in Ins. 4-403(c) (Ins. 4-403(a)-(c)).
• Before you disclose an insured's medical information to the insured's treating providers under Ins. 4-403(c)(12), give the insured a notice that specifies the information to be shared, with whom it will be shared and the uses and disclosures you may make, and an opportunity to opt out of the sharing (Ins. 4-403(c)(12)(iii)-(iv)).
• Disclose through an infrastructure for the exchange of protected health information among entities not under common ownership only in compliance with Health-Gen. 4-302.2 and 4-302.3 (Ins. 4-403(c)(12)(v)).