Is an insurer, in Missouri

Mo. Rev. Stat. Secs. 375.1300, 375.1303, 375.1306, 375.1309 · Read the law's page

• Do not require or request an individual's or their blood relative's genetic information or a genetic test, or consider genetic information or a genetic test result without the individual's approval, when making a health-plan eligibility, premium, coverage, or renewal decision.when it serves a financial business
• Do not use an employee's or job applicant's genetic information or genetic test results to discriminate against them or restrict a right or benefit otherwise due them, unless a statutory exception applies.
• Hold any genetic information you create, store, receive, or furnish in the ordinary course of business, a profession, or a service as a confidential medical record, and do not disclose it without the individual's written authorization.

Insurance Data Security Act, Mo. Rev. Stat. sec. 375.1410 · Read the law's page

• This binds a licensee, a person licensed, authorized to operate, or registered, or required to be, under Missouri's insurance laws (reached by declaring that you are an insurer, reinsurer or insurance producer). A licensee with fewer than ten employees is exempt from section 375.1405 only, a producer with fewer than fifty employees, less than $5,000,000 in gross annual revenue, or less than $10,000,000 in year-end total assets is exempt from the Act, and a licensee governed by the HIPAA privacy, security, and breach notification rules is deemed to comply with the Act except for the director notification requirements in subsections 1 and 2 of section 375.1410 (section 375.1417).
• Notify the director as promptly as practicable, and in no event later than four business days, from a determination that a cybersecurity event involving nonpublic information in your possession has occurred, when Missouri is your state of domicile (insurer) or home state (producer) and the event has a reasonable likelihood of materially harming a consumer residing in Missouri or a material part of your normal operations, or when you reasonably believe the information involved is of 250 or more Missouri consumers and notice must be given to a government body, self-regulatory agency, or other supervisory body under state or federal law, or the event has a reasonable likelihood of that harm.
• Provide as much of the listed information as practicable, in electronic form as directed by the director, covering the date and discovery of the event, how the information was exposed, the types of information involved, the period of compromise, the number of Missouri consumers affected, the results of your internal review, your remediation efforts, a copy of your privacy policy, and a contact person; continually update and supplement your notices.
• Comply with section 407.1500 as applicable, and give the director a copy of the notice sent to consumers when you are required to notify the director.
• Treat a cybersecurity event in a system maintained by a third-party service provider as one in your own system; your deadlines run from the day after the provider notifies you or you otherwise have actual knowledge, whichever is sooner.
• As an assuming insurer, notify your affected ceding insurers and the commissioner or director of insurance of your state of domicile within three business days of determining that a cybersecurity event has occurred.
• As an insurer whose consumers accessed your services through an independent insurance producer, and where consumer notice is required by law, notify the producers of record of all affected consumers no later than the time notice is given to those consumers.

Insurance Data Security Act, Mo. Rev. Stat. secs. 375.1405, 375.1407 and 375.1417 · Read the law's page

• This binds a licensee, a person licensed, authorized to operate, or registered, or required to be, under Missouri's insurance laws (reached by declaring that you are an insurer, reinsurer or insurance producer). A licensee has until January 1, 2027 to implement section 375.1405, and until January 1, 2028 to implement the third-party service provider duty in its subsection 6 (section 375.1427). A licensee with fewer than ten employees is exempt from section 375.1405, a producer with fewer than fifty employees, less than $5,000,000 in gross annual revenue, or less than $10,000,000 in year-end total assets is exempt from the Act, and a licensee affiliated with a depository institution that maintains a program under the Gramm-Leach-Bliley Act interagency guidelines is considered to meet section 375.1405 if it can document that on request (section 375.1417).
• Develop, implement, and maintain a comprehensive written information security program, based on your risk assessment, with administrative, technical, and physical safeguards for nonpublic information and your information system (section 375.1405.1).
• Conduct a risk assessment: designate who is responsible for the program, identify reasonably foreseeable internal and external threats including those at third-party service providers, assess their likelihood and potential damage and the sufficiency of your safeguards, and assess the effectiveness of key controls, systems, and procedures at least annually (section 375.1405.3).
• Determine which of the listed security measures are appropriate and implement them, including access controls, encryption of nonpublic information sent over an external network or stored on portable devices, secure development practices, effective controls that may include multifactor authentication, regular testing and monitoring, audit trails, and secure disposal; include cybersecurity risks in enterprise risk management and provide cybersecurity awareness training (section 375.1405.4).
• Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical, and physical measures to protect the information systems and nonpublic information it can reach (section 375.1405.6).
• Establish a written incident response plan that addresses the internal response process, goals, roles and decision-making authority, communications, remediation of weaknesses, documentation and reporting, and revision after an event (section 375.1405.8).
• If you are an insurer domiciled in Missouri, submit a written statement to the director certifying compliance by April 15 each year and keep the supporting records for five years (section 375.1405.9).
• When you learn that a cybersecurity event has or may have occurred, promptly investigate it, determine its nature and scope and the nonpublic information involved, restore the security of the compromised systems, and keep records of all cybersecurity events for at least three years and produce them on the director's demand (section 375.1407).