Is an insurer, in Mississippi

Medicare Supplement Insurance Minimum Standards regulation, 19 Miss. Admin. Code Pt. 3, R. 10.24 · Read the law's page

• If you issue a Medicare supplement policy or certificate in Mississippi, or act for or on behalf of an issuer as a third-party administrator or other person, do not deny or condition the issuance or effectiveness of the policy or certificate, including by imposing an exclusion of benefits based on a pre-existing condition, on the basis of an individual's genetic information (Rule 10.24(A)(1) and (J)(1)).
• Do not discriminate in the pricing of the policy or certificate, including the adjustment of premium rates, on the basis of an individual's genetic information (Rule 10.24(A)(2)).
• Do not request or require an individual or a family member of the individual to undergo a genetic test (Rule 10.24(C)).
• Do not request, require or purchase genetic information for underwriting purposes, or with respect to an individual before the individual's enrollment under the policy in connection with that enrollment (Rule 10.24(G) and (H)).
• If you ask an individual or a family member to undergo a genetic test for research, make the request pursuant to research that complies with Part 46 of Title 45 of the Code of Federal Regulations or equivalent Federal regulations, never require the test, tell each individual that compliance is voluntary and that non-compliance has no effect on enrollment status or premium or contribution amounts, do not use the information collected for underwriting, eligibility, premium rates or the issuance, renewal or replacement of a policy or certificate, notify the Secretary of Health and Human Services in writing of the activities, and meet any other conditions the Secretary requires by regulation (Rule 10.24(F)).

Insurance Data Security Law, sections 4 and 9, Senate Bill 2831 (2019) · Read the law's page

• Applies to a licensee under Mississippi insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate or registered, or required to be, under the insurance laws of Mississippi, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state.
• Notwithstanding any other provision of law, the Act is the exclusive state standard applicable to licensees for data security, the investigation of a cybersecurity event and notification to the Commissioner of Insurance.
• Develop, implement and maintain a comprehensive written information security program based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information system, sized to your size and complexity, the nature and scope of your activities, your use of third-party service providers and the sensitivity of the information.
• Design the program to define and periodically reevaluate a schedule for retention of nonpublic information and a mechanism for its destruction when no longer needed.
• Designate one or more employees, an affiliate or an outside vendor to be responsible for the program, identify reasonably foreseeable internal and external threats, and no less than annually assess the effectiveness of the safeguards' key controls, systems and procedures.
• Determine which of the listed security measures are appropriate for your risk assessment and implement them, including access controls, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices, multi-factor authentication where appropriate, testing and monitoring, audit trails, and secure disposal; include cybersecurity risks in your enterprise risk management and train your personnel.
• Establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information, your information systems or the continuing functionality of your business.
• Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it can access; licensees have two years from July 1, 2019 to implement this requirement and one year to implement the rest of the program section.
• If you have a board of directors, the board or an appropriate committee must require executive management to develop, implement and maintain the program and to report in writing at least annually on its status, your compliance and material matters.
• If you are an insurer domiciled in Mississippi, submit to the Commissioner of Insurance by February 15 each year a written statement certifying compliance with the program section, and keep the supporting records for five years.
• If you are an insurer, document any areas, systems or processes you have identified as requiring material improvement, updating or redesign, with the remedial efforts planned and underway, and make the documentation available for the Commissioner's inspection.
• You are exempt from the program section if you have fewer than 50 employees, less than $5,000,000 in gross annual revenue or less than $10,000,000 in year-end total assets, or if you are an insurance producer or adjuster, and an employee, agent, representative or designee of a licensee who is also a licensee is exempt to the extent the other licensee's program covers it; a licensee that maintains a HIPAA information security program and certifies compliance in writing, or is affiliated with a depository institution that meets the Interagency Guidelines, is considered to meet the program section.
• If you cease to qualify for an exception, you have 180 days to comply with the Act.

Insurance Data Security Law, sections 5 and 6, Senate Bill 2831 (2019) · Read the law's page

• Applies to a licensee under Mississippi insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate or registered, or required to be, under the insurance laws of Mississippi, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state.
• A cybersecurity event does not include the unauthorized acquisition of encrypted nonpublic information if the encryption, process or key is not also acquired, released or used without authorization, or an event after which you determine that the nonpublic information accessed by an unauthorized person has not been used or released and has been returned or destroyed.
• Notify the Commissioner of Insurance as promptly as possible, and no later than three business days after you determine that a cybersecurity event involving nonpublic information in your possession has occurred, when Mississippi is your state of domicile (insurer) or home state (producer) and the event has a reasonable likelihood of materially harming a consumer residing in Mississippi or any material part of your normal operations.
• Notify the Commissioner within the same three business days when you reasonably believe the nonpublic information involved is of 250 or more consumers residing in Mississippi and the event requires notice to a government body, self-regulatory agency or other supervisory body under state or federal law, or has a reasonable likelihood of materially harming a consumer or a material part of your normal operations.
• Give the Commissioner as much as possible of the 13 listed items of information, in electronic form as directed, and keep updating and supplementing the notification as material changes occur.
• Conduct a prompt investigation when you learn that a cybersecurity event has or may have occurred, determining as much as possible of whether an event occurred, its nature and scope and the nonpublic information involved, and performing or overseeing reasonable measures to restore the security of the compromised information systems; keep records of every cybersecurity event for at least five years and produce them on the Commissioner's demand.
• Give the Commissioner a copy of the notice sent to consumers under the state's breach notification statute when you must notify the Commissioner.
• Treat a cybersecurity event in a system maintained by a third-party service provider as you would one in your own system, unless the provider gives the Commissioner the notice, and complete the investigation steps yourself or confirm and document that the provider has completed them; the clock starts the day after the provider notifies you or you otherwise have actual knowledge.
• You are exempt from the third-party service provider investigation and notification provisions if you have fewer than 50 employees, less than $5,000,000 in gross annual revenue or less than $10,000,000 in year-end total assets, or if you are an insurance producer or adjuster.
• As an assuming insurer that has no direct contractual relationship with the affected consumers, notify your affected ceding insurers and the Commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred, or of receiving notice of one from your third-party service provider; you then have no other notice obligations relating to the event or data breach under this section or any other law of this state.
• As an insurer whose consumer accessed your services through an independent insurance producer, notify the producers of record of all affected consumers no later than the time consumer notice is given, when consumer notice is required.

Miss. Code Ann. §§ 83-5-801 to 83-5-825, SB 2831 §§ 4, 5 · Read the law's page

• If you are a licensee under the Mississippi insurance laws, maintain records concerning all cybersecurity events for at least five years from the date of each event (section 5(4)).
• Produce those cybersecurity event records upon the Commissioner of Insurance's demand (section 5(4)).
• If you are an insurer domiciled in Mississippi, maintain for examination by the department all records, schedules and data supporting your annual certificate for five years (section 4(9)).