Is an insurer, in Oklahoma

Genetic Nondiscrimination in Insurance Act, Okla. Stat. tit. 36, Sec. 3614.1 · Read the law's page

• If you offer an individual or group accident and health insurance policy, do not deny or condition the issuance or effectiveness of the policy or certificate, including by imposing a preexisting condition exclusion, on the basis of genetic information with respect to any individual (section 3614.1(C)(1) of Title 36).
• Do not discriminate in the pricing of the policy or certificate, including by adjusting premium rates, on the basis of genetic information with respect to any individual (section 3614.1(C)(2) of Title 36).
• Do not request or require an individual or a family member of an individual to undergo a genetic test, except for a request, never a requirement, that meets every condition in subsection H (section 3614.1(E) and (H) of Title 36).
• Do not request, require or purchase genetic information for underwriting purposes, or about any individual before the individual's enrollment under the policy in connection with the enrollment (section 3614.1(I) and (J) of Title 36).
• Request only the minimum amount of information necessary when you obtain and use the results of a genetic test in making a payment determination (section 3614.1(F) and (G) of Title 36).

Disclosure of Nonpublic Personal Information, Okla. Stat. tit. 36, Sec. 307.2 · Read the law's page

• Do not disclose any nonpublic personal information contrary to Title V of Public Law No. 106-102 (section 307.2(A) of Title 36).

Insurance Data Security Act, notice to the Insurance Commissioner, Okla. Stat. tit. 36, Sec. 675 · Read the law's page

• If you are a licensee under Title 36, notify the Insurance Commissioner without unreasonable delay, but not later than three business days, from a determination that a cybersecurity event involving nonpublic information in your possession has occurred, when either criterion in section 675(A) is met (section 675(A) of Title 36).
• Provide as much of the information listed in section 675(B) as possible, electronically in the manner and form the Commissioner prescribes, along with any applicable fees (section 675(B) of Title 36).
• Update and supplement your notifications to the Commissioner about material changes to previously provided information relating to the cybersecurity event (section 675(B) of Title 36).
• If you are an assuming insurer, notify your affected ceding insurers and the Commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred, or of receiving notice from your third-party service provider that one has occurred (section 675(E) of Title 36).
• If a cybersecurity event occurs in a system maintained by a third-party service provider and you are aware of it, notify the Commissioner as you would for any other event unless the provider has given the Commissioner and you the required notice, counting your deadlines from the day after the provider notifies you or you otherwise have actual knowledge of the event, whichever is sooner (section 675(D) of Title 36).
• If you are an insurer and a cybersecurity event in your possession or your third-party service provider's possession affects a consumer who accessed your services through an independent insurance producer, and consumer notice is required, notify the producers of record of all affected consumers no later than the time you notify the affected consumers (section 675(F) of Title 36).

Okla. Stat. tit. 36, Sec. 674 · Read the law's page

• If you are a licensee (a person licensed, authorized to operate or registered, or required to be, under Title 36 of the Oklahoma Statutes, other than a purchasing group or a risk retention group chartered in another state or an assuming insurer domiciled elsewhere) and learn that a cybersecurity event has or may have occurred, conduct, or have an outside vendor or service provider designated to act for you conduct, a prompt investigation (Okla. Stat. tit. 36, Sec. 674(A)).
• Where the event occurs in a system a third-party service provider maintains, complete the investigation steps or confirm and document that the provider has completed them (Okla. Stat. tit. 36, Sec. 674(C)).
• Maintain records concerning all cybersecurity events for at least five years from the date of each event, and produce those records upon the Insurance Commissioner's request (Okla. Stat. tit. 36, Sec. 674(D)).

Insurance Data Security Act, Okla. Stat. tit. 36, Sec. 673 · Read the law's page

• Applies to a licensee under Oklahoma insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate or registered, or required to be, under Title 36 of the Oklahoma Statutes, other than a purchasing group, a risk retention group chartered and licensed in another state, or an assuming insurer domiciled in another state.
• Develop, implement and maintain a comprehensive written information security program, based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information systems, commensurate with your size and complexity, your activities (including your use of third-party service providers) and the sensitivity of the nonpublic information.
• Designate the person responsible for the program, identify and assess the reasonably foreseeable internal and external threats to nonpublic information, and implement information safeguards to manage them, assessing the effectiveness of the key controls, systems and procedures at least annually.
• If you have a board of directors, have the board or an appropriate committee require executive management (or its delegates) to develop, implement and maintain the program and to report to the board in writing at least annually on its overall status, your compliance and material matters such as risk assessment, third-party service provider arrangements, test results and cybersecurity events; management that delegates oversees the delegate's work. The report has gone to the board, not the Insurance Commissioner, since November 1, 2025.
• Determine and implement the security measures that are appropriate, which include access controls, encryption (or other appropriate protection) of nonpublic information in transit over an external network and on a laptop or other portable device or media, secure development practices for applications you develop in house, effective controls on access to nonpublic information (which may include multi-factor authentication for any authorized individual), regular testing and monitoring of systems, audit trails, and secure disposal of nonpublic information.
• Include cybersecurity risks in your enterprise risk management process, stay informed about emerging threats and vulnerabilities, and give your personnel cybersecurity awareness training that is updated to reflect the risks your risk assessment identifies.
• Establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information, your information systems or the continuing functionality of your business.
• When you learn that a cybersecurity event has or may have occurred, including in a system a third-party service provider maintains, investigate promptly: determine whether it occurred, assess its nature and scope, identify the nonpublic information involved and take reasonable measures to restore the security of the compromised systems, or confirm and document that the provider has done so. Keep records of every cybersecurity event for at least five years from the event and produce them to the Insurance Commissioner on request; this has applied since July 1, 2024.
• Exercise due diligence in selecting a third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect and secure the information systems and nonpublic information it holds; this duty has applied since July 1, 2026.
• If you are an insurer domiciled in Oklahoma, submit to the Insurance Commissioner by April 15 each year a written statement certifying that you comply with section 673, and keep the supporting records for five years.
• A licensee with less than five million dollars in gross annual revenue is exempt from the act; an employee, agent, representative or designee of a licensee who is also a licensee is exempt to the extent the licensee's information security program covers them; and a licensee that meets the HIPAA or Gramm-Leach-Bliley conditions in section 678 is treated as meeting section 673. A licensee that ceases to qualify for an exception has 180 days to comply.