Law / United States / 
Hawaii
Insurance Data Security Law, cybersecurity event investigation and notice to the commissioner
Insurance Cybersecurity Event Notice, Haw. Rev. Stat. Secs. 431:3B-301 to 431:3B-306
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds every licensee under Hawaii's insurance code, a licensed insurer or producer or other person licensed, authorized or registered under chapter 431 or 432 or holding a certificate of authority under chapter 432D (reached by declaring that you are an insurer); the small-licensee exemption in section 431:3B-104(a)(1) lifts only part II, not these duties (HRS 431:3B-101, 431:3B-104).
- When you learn that a cybersecurity event has or may have occurred, investigate it promptly yourself or through a third-party service provider you designate: determine whether an event occurred, its nature and scope and the nonpublic information involved, and restore the security of the compromised information systems (HRS 431:3B-301(a) and (b)).
- Keep records of all cybersecurity events for at least five years from the date of each event and produce them on the commissioner's demand (HRS 431:3B-301(d)).
- Notify the commissioner as promptly as possible, and in no event later than three business days after you determine that a cybersecurity event impacting 250 or more consumers has occurred, when you are an insurer domiciled in Hawaii or an independent insurance producer whose home state is Hawaii (HRS 431:3B-302(a)(1)).
- Give the same notice when you reasonably believe the nonpublic information involved is of 250 or more consumers residing in Hawaii and the event has a reasonable likelihood of materially harming a consumer residing in Hawaii or a material part of your normal operation (HRS 431:3B-302(a)(2)).
- If law enforcement officials instruct you not to distribute information about the event, you need not notify the commissioner until they instruct you to (HRS 431:3B-302(a)).
- Give the commissioner as much as is possible and practicable of the information section 431:3B-302(b) lists (the date of the event, how the information was exposed, the number of Hawaii consumers affected, the results of your internal review and your remediation efforts) in electronic form as the commissioner directs, and update and supplement the notice as previously provided information materially changes (HRS 431:3B-302(b) to (d)).
- Comply with chapter 487N as applicable and give the commissioner a copy of the notice you send to consumers under it when you are required to notify the commissioner; this notice does not supersede any reporting requirement in chapter 487N (HRS 431:3B-302(e), 431:3B-303).
- Treat a cybersecurity event at a third-party service provider as your own event unless the provider gives the notice, with your deadlines running from the day after the provider notifies you or you otherwise have actual knowledge of the event, whichever is sooner (HRS 431:3B-304).
- If you are an assuming insurer, notify your affected ceding insurers and the commissioner of your state of domicile within three business days after you determine that a cybersecurity event has occurred (HRS 431:3B-305(a)).
- If you are an insurer and a consumer accessed your services through an independent insurance producer, notify the producers of record of all affected consumers as soon as practicable as the commissioner directs (HRS 431:3B-306(a)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
A violation of any provision of the Insurance Code is punishable by a fine of not less than $100 nor more than $10,000 per violation, or by imprisonment for not more than one year, or both (HRS 431:2-203(b)(3)).
Penalty structure
The fine is not less than $100 nor more than $10,000 per violation of any provision of the Insurance Code, or imprisonment for not more than one year, or both (HRS 431:2-203(b)(3)).
- Rule
- Per violation only
- As of
- Minimum
- 100
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
The insurance commissioner, who may take action that is necessary or appropriate to enforce the article (HRS 431:3B-102(c)).
What this law does
A licensee is every licensed insurer, producer, and any other person licensed or required to be licensed, authorized or required to be authorized, or registered or required to be registered, under chapter 431 or 432, or holding a certificate of authority under chapter 432D. If the licensee learns that a cybersecurity event has or may have occurred, the licensee or the third-party service provider designated to act on its behalf must conduct a prompt investigation.
The licensee must maintain records concerning all cybersecurity events for at least five years from the date of the cybersecurity event and produce those records upon demand of the commissioner. Each licensee must notify the commissioner as promptly as possible, but in no event later than three business days from a determination that a cybersecurity event impacting two hundred fifty or more consumers has occurred.
If law enforcement officials instruct a licensee not to distribute information regarding a cybersecurity event, the licensee is not required to provide notification until instructed to do so by law enforcement officials. Notification is required when the licensee is domiciled in the State, in the case of an insurer, or the licensee's home state is Hawaii, in the case of an independent insurance producer.
Notification is also required when the licensee reasonably believes that the nonpublic information involved is of two hundred fifty or more consumers residing in the State and is a cybersecurity event that has a reasonable likelihood of materially harming any consumer residing in the State or any material part of the normal operation of the licensee.
The section on notification of a cybersecurity event does not supersede any reporting requirements in chapter 487N. An assuming insurer must notify its affected ceding insurers and the commissioner of its state of domicile within three business days of making the determination that a cybersecurity event has occurred. An insurer must notify the producers of record of all affected consumers as soon as practicable as directed by the commissioner.
The Act that added the Insurance Data Security Law took effect on . The Governor approved the Act that added the Insurance Data Security Law on . A licensee that violates the article may be penalized in accordance with section 431:2-203 of the Insurance Code. A violation of a provision of the Insurance Code is punishable by a fine of not less than $100 nor more than $10,000 per violation, or by imprisonment for not more than one year, or both.
When LexLint raises it
When your app profile says your app is an insurer.