Law / United States / 
Hawaii
Insurance Data Security Law, information security program
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This binds every licensee under Hawaii's insurance code, a licensed insurer or producer or other person licensed, authorized or registered under chapter 431 or 432 or holding a certificate of authority under chapter 432D (reached by declaring that you are an insurer); a licensee with fewer than ten employees, including independent contractors, is exempt from this part (HRS 431:3B-101, 431:3B-104(a)(1)).
- Develop, implement and maintain a comprehensive written information security program, based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information system, sized to your size and complexity, activities and the sensitivity of the information (HRS 431:3B-201).
- Designate one or more employees, an affiliate or a third-party service provider responsible for the program, identify reasonably foreseeable internal and external threats, assess their likelihood and potential damage and the sufficiency of your safeguards, and assess the effectiveness of your key controls, systems and procedures at least annually (HRS 431:3B-202(b)).
- Based on that risk assessment, determine which of the listed security measures are appropriate and implement them: access controls, encryption of nonpublic information in transit over an external network and on portable devices, secure development practices, effective controls that may include multi-factor authentication, testing and monitoring, audit trails and secure disposal, and give your personnel cybersecurity awareness training (HRS 431:3B-203).
- If you have a board of directors, have the board or an appropriate committee require executive management to develop, implement and maintain the program and report to it in writing at least annually (HRS 431:3B-204).
- Exercise due diligence in selecting each third-party service provider and, where appropriate, require it to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it can reach; you had until to implement this duty (HRS 431:3B-205, Act 112 section 6).
- Monitor, evaluate and adjust the program for changes in technology, the sensitivity of your nonpublic information, threats, and your own business arrangements (HRS 431:3B-206).
- Establish a written incident response plan that covers the internal response process, its goals, roles and decision-making authority, communications, remediation of weaknesses, documentation and reporting, and revision of the plan after a cybersecurity event (HRS 431:3B-207).
- If you are an insurer domiciled in Hawaii, submit to the commissioner by March 31 each year a written statement certifying your compliance with this part, and keep the supporting records for five years (HRS 431:3B-208).
- Implement these duties, other than the third-party service provider oversight duty, by (Act 112 section 6(1)(A)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Criminal exposureYes
Criminal exposure note
A violation of any provision of the Insurance Code is punishable by a fine of not less than $100 nor more than $10,000 per violation, or by imprisonment for not more than one year, or both (HRS 431:2-203(b)(3)).
Penalty structure
The fine is not less than $100 nor more than $10,000 per violation of any provision of the Insurance Code, or imprisonment for not more than one year, or both (HRS 431:2-203(b)(3)).
- Rule
- Per violation only
- As of
- Minimum
- 100
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
The insurance commissioner, who may take action that is necessary or appropriate to enforce the article (HRS 431:3B-102(c)).
What this law does
A licensee is every licensed insurer, producer, and any other person licensed or required to be licensed, authorized or required to be authorized, or registered or required to be registered, under chapter 431 or 432, or holding a certificate of authority under chapter 432D. Each licensee must develop, implement, and maintain a comprehensive written information security program based on its risk assessment, containing administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system.
The licensee must designate one or more employees, an affiliate, or a third-party service provider to act on its behalf and be responsible for the information security program. Based on its risk assessment, the licensee must determine which of the listed security measures are appropriate and implement them.
A licensee's board of directors, or an appropriate committee of the board, must require the licensee's executive management or its delegates to develop, implement, and maintain the information security program. A licensee must exercise due diligence in selecting its third-party service provider. Each licensee must establish a written incident response plan designed to promptly respond to and recover from any cybersecurity event.
Each insurer domiciled in the State must annually submit to the commissioner a written statement by March 31 certifying that it is in compliance with part II of the article. A licensee with fewer than ten employees, including any independent contractors, is exempt from part II of the article.
A licensee subject to the Health Insurance Portability and Accountability Act of 1996 that maintains an information security program under that Act is considered to have met part II, if it is compliant and submits a written statement certifying its compliance. Licensees other than risk retention groups chartered and licensed in the State had one year from the effective date of the Act to implement sections 201, 202, 203, 204, 206, 207 and 208 of the new article.
Licensees other than risk retention groups chartered and licensed in the State had two years from the effective date of the Act to implement section 205 of the new article. The Act that added the Insurance Data Security Law took effect on . The Governor approved the Act that added the Insurance Data Security Law on . A licensee that violates the article may be penalized in accordance with section 431:2-203 of the Insurance Code.
A violation of a provision of the Insurance Code is punishable by a fine of not less than $100 nor more than $10,000 per violation, or by imprisonment for not more than one year, or both.
When LexLint raises it
When your app profile says your app is an insurer.