Law / United States / 
Kentucky
Insurance Data Security Law, written information security program
Insurance Data Security Law information security program, KRS 304.3-756
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security
As of .
What it requires
- Applies to a licensee under Kentucky insurance law, which you declare by stating that you are an insurer: any person who is, or is required to be, licensed, authorized to operate, or registered under the insurance laws of Kentucky, other than a purchasing group or a risk retention group chartered and licensed in another state, or a licensee acting as an assuming insurer domiciled in another state or jurisdiction.
- Develop, implement, and maintain a comprehensive written information security program based on your risk assessment, with administrative, technical, and physical safeguards for nonpublic information and your information system, in proportion to your size and complexity, the nature and scope of your activities, and the sensitivity of the nonpublic information.
- Designate one or more employees, an affiliate, or an outside vendor as responsible for the program, identify and assess reasonably foreseeable internal and external threats, including threats to nonpublic information held by third-party service providers, and at least annually assess the effectiveness of the key controls, systems, and procedures of your safeguards.
- Implement the security measures that are appropriate, including access controls, restricted physical access, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices for in-house applications and testing of externally developed ones, multi-factor authentication where effective, regular testing and monitoring, audit trails, and secure disposal of nonpublic information in any format.
- Include cybersecurity risks in your enterprise risk management process, stay informed regarding emerging threats or vulnerabilities, and give personnel cybersecurity awareness training that is updated to reflect the risks identified in your risk assessment.
- Establish a written incident response plan to promptly respond to and recover from a cybersecurity event, covering its goals, the internal response process, roles and decision-making authority, communications, remediation of weaknesses, documentation and reporting, and revision after an event.
- If you use a third-party service provider, exercise due diligence in selecting it and require it to implement appropriate administrative, technical, and physical measures to protect the information systems and nonpublic information it holds or can access.
- Have your executive management develop, implement, and maintain the program and, if you have a board of directors or other appropriate committee, report to it in writing at least annually on the status of the program, your compliance, and material matters.
- If you are an insurer domiciled in Kentucky, submit to the commissioner by February 15 each year a written statement certifying that you comply with this section, and keep the supporting records for five years.
- A licensee with fewer than fifty employees, including independent contractors, is exempt from KRS 304.3-750 to 304.3-768, and a licensee that meets the compliance conditions of KRS 304.3-766 for the federal health privacy rules or the Gramm-Leach-Bliley Act standards is deemed in compliance if it submits the annual written statement KRS 304.3-766 describes.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Commissioner of Insurance, who may examine and investigate the affairs of any licensee and take action necessary or appropriate to enforce KRS 304.3-756, 304.3-758, and 304.3-760 (KRS 304.3-762).
What this law does
Each licensee must develop, implement, and maintain a comprehensive written information security program based on its risk assessment that contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system.
A licensee is any person who is, or is required to be, licensed, authorized to operate, or registered under the insurance laws of Kentucky, other than a purchasing group or a risk retention group chartered and licensed in another state, or a licensee acting as an assuming insurer domiciled in another state or jurisdiction.
A licensee must implement, as appropriate, protection by encryption or other appropriate means of all nonpublic information while being transmitted over an external network and stored on a laptop computer or other portable computing or storage device or media. A licensee must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event.
A licensee that uses a third-party service provider must exercise due diligence in selecting it and require it to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the provider. Each insurer domiciled in Kentucky must submit to the commissioner by February 15 of each year a written statement certifying that the insurer is in compliance with the section.
A licensee is deemed in compliance if it is subject to, governed by, and compliant with the federal health privacy, security, and breach notification rules, maintains nonpublic information in the same manner as protected health information, and submits to the commissioner an annual written statement certifying its compliance.
A licensee that is a financial institution subject to, governed by, and compliant with the privacy, security, and breach notification standards issued under the Gramm-Leach-Bliley Act is also deemed in compliance if it submits an annual written statement certifying its compliance and a copy of any breach notification at the same time and in the same manner as notifications provided to its federal regulatory authorities.
The commissioner may examine and investigate the affairs of any licensee and take action that is necessary or appropriate to enforce the relevant provisions. The section took effect on .
When LexLint raises it
When your app profile says your app is an insurer.