Law / United States / 
Maryland
Maryland Insurance Data Security Act, carrier information security program
Md. Code Ann., Ins. section 33-103 (Maryland Insurance Data Security Act, Title 33)
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a carrier, which means an authorized insurer, nonprofit health service plan, health maintenance organization, dental organization, managed general agent or third-party administrator, and not a purchasing group or risk retention group chartered and licensed in another state or an assuming insurer domiciled in another state; declare is_insurer if your organization is one. A carrier subject to and compliant with the Health Insurance Portability and Accountability Act (HIPAA) privacy, security and breach notification rules, and holding nonpublic information the way it holds protected health information, is deemed to comply with this section.
- Develop, implement, and maintain a comprehensive written information security program based on your risk assessment, with administrative, technical, and physical safeguards for nonpublic information and your information system, commensurate with your size and complexity, your activities and the sensitivity of the information (33-103(a)).
- Designate who is responsible for the program, identify and assess reasonably foreseeable threats, assess the sufficiency of your safeguards, and at least annually assess the effectiveness of your key controls, systems and procedures (33-103(c)).
- Based on your risk assessment, determine which of the listed security measures are appropriate and implement them, including access controls, encryption of nonpublic information in transit over an external network and on portable devices, secure development practices, regular testing and monitoring, audit trails, and secure disposal (33-103(d)).
- Include cybersecurity risks in your enterprise risk management process, stay informed about emerging threats and vulnerabilities, and train your personnel on cybersecurity awareness (33-103(e) and (f)).
- If you have a board of directors, have it or an appropriate committee require management to develop, implement and maintain the program and to report to it in writing at least annually (33-103(g)).
- Require each third-party service provider to implement appropriate administrative, technical, and physical measures to protect the systems and nonpublic information it can access or holds, with an implementation date of for this item (33-103(h)).
- Establish a written incident response plan that addresses the areas the section lists (33-103(i)).
- On or before April 15 each year, submit to the Commissioner a written statement certifying your compliance with section 33-103 and keep the supporting records for five years, unless you are a carrier not domiciled in Maryland that meets the exemption conditions in subsection (k) (33-103(j) and (k)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 33-108 subjects a carrier that violates a provision of Title 33 to a penalty of not less than $100 but not more than $125,000 for each violation, in addition to any other sanction to which the carrier may be subject.
- Rule
- Per violation only
- As of
- Minimum
- 100
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 125,000
Who enforces it
Enforcement body
Maryland Insurance Commissioner, to whom the carrier submits its annual certification and who may adopt regulations consistent with Title 33 of the Insurance Article.
What this law does
Each carrier must develop, implement, and maintain a comprehensive written information security program based on the carrier's risk assessment. A carrier is an authorized insurer, a nonprofit health service plan, a health maintenance organization, a dental organization, a managed general agent, or a third-party administrator.
Each carrier must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in its possession, its information systems, or the continuing functionality of any aspect of its business or operations.
A carrier must require a third-party service provider to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to or held by the provider. On or before April 15 each year, each carrier must submit to the Commissioner a written statement certifying that it complies with section 33-103, except a carrier not domiciled in Maryland that meets the conditions of subsection (k).
A carrier subject to and compliant with the Health Insurance Portability and Accountability Act (HIPAA) privacy, security, and breach notification rules that maintains nonpublic information in the same manner as protected health information is deemed to comply with sections 33-103 and 33-104. A carrier subject to and in compliance with section 33-103 is deemed to be in compliance with sections 14-3502 and 14-3503 of the Commercial Law Article. A carrier had until to implement section 33-103 of the Insurance Article.
A carrier had until to implement subsection (h) of section 33-103, on third-party service providers. A carrier that violates a provision of Title 33 is subject to a penalty of not less than $100 but not more than $125,000 for each violation, in addition to any other sanction to which it may be subject.
When LexLint raises it
When your app profile says your app is an insurer.