Law / United States / 
Maryland
Insurance Data Security Act: investigation of a cybersecurity event and notice to the Insurance Commissioner
Md. Code Ann., Ins. §§ 33-104, 33-105 (Title 33)
In force since .
A breach notification rule binding private bodies.
- Obligation class
- Breach notice, Reporting, Governance
As of .
What it requires
- If you are a carrier (an authorized insurer, nonprofit health service plan, health maintenance organization, dental organization, managed general agent or third-party administrator), notify the Insurance Commissioner as promptly as possible and no later than 3 business days after you determine that a cybersecurity event has occurred, when Maryland is your state of domicile and the event has a reasonable likelihood of harming a consumer residing in the State or a material part of your normal operations, or when you reasonably believe the nonpublic information of 250 or more consumers residing in the State is involved and notice is owed to another government or supervisory body or the event is reasonably likely to materially harm a Maryland consumer or a material part of your normal operation (Ins. 33-105(a)).
- Give the Commissioner as much as reasonably possible of the information section 33-105(b) lists, including the date of the event, how the information was exposed, how the event was discovered, the types of information acquired, the period of compromise, the number of Maryland consumers affected, the results of any internal review, a copy of your privacy policy with the steps you will take to investigate and notify consumers, and a contact person, in electronic form as the Commissioner directs (Ins. 33-105(b)-(c)).
- Keep updating and supplementing your initial and later notifications to the Commissioner about the event (Ins. 33-105(d)).
- Comply with section 14-3504 of the Commercial Law Article as applicable and give the Commissioner a copy of the notice you send to consumers under that section (Ins. 33-105(e)).
- When you learn that a cybersecurity event has or may have occurred, conduct a prompt investigation, including where the event is in a system a third-party service provider maintains, either completing the investigation steps or confirming and documenting that the provider has (Ins. 33-104(a)-(c)).
- Keep records of all cybersecurity events for at least 5 years from the date of the event and produce them on the Commissioner's demand (Ins. 33-104(d)).
- If you are a managed care organization that investigates under your contract with the Maryland Department of Health and determines that a cybersecurity event occurred, give the Commissioner copies of all notices and reports you provide to that Department at the same time and in the same manner (Ins. 33-105(f)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 33-108 subjects a carrier that violates a provision of Title 33 to a penalty of not less than $100 but not more than $125,000 for each violation, in addition to any other sanction to which the carrier may be subject.
- Rule
- Per violation only
- As of
- Minimum
- 100
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 125,000
Who enforces it
Enforcement body
Maryland Insurance Commissioner, to whom the carrier gives notice and who may adopt regulations consistent with Title 33 of the Insurance Article.
Settledness
- As of
- Open questions
- When does a carrier 'determine' that a cybersecurity event has occurred, so that the 3-business-day period in section 33-105(a) starts, given that section 33-104(a) separately requires a prompt investigation once a carrier learns an event has or may have occurred?
What this law does
Title 33 of the Insurance Article sets standards for data security and for the investigation of and notification to the Commissioner of a cybersecurity event applicable to carriers. A carrier is an authorized insurer, nonprofit health service plan, health maintenance organization, dental organization, managed general agent or third-party administrator. A carrier that learns a cybersecurity event has or may have occurred must conduct a prompt investigation.
A carrier must keep records of all cybersecurity events for at least 5 years from the date of the event and produce them on the Commissioner's demand. A carrier must notify the Commissioner as promptly as possible and no later than 3 business days after a determination that a cybersecurity event has occurred when either of the criteria in section 33-105(a) has been met.
The first criterion is that Maryland is the carrier's state of domicile and the event has a reasonable likelihood of harming a consumer residing in the State or a material part of the carrier's normal operations, and the second is that the carrier reasonably believes the nonpublic information of 250 or more consumers residing in the State is involved and notice is owed to another government or supervisory body or the event is reasonably likely to cause material harm.
A carrier must comply with section 14-3504 of the Commercial Law Article, as applicable, and provide the Commissioner a copy of the notice sent to consumers under that section.
A carrier that is subject to, governed by and compliant with the federal health privacy, security and breach notification rules, and that maintains nonpublic information in the same manner as protected health information, is deemed in compliance with sections 33-103 and 33-104 but must still comply with section 33-105(a) through (d).
A carrier that violates a provision of Title 33 is subject to a penalty of not less than $100 and not more than $125,000 for each violation, in addition to any other sanction to which it may be subject. Title 33 may not be construed to create or imply a private cause of action for violation of its provisions. The Act that enacted Title 33 took effect on .
When LexLint raises it
When your app profile says your app is an insurer.