Law / United States / 
Maine
Maine Insurance Data Security Act, licensee information security program
Maine Insurance Data Security Act information security program, 24-A M.R.S. § 2264
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security
As of .
What it requires
- Applies to a licensee under Maine insurance law, which you declare by stating that you are an insurer: a person licensed, authorized to operate or registered, or required to be licensed, authorized or registered, under the insurance laws of Maine, other than a purchasing group or a risk retention group chartered and licensed in another state or a licensee acting as an assuming insurer domiciled in another state or jurisdiction.
- Develop, implement and maintain a comprehensive, written information security program based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information systems, in proportion to your size and complexity, the nature and scope of your activities, including your use of third-party service providers, and the sensitivity of the nonpublic information.
- Designate one or more employees, an affiliate or another person to be responsible for the program, identify reasonably foreseeable internal and external threats, including threats to information held by third-party service providers, and at least annually assess the effectiveness of your key controls, information systems and procedures.
- Consider the security measures section 2264 lists, including access controls, encryption of nonpublic information in transit over an external network and on laptops and portable media, secure development practices, multifactor authentication where effective, regular testing and monitoring, audit trails and secure disposal, and implement those you consider appropriate.
- Include cybersecurity risks in your enterprise risk management process, stay informed of emerging threats and vulnerabilities, and give your personnel cybersecurity awareness training that is updated to reflect the risks in your risk assessment.
- Establish a written incident response plan designed to promptly respond to and recover from any cybersecurity event that compromises nonpublic information, your information systems or the continuing functionality of your business.
- If you learn that a cybersecurity event has or may have occurred, conduct a prompt investigation or have a designated outside vendor or service provider conduct it, and keep records of the event for at least 5 years and produce them on the superintendent's demand.
- Exercise due diligence in selecting each third-party service provider and require it to implement appropriate administrative, technical and physical safeguards for the information systems and nonpublic information it can access or holds.
- No later than , require each third-party service provider to notify you when it becomes aware of a cybersecurity event affecting nonpublic information obtained from you, in its own system or an ancillary service provider's system, that has a reasonable likelihood of materially harming any consumer or any material part of your normal operations.
- If you are an insurance carrier domiciled in Maine, submit to the superintendent by April 15 each year a written statement certifying compliance with section 2264, and keep the supporting records for 5 years.
- A licensee with fewer than 10 employees, including independent contractors working for it in the business of insurance, is exempt from section 2264.
- A licensee that is subject to and in compliance with Health Insurance Portability and Accountability Act (HIPAA) and its related privacy, security and breach notification rules is considered to meet the chapter, other than the notice to the superintendent in section 2266, only if it keeps a program that treats all nonpublic information relating to Maine consumers as protected health information, certifies compliance to the superintendent each year, and the superintendent has not found the federal rules materially less stringent.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Superintendent of Insurance, who may examine and investigate the affairs of any licensee and take action necessary or appropriate to enforce the chapter (24-A M.R.S. § 2267).
What this law does
A licensee must develop, implement and maintain a comprehensive, written information security program based on the licensee's risk assessment and containing administrative, technical and physical safeguards for the protection of nonpublic information and the licensee's information systems.
A licensee is a person licensed, authorized to operate or registered or required to be licensed, authorized or registered pursuant to the insurance laws of Maine, other than a purchasing group or a risk retention group chartered and licensed in another state or a licensee acting as an assuming insurer domiciled in another state or jurisdiction.
A licensee must establish a written incident response plan designed to promptly respond to and recover from any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information in its possession, its information systems or the continuing functionality of any aspect of its business or operations.
An insurance carrier domiciled in Maine must submit to the superintendent by April 15 each year a written statement certifying that it is in compliance with the requirements of section 2264. A licensee that learns that a cybersecurity event has or may have occurred must conduct a prompt investigation, or have a designated outside vendor or service provider conduct it. A licensee must maintain records concerning a cybersecurity event for a period of at least 5 years from the date of the event.
A licensee with fewer than 10 employees, including any independent contractors working for the licensee in the business of insurance, is exempt from section 2264. A licensee that is subject to and in compliance with Health Insurance Portability and Accountability Act (HIPAA) is considered to meet the requirements of the chapter, other than the requirements for notification to the superintendent, if it meets three conditions that section 2269 lists.
The superintendent may take any enforcement action permitted under section 12-A against any person that violates any provision of the chapter. The chapter takes effect , and a licensee must comply with section 2264 no later than that day, except that it must comply with subsection 6 of that section no later than .
When LexLint raises it
When your app profile says your app is an insurer.