Law / United States / 
Maine
Maine Insurance Data Security Act, notice of a cybersecurity event to the superintendent
Maine Insurance Data Security Act notification of a cybersecurity event, 24-A M.R.S. § 2266
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Reporting
As of .
What it requires
- Applies to a licensee under Maine insurance law, which you declare by stating that you are an insurer: a person licensed, authorized to operate or registered, or required to be licensed, authorized or registered, under the insurance laws of Maine, other than a purchasing group or a risk retention group chartered and licensed in another state or a licensee acting as an assuming insurer domiciled in another state or jurisdiction.
- Notify the superintendent as promptly as possible and in no event later than 3 business days from a determination that a cybersecurity event has occurred, if Maine is your state of domicile as an insurance carrier or your home state as an insurance producer.
- Also notify the superintendent within 3 business days of that determination if you reasonably believe the nonpublic information involved concerns 250 or more consumers residing in Maine and the event requires notice to a government body, self-regulatory organization or other supervisory body under state or federal law, or has a reasonable likelihood of materially harming a consumer residing in Maine or a material part of your normal operation.
- Provide as much as possible of the information section 2266, subsection 2 lists, in electronic form as the superintendent directs, and update and supplement the notice for the continuing life of the event.
- Comply with Title 10, chapter 210-B for consumer notice and, when you must notify the superintendent, give the superintendent a copy of the notice sent to consumers.
- For an event in a system maintained by a third-party service provider or an ancillary service provider, count your notice deadlines from the day after the provider notifies you or the day after you otherwise have actual knowledge, whichever is sooner.
- If you are an assuming insurer, notify your affected ceding insurers and the superintendent of your state of domicile within 3 business days of determining that a cybersecurity event involving nonpublic information you use or hold has occurred, or of receiving notice from your third-party service provider that one has occurred.
- If you are an insurance carrier, notify the producers of record of all affected consumers no later than the time consumers must be notified or as the superintendent directs, unless you do not have the current producer of record information for a consumer.
- A licensee that complies with Health Insurance Portability and Accountability Act (HIPAA) is not excused from the notice to the superintendent.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Superintendent of Insurance, who may examine and investigate the affairs of any licensee and take action necessary or appropriate to enforce the chapter (24-A M.R.S. § 2267).
What this law does
A licensee must notify the superintendent as promptly as possible but in no event later than 3 business days from a determination that a cybersecurity event has occurred if Maine is the licensee's state of domicile, in the case of an insurance carrier, or its home state, in the case of an insurance producer.
A licensee must also notify the superintendent within that period if it reasonably believes that the nonpublic information involved concerns 250 or more consumers residing in Maine and the event requires notice to a government body, self-regulatory organization or other supervisory body, or has a reasonable likelihood of materially harming a Maine consumer or any material part of the licensee's normal operation.
A licensee must provide in electronic form as directed by the superintendent as much as possible of the information that subsection 2 lists regarding a cybersecurity event. The licensee has a continuing obligation to update and supplement its initial and subsequent notifications to the superintendent concerning the cybersecurity event.
A licensee must comply with Title 10, chapter 210-B and, when required to notify the superintendent, must provide the superintendent a copy of the notice sent to consumers. An assuming insurer must notify its affected ceding insurers and the superintendent of its state of domicile within 3 business days of making the determination that a cybersecurity event has occurred.
An insurance carrier must notify the producers of record of all affected consumers who accessed its services through an independent insurance producer no later than the time consumers must be notified or as directed by the superintendent, except where it lacks the current producer of record information for a consumer. The chapter takes effect .
When LexLint raises it
When your app profile says your app is an insurer.