Law / United States / 
Minnesota
Minnesota Insurance Data Security Act, information security program and investigation of a cybersecurity event
Minn. Stat. sections 60A.985, 60A.9851, 60A.9852 (Minnesota Insurance Data Security Act)
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a licensee of the Minnesota Department of Commerce or Department of Health under the insurance chapters; declare is_insurer if your organization is one. A licensee with fewer than 25 employees is exempt, and a licensee subject to and in compliance with Health Insurance Portability and Accountability Act (HIPAA) is treated as compliant if it files a written statement certifying that compliance.
- Develop, implement, and maintain a comprehensive written information security program based on your risk assessment, with administrative, technical, and physical safeguards for nonpublic information and your information system, sized to your operations, your use of third-party service providers and the sensitivity of the information (60A.9851, subd. 1 to 4).
- Designate who is responsible for the program, assess reasonably foreseeable threats and the sufficiency of your safeguards, and test the effectiveness of key controls at least annually (60A.9851, subd. 3).
- Have your board or an appropriate committee require management to develop, implement and maintain the program and to report to it in writing at least annually on the program's status and material matters (60A.9851, subd. 5).
- Require each third-party service provider to implement appropriate administrative, technical, and physical measures to protect the systems and nonpublic information it can access or holds (60A.9851, subd. 6).
- Establish a written incident response plan that covers the areas the subdivision lists (60A.9851, subd. 8).
- If you are an insurer domiciled in Minnesota, certify your compliance in writing to the commissioner by April 15 of each year and keep the supporting records for five years (60A.9851, subd. 9).
- When you learn that a cybersecurity event has or may have occurred, investigate it promptly, and keep records of every cybersecurity event for at least five years, producing them on the commissioner's demand (60A.9852).
These lines are LexLint's reading of the law's text, as of .
What this law does
Each licensee must develop, implement, and maintain a comprehensive written information security program based on its risk assessment, with administrative, technical, and physical safeguards for nonpublic information and its information system.
A licensee is a person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered, by the Department of Commerce or the Department of Health under chapters 59A to 62M, 62Q to 62V, and 64B to 79A. Each licensee must establish a written incident response plan designed to promptly respond to and recover from a cybersecurity event that compromises nonpublic information, its information systems, or the continuing functionality of its business or operations.
A licensee must require a third-party service provider to implement appropriate administrative, technical, and physical measures to protect the information systems and nonpublic information that the provider can access or holds. By April 15 of each year, an insurer domiciled in Minnesota must certify in writing to the commissioner that it complies with section 60A.9851. If a licensee learns that a cybersecurity event has or may have occurred, it must conduct a prompt investigation.
A licensee must maintain records concerning all cybersecurity events for at least five years from the date of the event and produce them on the commissioner's demand. A licensee with fewer than 25 employees is exempt from sections 60A.9851 and 60A.9852. A licensee subject to and in compliance with Health Insurance Portability and Accountability Act (HIPAA) is considered to comply with sections 60A.9851 and 60A.9852 if it submits a written statement certifying its compliance with HIPAA.
Licensees had one year from to implement section 60A.9851, subdivisions 1 to 5 and 7 to 9, and two years to implement subdivision 6. A violation of sections 60A.985 to 60A.9856 may be penalized in accordance with section 60A.052.
When LexLint raises it
When your app profile says your app is an insurer.