Law / United States / 
Montana
Insurance information act: computer security breach notice
In force since .
A breach notification rule binding private bodies.
- Obligation class
- Breach notice, Reporting
As of .
What it requires
- If you are a licensee or insurance-support organization that conducts business in Montana and owns or licenses computerized data that includes personal information, notify any individual whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person, without unreasonable delay, consistent with law-enforcement needs and the measures necessary to determine the scope of the breach and restore the system.
- If you maintain computerized data that includes personal information disclosed to you to perform an insurance function, notify the licensee or insurance-support organization immediately following discovery of a breach of the system in which the data is maintained.
- When you must notify individuals, simultaneously submit to the commissioner an electronic copy of the notification and a statement of the date and method of distribution.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Section 33-19-405 makes a person who violates chapter 19 subject to the civil penalty in section 33-1-317, a fine not to exceed $25,000 imposed by the commissioner after a hearing, except that the fine on insurance producers or adjusters may not exceed $5,000 per violation.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 25,000
Who enforces it
Enforcement body
The commissioner of insurance, who has the power to examine and investigate the affairs of every insurance institution or insurance producer doing business in Montana.
What this law does
A licensee or insurance-support organization that conducts business in Montana and owns or licenses computerized data that includes personal information must notify any individual whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person.
A person to whom personal information is disclosed in order to perform an insurance function and who maintains computerized data that includes it must notify the licensee or insurance-support organization immediately following discovery of a breach of the system. A licensee or insurance-support organization that must issue a notification must simultaneously submit an electronic copy of the notification and a statement of its date and method of distribution to the commissioner.
A licensee that is a Health Insurance Portability and Accountability Act (HIPAA) covered entity exempt under section 33-19-105(1) shall comply with section 33-19-321. A person who violates chapter 19 is subject to the civil penalty provided in section 33-1-317. Section 33-1-317 lets the commissioner, after a hearing, impose a fine not to exceed $25,000 on a person found to have violated a provision of the insurance code, except that the fine on insurance producers or adjusters may not exceed $5,000 per violation.
Section 33-19-321 took effect on . The history note of section 33-19-321 records that it was enacted by section 9 of chapter 518, Laws of 2005, and amended by section 4 of chapter 180, Laws of 2007 and section 4 of chapter 62, Laws of 2015.
When LexLint raises it
When your app profile says your app is an insurer.