Law / United States / 
New Hampshire
Insurance Data Security Law, licensee information security program
Insurance Data Security Law information security program, RSA 420-P:4
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security
As of .
What it requires
- Applies to a licensee under New Hampshire insurance law, which you declare by stating that you are an insurer: any person licensed, authorized to operate or registered, or required to be licensed, authorized or registered, under the insurance laws of New Hampshire, other than a purchasing group or a risk retention group chartered and licensed in another state or a person acting as an assuming insurer domiciled in another state or jurisdiction.
- Develop, implement and maintain a comprehensive written information security program based on your risk assessment, with administrative, technical and physical safeguards for nonpublic information and your information system, in proportion to your size and complexity, the nature and scope of your activities, including your use of third-party service providers, and the sensitivity of the nonpublic information.
- Designate one or more employees, an affiliate or an outside vendor as responsible for the program, identify reasonably foreseeable internal and external threats, including threats to information held by third-party service providers, and at least annually assess the effectiveness of your safeguards' key controls, systems and procedures.
- Determine which of the security measures RSA 420-P:4, IV lists are appropriate and implement them, including access controls, encryption of nonpublic information in transit over an external network and on laptops and portable media, multi-factor authentication where effective, regular testing and monitoring, audit trails and secure disposal.
- Include cybersecurity risks in your enterprise risk management process, stay informed of emerging threats or vulnerabilities, and give your personnel cybersecurity awareness training that is updated to reflect the risks in your risk assessment.
- Establish a written incident response plan designed to promptly respond to and recover from any cybersecurity event that compromises nonpublic information, your information systems or the continuing functionality of your business.
- If you learn that a cybersecurity event has or may have occurred, conduct a prompt investigation or have a designated outside vendor or service provider conduct it, and keep records of all cybersecurity events for at least 5 years and produce them on the commissioner's demand.
- Exercise due diligence in selecting each third-party service provider and require it to implement appropriate administrative, technical and physical measures to protect the information systems and nonpublic information it can access or holds.
- If you are an insurer domiciled in New Hampshire, submit to the commissioner by March 1 each year a written statement certifying compliance with RSA 420-P:4, and keep the supporting records for 5 years.
- A licensee with fewer than 20 employees, including independent contractors, a continuing care retirement community, a life settlement provider, and a bank or credit union that meets the Gramm-Leach-Bliley safeguards, are exempt from RSA 420-P:4.
- A licensee that complies with Health Insurance Portability and Accountability Act (HIPAA) is considered to meet the chapter with respect to protected health information, and one that complies with 23 NYCRR Part 500 and certifies that in writing to the commissioner is considered to meet the chapter, but each remains bound by the commissioner notification duties of RSA 420-P:6, I and II, and the second also by RSA 420-P:5 and RSA 420-P:6, III.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The insurance commissioner, who may examine and investigate the affairs of any licensee and take action necessary or appropriate to enforce the chapter (RSA 420-P:7).
What this law does
Each licensee must develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment and that contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system.
A licensee is any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered, pursuant to the insurance laws of New Hampshire, other than a purchasing group or a risk retention group chartered and licensed in another state or a person acting as an assuming insurer domiciled in another state or jurisdiction.
Each licensee must establish, as part of its program, a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event. Each insurer domiciled in New Hampshire must submit to the commissioner by March 1 each year a written statement certifying that the insurer is in compliance with the requirements of RSA 420-P:4.
A licensee that learns that a cybersecurity event has or may have occurred must conduct a prompt investigation, or have a designated outside vendor or service provider conduct it. A licensee with fewer than 20 employees, including any independent contractors, is exempt from RSA 420-P:4. A licensee that complies with the Health Insurance Portability and Accountability Act (HIPAA) safe harbor must continue to comply with the commissioner notification requirements of RSA 420-P:6, I and II.
A licensee that is in compliance with 23 NYCRR Part 500 is considered to meet the requirements of the chapter if it submits a written statement to the commissioner certifying that compliance, but it remains subject to the investigation requirements of RSA 420-P:5 and the notification requirements of RSA 420-P:6, I, II and III. A licensee that violates the chapter may be penalized in accordance with RSA 400-A:15, III. The chapter took effect on .
When LexLint raises it
When your app profile says your app is an insurer.