Law / United States / 
Ohio
Ohio Insurance Data Security Law, cybersecurity event investigation and notice to the superintendent
Insurer Cybersecurity Event Notice, Ohio Rev. Code ss. 3965.03 and 3965.04
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Reporting
As of .
What it requires
- This binds every licensee under Ohio's insurance laws, an insurer, agent or other person licensed, authorized or registered under them (reached by declaring that you are an insurer); the small-licensee exemption in section 3965.07(A) lifts only section 3965.02, and a licensee in compliance with the Health Insurance Portability and Accountability Act (HIPAA) privacy and security rules still gives the section 3965.04 notice (sections 3965.01(M) and 3965.07).
- When you learn that a cybersecurity event has or may have occurred, investigate it promptly yourself or through a vendor you designate: determine whether an event occurred, assess its nature and scope, identify the nonpublic information involved, and restore the security of the compromised information systems (section 3965.03(A) and (B)).
- Keep records of all cybersecurity events for at least five years from the date of each event and produce them on the superintendent's demand (section 3965.03(D)).
- Notify the superintendent of insurance as promptly as possible, and no later than three business days after you determine that a cybersecurity event involving nonpublic information in your possession has occurred, when Ohio is your state of domicile (insurer) or home state (independent insurance agent) and the event has a reasonable likelihood of materially harming a consumer or a material part of your normal operations (section 3965.04(A)(1)).
- Give the same notice within the same three business days when you reasonably believe the nonpublic information involved relates to 250 or more Ohio consumers and the event is one you must report to a government body under other law or has a reasonable likelihood of materially harming an Ohio consumer or a material part of your normal operations (section 3965.04(A)(2)).
- In the notice give as much as possible of the information section 3965.04(B)(1) lists, including the date of the event, how the information was exposed, the number of Ohio consumers affected, the results of your internal review and your remediation efforts, give it electronically as the superintendent directs, and update it as material developments occur (section 3965.04(B)).
- Give the superintendent a copy of the notice you send to consumers under section 1349.19 of the Revised Code (section 3965.04(C)).
- Treat a cybersecurity event at a third-party service provider as your own event, with your deadlines running from the day after the provider notifies you or you otherwise have actual knowledge of it, whichever is sooner (section 3965.04(D)).
- If you are an assuming insurer, notify your affected ceding insurers and the insurance commissioner of your state of domicile within three business days of determining that a cybersecurity event has occurred (section 3965.04(E)(1)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The superintendent of insurance, who may examine and investigate any licensee and take any necessary or appropriate action to enforce the chapter.
What this law does
Section 3965.04 of the Revised Code requires a licensee to notify the superintendent of insurance as promptly as possible, and in no event later than three business days, after a determination that a cybersecurity event involving nonpublic information in its possession has occurred, when either of two sets of criteria is met.
The first set of criteria is that Ohio is the licensee's state of domicile, in the case of an insurer, or its home state, in the case of an independent insurance agent, and that the event has a reasonable likelihood of materially harming a consumer or a material part of the licensee's normal operations.
The second set of criteria is that the licensee reasonably believes the nonpublic information involved relates to two hundred fifty or more consumers residing in Ohio and that the event is one of two further kinds. A licensee that learns a cybersecurity event has or may have occurred must conduct a prompt investigation itself or through a designated outside vendor or service provider.
A licensee must maintain records concerning all cybersecurity events for a period of at least five years from the date of the event and produce them upon demand of the superintendent of insurance. A licensee that must notify the superintendent must also give the superintendent a copy of the notice it sent to consumers under section 1349.19 of the Revised Code.
A licensee subject to and in compliance with the Health Insurance Portability and Accountability Act (HIPAA) privacy and security rules is deemed to meet the chapter except for its notification requirements under section 3965.04. The Revised Code shows section 3965.04 as effective , with Senate Bill 273 of the 132nd General Assembly as its latest legislation.
When LexLint raises it
When your app profile says your app is an insurer.