Law / United States / 
Oregon
Insurance licensee safeguards for customer information, information security program rules
OAR 836-081-0101 to 836-081-0126
In force since .
A sector security regimes rule binding private bodies.
- Obligation class
- Security
As of .
What it requires
- Applies to a licensee as defined in ORS 746.600, which you declare by stating that you are an insurer; it does not include a purchasing group or an unauthorized insurer in regard to surplus lines business.
- Establish and implement an information security program, including appropriate policies and systems, to protect the security, confidentiality and integrity of customer information, which is personal information about a customer, in paper, electronic or other form, that is maintained by or on behalf of the licensee.
- Design the program to ensure the security and confidentiality of customer information, to protect against any anticipated threats or hazards to its security or integrity, and to protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer.
These lines are LexLint's reading of the law's text, as of .
What this law does
Rule 836-081-0101(3) requires each licensee to establish and implement an information security program, including appropriate policies and systems. The rules establish standards for developing and implementing administrative, technical and physical safeguards to protect the security, confidentiality and integrity of customer information, pursuant to Sections 501, 505(b), and 507 of the Gramm-Leach-Bliley Act.
The safeguards apply to nonpublic personal information, including financial information and health information.
Rule 836-081-0116 requires a licensee's information security program to be designed to ensure the security and confidentiality of customer information, to protect against any anticipated threats or hazards to the security or integrity of the information, and to protect against unauthorized access to or use of the information that could result in substantial harm or inconvenience to any customer.
Customer information means personal information as defined in ORS 746.600 about a customer, whether in paper, electronic or other form, that is maintained by or on behalf of the licensee. A licensee is a licensee as defined in ORS 746.600, except that the term does not include a purchasing group or an unauthorized insurer in regard to surplus lines business conducted pursuant to ORS 735.400 to 735.495.
The rules are adopted by the Director of the Department of Consumer and Business Services under the authority of ORS 731.244 to implement ORS 746.240 and ORS 746.670, and do not name ORS 646A.622 as a statute they implement. ORS 646A.622(2)(b) treats a covered entity or vendor as complying with the safeguards duty in ORS 646A.622(1) if it complies with regulations promulgated under Title V of the Gramm-Leach-Bliley Act, where its personal information is also subject to that Act.
ORS 646A.622(2)(a) likewise treats a covered entity or vendor as complying if it complies with a state or federal law that provides greater protection to personal information than the section provides. Rule 836-081-0116 took effect on .
When LexLint raises it
When your app profile says your app is an insurer.