Law / United States / 
Utah
Insurance licensee standards for safeguarding customer information
In force.
A sector security regimes rule binding private bodies.
- Obligation class
- Security
As of .
What it requires
- Applies to a licensee of the department, as the rule defines the term, that obtains nonpublic personal financial or health information from a customer, which you declare by stating that you are an insurer; it does not reach a purchasing group, an exempted warranty or service contract provider, or an unauthorized insurer for excess line business.
- Implement a comprehensive written information security program including administrative, technical, and physical safeguards to protect customer information, appropriate to the size and complexity of the licensee and the nature and scope of its activities.
- Design the program to ensure the security and confidentiality of customer information, to protect against any anticipated threat or hazard to its security or integrity, and to protect against unauthorized access to or use of it that could result in substantial harm or inconvenience to any customer.
These lines are LexLint's reading of the law's text, as of .
What this law does
Rule R590-216-4 requires a licensee to implement a comprehensive written information security program including administrative, technical, and physical safeguards to protect customer information. The safeguards must be appropriate to the size and complexity of the licensee and the nature and scope of its activities.
Rule R590-216-5 requires the program to ensure the security and confidentiality of customer information, to protect against any anticipated threat or hazard to the security or integrity of the information, and to protect against unauthorized access to or use of the information that could result in substantial harm or inconvenience to any customer.
The rule applies to a licensee of the department that obtains any nonpublic information from a customer, including nonpublic personal financial information or nonpublic personal health information. A licensee does not include a purchasing group, a manufacturer or seller warranty provider or manufacturer or seller service contract provider exempted by Section R590-206-2, or an unauthorized insurer regarding the excess line business conducted pursuant to Section 31A-15-103.
The methods of development and implementation in Section R590-216-6 are examples, and a licensee may adopt other actions or procedures to implement the program. The rule's purpose is to establish standards to assist a licensee in developing and implementing administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information under the Gramm-Leach-Bliley Act. The rule page gives as the date of the rule's last change. No day on which the rule first took effect has been located, so no effective date is recorded.
When LexLint raises it
When your app profile says your app is an insurer.