SB 385 — Enacts provisions relating to insurance companies' data security

Summary

Enacts provisions relating to insurance companies' data security

Bill Text

Compared against the Missouri Revised Statutes as published AI-generated reading aid — verify against the official bill.

This bill amends 13 section(s) of the Missouri Revised Statutes: Section 375.1400, RSMo; Section 375.1402, RSMo; Section 375.1405, RSMo; Section 375.1407, RSMo; Section 375.1410, RSMo; Section 375.1412, RSMo.

• Section 375.1400, RSMo

  known and may be cited as the "Insurance Data Security Act". Notwithstanding any other provision of law to the contrary, sections 375.1400 to 375.1427 establish the exclusive state standards applicable to licensees for data security, the investigation of a cybersecurity event as defined in section 375.1402, and notification to the director. Sections 375.1400 to 375.1427 shall not be construed to create or imply a private cause of action for violation of their provisions, nor shall such sections be construed to curtail a private cause of action that would otherwise exist in the absence of sections 375.1400 to 375.1427.

  amended

• Section 375.1402, RSMo

  the following terms mean: (1"Authorized person", an individual known to and authorized by the licensee and determined to be necessary and appropriate to have access to the nonpublic information held by the licensee and its information systems; (2"Consumer", an individual including, but not limited to, an applicant, policyholder, insured, beneficiary, claimant, or certificate holder, who is a resident of this state and whose nonpublic information is in a licensee's possession, custody, or control; (3"Cybersecurity event", an event resulting in unauthorized access to, malicious disruption of, or misuse of an information system or nonpublic information in the possession, custody, or control of a licensee or an authorized person; however: (aThe term "cybersecurity event" does not include the unauthorized acquisition of encrypted, nonpublic information if the encryption, process, or key is not also acquired, released, or used without authorization; and (bThe term "cybersecurity event" does not include an event with regard to which the licensee has determined that the nonpublic information accessed by an unauthorized person has not been used or released and has been returned or destroyed; (4"Department", the department of commerce and insurance; (5"Director", the director of the department of commerce and insurance; (6"Encrypted", the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key; (7"HIPAA", the federal Health Insurance Portability and Accountability Act (42 U.S.C. Section 1320d, et seq.); (8"Information security program", the administrative, technical, and physical safeguards that a licensee uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle nonpublic information; (9"Information system", a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of electronic nonpublic information, as well as any specialized system such as industrial and process controls systems, telephone switching and private branch exchange systems, and environmental control systems; (10"Licensee", any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered under the insurance laws of this state, but shall not include a purchasing group or a risk retention group chartered and licensed in a state other than this state or a licensee that is acting as an assuming insurer that is domiciled in another state or jurisdiction; (11"Multi-factor authentication", authentication through verification of at least two of the following types of authentication factors: (aKnowledge factors, such as a password; (bPossession factors, such as a token or text message on a mobile phone; or (cInherence factors, such as a biometric characteristic; (12"Nonpublic information", information that is not publicly available information and is: (aBusiness-related information of a licensee, the tampering with which, or unauthorized disclosure, access, or use of which, would cause a material adverse impact to the business, operations, or security of the licensee; (bAny information concerning a consumer that, because of name, number, personal mark, or other identifier, can be used to identify such consumer, in combination with any one or more of the following data elements: Social Security number; Driver's license number or nondriver identification card number; Financial account number or credit or debit card number; Any security code, access code, or password that would permit access to a consumer's financial account; Biometric records; or Military identification number; (cAny information or data, except age or gender, in any form or medium created by or derived from a health care provider or a consumer and that relates to: The past, present, or future physical, mental, or behavioral health or condition of an

  amended

• Section 375.1405, RSMo

  complexity of the licensee; the nature and scope of the licensee's activities, including its use of third-party service providers; and the sensitivity of the nonpublic information used by the licensee or in the licensee's possession, custody, or control, each licensee shall develop, implement, and maintain a comprehensive written information security program that is based on the licensee's risk assessment and that contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system. A licensee's information security program shall be designed to: (1Protect the security and confidentiality of nonpublic information and the security of the information system; (2Protect against any threats or hazards to the security or integrity of nonpublic information and the information system; (3Protect against unauthorized access to or use of nonpublic information and minimize the likelihood of harm to any consumer; and (4Define and periodically reevaluate a schedule for retention of nonpublic information and a mechanism for its destruction when no longer needed. The licensee shall: (1Designate one or more employees, an affiliate, or an outside vendor designated to act on behalf of the licensee who is responsible for the information security program; (2Identify reasonably foreseeable internal or external threats that could result in unauthorized access, transmission, disclosure, misuse, alteration, or destruction of nonpublic information, including the security of information systems and nonpublic information that are accessible to, or held by, third-party service providers; (3Assess the likelihood and potential damage of these threats, taking into consideration the sensitivity of the nonpublic information; (4Assess the sufficiency of policies, procedures, information systems, and other safeguards in place to manage these threats, including consideration of threats in each relevant area of the licensee's operations, including: (aEmployee training and management; (bInformation systems, including network and software design, as well as information classification, governance, processing, storage, transmission, and disposal; and (cDetecting, preventing, and responding to attacks, intrusions, or other systems failures; and (5Implement information safeguards to manage the threats identified in its ongoing assessment, and no less than annually, assess the effectiveness of the safeguards' key controls, systems, and procedures. Based on its risk assessment, the licensee shall: (1Design its information security program to mitigate the identified risks, commensurate with the size and complexity of the licensee's activities, including its use of third-party service providers, and the sensitivity of the nonpublic information used by the licensee or in the licensee's possession, custody, or control; (2Determine which of the following security measures are appropriate and implement such security measures: (aPlace access controls on information systems, including controls to authenticate and permit access only to authorized persons to protect against the unauthorized acquisition of nonpublic information; (bIdentify and manage the data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes in accordance with their relative importance to business objectives and the organization's risk strategy; (cRestrict access at physical locations containing nonpublic information only to authorized persons; (dProtect by encryption or other appropriate means all nonpublic information while being transmitted over an external network and all nonpublic information stored on a laptop computer or other portable computing or storage device or media; (eAdopt secure development practices for in-house developed applications utilized by the licensee and procedures for evaluating, assessing, or testing the security of externally developed applications utilized by the

  amended

• Section 375.1407, RSMo

  cybersecurity event has or may have occurred, the licensee, or an outside vendor or service provider designated to act on behalf of the licensee, shall conduct a prompt investigation. During the investigation, the licensee, or an outside vendor or service provider designated to act on behalf of the licensee, shall, at a minimum, determine as much of the following information as possible: (1Determine whether a cybersecurity event has occurred; (2Assess the nature and scope of the cybersecurity event; (3Identify any nonpublic information that may have been involved in the cybersecurity event; and (4Perform or oversee reasonable measures to restore the security of the information systems compromised in the cybersecurity event in order to prevent further unauthorized acquisition, release, or use of nonpublic information in the licensee's possession, custody, or control. If the licensee learns that a cybersecurity event has or may have occurred in a system maintained by a third- party service provider, the licensee shall complete the steps listed in subsection 2 of this section or confirm and document that the third-party service provider has completed those steps. The licensee shall maintain records concerning all cybersecurity events for a period of at least three years from the date of the cybersecurity event and shall produce those records upon demand of the director.

  amended

• Section 375.1410, RSMo

  as promptly as practicable, but in no event later than three business days, from a determination that a cybersecurity event involving nonpublic information that is in the possession of a licensee has occurred when either of the following criteria has been met: (1This state is the licensee's state of domicile, in the case of an insurer, or this state is the licensee's home state, in the case of a producer, as those terms are defined in section 375.012, and the cybersecurity event has a reasonable likelihood of materially harming a consumer residing in this state or a reasonable likelihood of materially harming any material part of the normal operations of the licensee; or (2The licensee reasonably believes that the nonpublic information involved is of one thousand or more consumers residing in this state and is either of the following: (aA cybersecurity event impacting the licensee of which notice is required to be provided to any government body, self-regulatory agency, or any other supervisory body under any state or federal law; or (bA cybersecurity event that has a reasonable likelihood of materially harming: Any consumer residing in this state; or Any material part of the normal operations of the licensee. The licensee shall provide as much of the following information as possible. The licensee shall provide the information in electronic form as directed by the director. The licensee shall have a continuing obligation to update and supplement initial and subsequent notifications to the director regarding material changes to previously provided information relating to the cybersecurity event: (1The date of the cybersecurity event; (2A description of how the information was exposed, lost, stolen, or breached, including the specific roles and responsibilities of third-party service providers, if any; (3How the cybersecurity event was discovered; (4Whether any exposed, lost, stolen, or breached information has been recovered and if so, how this was done; (5The identity of the source of the cybersecurity event; (6Whether the licensee has filed a police report or has notified any regulatory, government, or law enforcement agencies and, if so, when such notification was provided; (7A description of the specific types of information acquired without authorization. "Specific types of information" means particular data elements including, for example, types of medical information, types of financial information, or types of information allowing identification of the consumer; (8The period during which the information system was compromised by the cybersecurity event; (9The number of total consumers in this state affected by the cybersecurity event. The licensee shall provide the best estimate in the initial report to the director and update this estimate with each subsequent report to the director under this section; (10The results of any internal review identifying a lapse in either automated controls or internal procedures, or confirming that all automated controls or internal procedures were followed; (11A description of the efforts being undertaken to remediate the situation that permitted the cybersecurity event to occur; (12A copy of the licensee's privacy policy and a statement outlining the steps the licensee will take to investigate and notify consumers affected by the cybersecurity event; and (13The name of a contact person who is both familiar with the cybersecurity event and authorized to act for the licensee. The licensee shall comply with section 407.1500, as applicable, and provide a copy of the notice sent to consumers under that section to the director when a licensee is required to notify the director under subsection 1 of this section. (1) In the case of a cybersecurity event in a system maintained by a third-party service provider of which the licensee has become aware, the licensee shall treat such event as it would under subsection 1 of this section. (2The computation of a licensee's deadlines shall begin on th

  amended

• Section 375.1412, RSMo

  and investigate into the affairs of any licensee to determine whether the licensee has been or is engaged in any

  amended

• Section 375.1427, RSMo

  power is in addition to the powers the director has under the law. Any such investigation or examination shall be conducted under section 374.190 or 374.205. Whenever the director has reason to believe that a licensee has been or is engaged in conduct in this state that violates sections 375.1400 to 375.1427, the director may take action that is necessary or appropriate to enforce the provisions of sections 375.1400 to 375.1427.

  amended

• Section 375.1415, RSMo

  information in the control or possession of the department that are furnished by a licensee or an employee or agent thereof acting on behalf of a licensee under subsection 9 of section 375.1405 or subsection 2 of section 375.1410 or that is obtained by the director in an investigation or examination under section 375.1412 shall be confidential by law and privileged, shall not be subject to disclosure under chapter 610, shall not be subject to subpoena, and shall not be subject to discovery or admissible in evidence in any private civil action. However, the director is authorized to use the documents, materials, or other information in the furtherance of any regulatory or legal action brought as a part of the director's duties. Neither the director nor any person or entity who received documents, materials, or other information while acting under the authority of the director shall be permitted or required to testify in any private civil action concerning any confidential documents, materials, or information subject to subsection 1 of this section. Consistent with the insurance data security act's goal of safeguarding consumer nonpublic information, neither the director nor any person or entity who receives documents, materials, or other information while acting under the authority of the director shall be permitted to share or otherwise release the documents, materials, or other information to a third party including, but not limited to, other state, federal, or international regulatory agencies or law enforcement agencies. In order to assist in the performance of the director's duties under sections 375.1400 to 375.1427, the director: (1May receive documents, materials, or information, including otherwise confidential and privileged documents, materials, or information, from the National Association of Insurance Commissioners, its affiliates, or subsidiaries and from regulatory and law enforcement officials of other foreign or domestic jurisdictions and shall maintain as confidential or privileged any document, material, or information received with notice or the understanding that it is confidential or privileged under the laws of the jurisdiction that is the source of the document, material, or information; and (2May enter into agreements governing sharing and use of information consistent with this subsection. No waiver of any applicable privilege or claim of confidentiality in the documents, materials, or information shall occur as a result of disclosure to the director under this section or as a result of sharing as authorized in subsection 3 of this section. Nothing in sections 375.1400 to 375.1427 shall prohibit the director from releasing final adjudicated actions that are open to public inspection under chapter 610 to a database or other clearinghouse service maintained by the National Association of Insurance Commissioners, its affiliates, or subsidiaries.

  amended

• Section 375.1417, RSMo

  sections 375.1400 to 375.1427: (1A licensee with fewer than ten employees, including any independent contractors, is exempt from the provisions of section 375.1405; (2A licensee subject to and governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services, 45 CFR 160 and 164, established under the Health Insurance Portability and Accountability Act of 1996, P.L. 104-191, and the Health Information Technology for Economic and Clinical Health Act (HITECH), P.L. 111-5, and that maintains nonpublic information in the same manner as protected health information shall be deemed to comply with the requirements of sections 375.1400 to 375.1427, except for the director notification requirements in subsections 1 and 2 of section 375.1410; (3An employee, agent, representative, or designee of a licensee, who is also a licensee, is exempt from section 375.1405 and need not develop its own information security program to the extent that the employee, agent, representative, or designee is covered by the information security program of the other licensee; (4Producers that have fewer than fifty employees, less than five million dollars in gross annual revenue, or less than ten million dollars in year-end total assets; and (5A licensee affiliated with a depository institution that maintains an information security program in compliance with the Interagency Guidelines Establishing Standards for Safeguarding Customer Information (Interagency Guidelines) as set forth under Sections 501 and 505 of the federal Gramm-Leach-Bliley Act, P.L. 106-102, shall be considered to meet the requirements of section 375.1405 and any rules, regulations, or procedures established thereunder, provided that the licensee produces, upon request, documentation satisfactory to the director that independently validates the affiliated depository institution's adoption of an information security program that satisfies the interagency guidelines. In the event that a licensee ceases to qualify for an exception, such licensee shall have one hundred eighty calendar days to comply with sections 375.1400 to 375.1427.

  amended

• Section 375.1420, RSMo

  375.1400 to 375.1427, a licensee may be subject to penalties as provided by law, including sections 374.046, 374.048, and 374.049.

  amended

• Section 375.1422, RSMo

  and insurance may promulgate rules as necessary for the

  amended

• Section 375.1427, RSMo

  or portion of a rule, as that term is defined in section 536.010, that is created under the authority delegated in this section shall become effective only if it complies with and is subject to all of the provisions of chapter 536 and,

  amended

• Section 536.028, RSMo

  536 are nonseverable and if any of the powers vested with the general assembly under chapter 536 to review, to delay the effective date, or to disapprove and annul a rule are subsequently held unconstitutional, then the grant of rulemaking authority and any rule proposed or adopted after August 28, 2025, shall be invalid and void.

  amended

• Section 375.1425, RSMo

  375.1427 or the application thereof to any person or circumstance is for any reason held to be invalid, the remainder of sections 375.1400 to 375.1427 and the application of such provision to other persons or circumstances shall not be affected thereby.

  amended

• Section 375.1427, RSMo

  to implement section 375.1405 and until January 1, 2028, to implement subsection 6 of section 375.1405.

  amended

Action History

1. March 11, 2025

   Voted Do Pass S Insurance and Banking Committee

2. March 04, 2025

   Hearing Conducted S Insurance and Banking Committee

3. February 17, 2025

   Second Read and Referred S Insurance and Banking Committee

4. January 08, 2025

   S First Read

5. December 01, 2024

   Prefiled

Sponsors

• Curtis Trent · Primary

Subjects