An Act relating to insurance; relating to insurance data security; relating to mammograms; amending Rule 26...
Do you support it?
Want to know if it passes?
We'll email you when SB 134 moves — a committee vote, a floor vote, or a signature. Nothing else.
Free forever · unsubscribe in one click.
Your answer was recorded either way.
Which district are you in?
Your ZIP is all we need to match you to your own representatives — so we can tell you how they voted on SB 134.
You're tracking SB 134
We'll email you the moment it moves.
SB 134 — An Act relating to insurance; relating to insurance data security; relating to mammograms; amending Rule 26, Alaska Rules of Civil Procedure, and Rules 402 and 501, Alaska Rules of Evidence; and providing for an effective date.
Last action — (S) EFFECTIVE DATE(S) OF LAW SEE CHAPTER
No card. One bill, free forever — alerts when it moves.
-
✓Introduced
-
✓In Committee
-
✓Passed Senate
-
✓Passed House
-
✓To Executive
-
6Enacted
This bill has been enacted into law. Introduced April 21, 2023. Enacted.
Signed by Governor Mike Dunleavy (Republican) on October 09, 2024.
Prognosis
Where this bill stands today.
Odds of enactment
HighHow often bills like it became law.
-
Enacted
Current position in the legislative process.
-
6 sponsors
1 primary, 5 co-sponsors signed on.
-
Bipartisan support
Sponsored across 2 parties (4 D · 2 R) — cross-party backing.
-
Mixed recorded votes
7 passed, 3 failed in recorded votes so far.
Prognosis reads this bill's own signals — stage, sponsorship breadth, committee status, recorded votes and cross-state momentum. Odds come from a model trained on which bills have become law.
Bill Text
What changed in the latest version
574 added · 520 removedPlain-language change summary
The revised version of SB 134 introduces a new section specifically focused on insurance data security, which establishes a uniform state standard for data security among insurance companies in Alaska. This change is significant because it clarifies how cybersecurity incidents should be investigated and reported and importantly, it ensures that individuals cannot sue for damages under these new data security rules. Overall, this amendment aims to strengthen protections for consumers while also providing a clear framework for the insurance industry to follow in safeguarding sensitive information.
33-LS0253\BLAWS SENATEOF BILLALASKA NO.Source Chapter No.
134HCS INCSSB THE134(JUD) LEGISLATURE_______ OFAN THEACT STATERelating OFto ALASKAinsurance; THIRTY-THIRD LEGISLATURE - SECOND SESSION BY SENATORS KAUFMAN, Dunbar, Giessel, Gray-Jackson, Claman Introduced:
4/21/23relating Referred:to insurance data security;
Labor & Commerce, Judiciary, Finance A BILL FOR AN ACT ENTITLED "An Act relating to insurancemammograms; data security;
and providing for an effective date."date. BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF ALASKA:
*_______________ SectionBE 1.IT ENACTED BY THE LEGISLATURE OF THE STATE OF ALASKA:
ASTHE 21.96ACT isFOLLOWS amendedON byPAGE adding1 newEnrolled sectionsSB 134 AN ACT Relating to read:insurance;
relating to insurance data security;
relating to mammograms;
amending Rule 26, Alaska Rules of Civil Procedure, and Rules 402 and 501, Alaska Rules of Evidence;
and providing for an effective date.
_______________ * Section 1.
AS 21.23 is amended by adding new sections to read:
Article 2.
Insurance Data Security.
21.96.250.21.23.240.
Purpose and construction.
(a) AS 21.23.240 - 21.23.399 establish the exclusive state standard for data security for licensees and govern the investigation and notification of a cybersecurity event.
(b) AS 21.23.240 - 21.23.399 may not be construed to (1) create or imply a private cause of action for violation of AS 21.23.240 - 21.23.399;
or (2) prevent a private cause of action that would otherwise exist in the absence of AS 21.23.240 - 21.23.399.
-1- Enrolled SB 134 Sec.
21.23.250.
(a) A licensee shall conduct a risk assessment commensurate with the size and complexity of the licensee and in consideration of the nature and scope of the licensee's activities to evaluate the security and confidentiality of nonpublic information.information used by or in the possession or control of the licensee.
(2) assess the likelihood and potential damage of the threats identified SB0134A -1- SB 134 New Text Underlined [DELETED TEXT BRACKETED] 33-LS0253\B in (1) of this subsection, taking into consideration the sensitivity of nonpublic information;
(b) A licensee shall use the licensee's risk assessment to design the licensee's information security program required under AS 21.96.260(a).21.23.260(a).
21.96.260.21.23.260.
(a) A licensee shall develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment conducted under AS 21.96.250(a).21.23.250(a).
(b) A licensee's information security program must Enrolled SB 134 -2- (1) contain administrative, technical, and physical safeguards to protect the security and confidentiality of nonpublic information and the security of the licensee's information system;
SB 134 -2- SB0134A New Text Underlined [DELETED TEXT BRACKETED] 33-LS0253\B (c) In developing, implementing, and maintaining a licensee's information security program, the licensee shall (1) based on the licensee's risk assessment conducted under AS 21.96.250(a),21.23.250(a), implement the following security measures if the licensee determines that the security measure is appropriate:
-3- Enrolled SB 134 (E) adopt secure development practices for applications used by the licensee that are developed in-house;
the licensee shall adopt procedures for evaluating, assessing, or testing the security of externally developed applications used by the licensee;
(H) include audit trails inside the information security program that are designed to detect and respond to cybersecurity events and to SB0134A -3- SB 134 New Text Underlined [DELETED TEXT BRACKETED] 33-LS0253\B reconstruct material financial transactions sufficient to support normal operations and obligations of the licensee;
Enrolled SB 134 -4- (7) exercise due diligence in selecting a third-party service provider;
(8) where appropriate, require a third-party service provider to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the third-party service provider;
(9)for monitor,purposes evaluate,of andthis adjust,paragraph, asencrypted appropriate,nonpublic the information securityis programnot consistentconsidered withaccessible relevantto, changesor inheld technology,by, the sensitivitythird-party ofservice itsprovider nonpublicif information,the internalassociated protective process or externalkey threatsnecessary to nonpublicassign information,meaning andto the licensee'snonpublic owninformation changingis businessnot arrangements,within includingthe mergers,possession acquisitions,of alliances,the jointthird-party ventures,service outsourcingprovider; arrangements, and changes to information systems;
and(9) SBrequire 134that -4-a SB0134Athird-party Newservice Textprovider Underlinedthat [DELETEDhas TEXTaccess BRACKETED]to 33-LS0253\Bor (10)holds establishnonpublic ainformation writtennotify incidentthe responselicensee planas designedsoon toas promptlypossible respondbut to,not andlater recoverthan from,10 abusiness cybersecuritydays eventafter determining that compromises the confidentiality,third-party integrity,service orprovider availabilityhas ofexperienced nonpublica informationcybersecurity inevent theinvolving licensee'snonpublic possession, the licensee's information systems,associated orwith thea continuingconsumer; functionality of an aspect of the licensee's business or operations;
for purposes of this paragraph, encrypted nonpublic information is considered accessible to or held by the third-party service provider if the associated protective process or key necessary to assign meaning to the nonpublic information is within the possession of the third-party service provider;
(10) monitor, evaluate, and adjust, as appropriate, the information security program consistent with relevant changes in technology, the sensitivity of its nonpublic information, internal or external threats to nonpublic information, and the licensee's own changing business arrangements, including mergers, acquisitions, alliances, joint ventures, outsourcing arrangements, and changes to information systems;
and (11) establish a written incident response plan designed to promptly respond to, and recover from, a cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in the licensee's possession, the licensee's information systems, or the continuing functionality of an aspect of the licensee's business or operations;
-5- Enrolled SB 134 (B) the goals of the incident response plan;
Show all 141 changed lines (101 more)
(A) the overall status of the information security program and the licensee's compliance with AS 21.96.25021.23.240 - 21.96.399;21.23.399;
and (B) material matters related to the information security program, including risk assessment, risk management and control decisions, SB0134A -5- SB 134 New Text Underlined [DELETED TEXT BRACKETED] 33-LS0253\B third-party service provider arrangements, results of testing, cybersecurity events or violations, management's responses to the cybersecurity events or violations, and recommendations for changes in the information security program.
The delegate shall provide a report to the executive Enrolled SB 134 -6- management that complies with the requirements of (d)(2) of this section.
(f) Each licensee who is an insurer domiciled in this state shall (1) submit to the director a written statement by February 15 of each year certifying that the insurer is in compliance with the requirements under AS 21.96.25021.23.250 and this section;
or SB 134 -6- SB0134A New Text Underlined [DELETED TEXT BRACKETED] 33-LS0253\B (C) an inherence factor, including a biometric characteristic.
21.96.270.21.23.270.
During the investigation, if the licensee, outside vendor, or third-party service provider determines that a cybersecurity event has occurred, the licensee, outside vendor,vendoor or third-party service provider shall, to the extent possible, -7- Enrolled SB 134 (1) assess the nature and scope of the cybersecurity event;
and (3) perform or oversee reasonable measures to restore the security of the information systems compromised in the cybersecurity event to prevent further unauthorized acquisition, release, or use of nonpublic information in the licensee's possession,possession custody, or control.
21.96.280.21.23.280.
(a) AUnless a federal law enforcement official instructs the licensee not to distribute information regarding a cybersecurity event, a licensee shall notify the director as soon as possible and not later than 72three hoursbusiness days after athe licensee determines that a cybersecurity event has occurred, if (1) the licensee is an insurer and domiciled in this state;
or (3) the licensee reasonably believes that the cybersecurity event involves the nonpublic information of 250 or more consumers residing in this state and SB0134A -7- SB 134 New Text Underlined [DELETED TEXT BRACKETED] 33-LS0253\B the cybersecurity event (A) affects the licensee, and a state or federal law requires the licensee to provide notice of the cybersecurity event to a government agency;
or (B) has a reasonable likelihood of materially harming a consumer residing in this state or a material part of the normal operation of the Enrolled SB 134 -8- licensee.
(b) TheTo notification to the directorgreatest under (a) of this section must include, to the extent possible and in a form and format prescribed by the director, the notification to the director under (a) of this section must include the following information:
(10) the results of an internal review identifying a lapse ineither the SB 134 -8- SB0134A New Text Underlined [DELETED TEXT BRACKETED] 33-LS0253\B licensee's automated controls or internal procedures or confirming that the licensee followed all automated controls or internal procedures;
(12) a copy of the licensee's privacy policy and a statement outlining the steps the licensee will take to investigate and notify consumerscumers affected by the -9- Enrolled SB 134 cybersecurity event;
(e) IfUnless a third-party service provider of a licensee notifies the director, if the licensee becomes aware of a cybersecurity event that affects an information system maintained by athe third-party service providerprovider, of the licensee, the licensee shall comply with the requirements of this section, except that the time prescribed in (a) of this section beginsto the daygreatest afterextent thepossible. third-party service provider notifies the licensee of the cybersecurity event or the day after the date the licensee has actual knowledge of the cybersecurity event, whichever is earlier.
(f)For Apurposes licenseeof actingthis assubsection, anthe assumingtime insurerprescribed thatin determines(a) thatof athis cybersecuritysection eventbegins hasthe occurredday shall, not later than 72 hours after the determination,third-party notifyservice theprovider licensee'snotifies affected ceding insurers and the insurancelicensee supervisory official of the licensee's state of domicile if (1) the cybersecurity event involvesor nonpublicthe informationday andafter the nonpublicdate information is information used by or in the possession,licensee custody,has oractual controlknowledge of the licenseecybersecurity actingevent, aswhichever anis assumingearlier. insurer;
and(f) SB0134AA -9-licensee SBacting 134as Newan Textassuming Underlinedinsurer [DELETEDthat TEXTdetermines BRACKETED]that 33-LS0253\Ba (2)cybersecurity theevent licenseehas doesoccurred shall, not havelater athan directthree contractualbusiness relationshipdays withafter athe consumerdetermination, notify the licensee's affected byceding insurers and the insurance supervisory official of the licensee's state of domicile if (1) the cybersecurity event.event involves nonpublic information and the nonpublic information is information used by or in the possession or control of the licensee acting as an assuming insurer;
(g)and A(2) licensee acting as an assuming insurer that receives notification from the licensee'slicensee third-partydoes servicenot providerhave that a cybersecuritydirect eventcontractual hasrelationship occurredwith shall,a notconsumer later than 72 hours after receiving notification, notify the licensee's affected cedingby insurers and the insurance supervisory official of the licensee's state of domicile if the cybersecurity eventevent. involves nonpublic information and the nonpublic information is in the possession, custody, or control of the third-party service provider.
(h)(g) A cedinglicensee acting as an assuming insurer notifiedthat underreceives (f)notification orfrom (g)the oflicensee's thisthird-party sectionservice provider that a cybersecurity event has aoccurred directshall, contractualnot relationshiplater withthan anthree business days after receiving notification, notify the licensee's affected consumerEnrolled shallSB comply134 with-10- thisceding sectioninsurers and allthe applicableinsurance provisionssupervisory official of ASthe 45.48licensee's (Alaskastate Personalof Informationdomicile Protectionif Act).the cybersecurity event involves nonpublic information and the nonpublic information is in the possession or control of the third-party service provider.
(i)(h) AExcept licenseeas thatprovided isin an(f) insurer and that(g) becomesof awarethis thatsection, a cybersecuritylicensee eventacting involving nonpublic information has occurred shall, as soonan asassuming possibleinsurer anddoes innot ahave formother andnotice formatobligations prescribedrelating byto the director, notify each independent insurance producer of record of a consumer affected by the cybersecurity event ifunder (1)this thesection. nonpublic information is in the possession, custody, or control of the licensee or the licensee's third-party service provider;
(i) A licensee that is an insurer and that becomes aware that a cybersecurity event involving nonpublic information has occurred shall, as soon as possible and in a form and format prescribed by the director, notify each independent insurance producer of record of a consumer affected by the cybersecurity event if (1) the nonpublic information is in the possession or control of the licensee or the licensee's third-party service provider;
Sec.(j) An insurer shall notify an insurance producer of a cybersecurity event involving nonpublic information, not later than the date the notice is provided to the affected consumers, if (1) the nonpublic information is in the possession or control of a licensee that is an insurer or the licensee's third-party service provider;
21.96.290.(2) the consumer accessed the insurer's services through an insurance producer;
and (3) the insurer is required to notify affected consumers under AS 21.23.240 - 21.23.399 or AS 45.48.
(k) An insurer is exempt from notifying an insurance producer under (j) of this section if (1) the producer is not authorized by law or contract to sell, solicit, or negotiate on behalf of the insurer;
or (2) the insurer does not have the current producer information for an affected consumer.
-11- Enrolled SB 134 Sec.
21.23.290.
(a) Any document, material, or information in the possession or control of the division that is provided by a licensee or an employee or agent acting on behalf of a licensee under AS 21.96.260(f)21.23.260(f) or 21.96.280(b)(2)21.23.280(b)(2) - (5), (8), (10), or (11) or that is obtained by the director in an investigation or examination under AS 21.96.31021.23.310 (1) is confidential and privileged;
SB 134 -10- SB0134A New Text Underlined [DELETED TEXT BRACKETED] 33-LS0253\B (b) The director may use a document, material, or information described in (a) of this section in a regulatory or legal proceeding brought in the performance of the duties of the director under this title.
(d) In the performance of duties under AS 21.96.25021.23.240 - 21.96.399,21.23.399, the director may (1) may disclose a document, material, or information, including a document, material, or information that is confidential and privileged or subject to (a) of this section, to state, federal, and international regulatory or law enforcement agencies, or to the National Association of Insurance Commissioners and its affiliates or subsidiaries, if the recipient agrees in writing to maintain the confidentiality and privileged status of the document, material, or information;
(2) may receive a document, material, or information, including a document, material, or information that is confidential and privileged, from the National Association of Insurance Commissioners and its affiliates or subsidiaries, and from state, federal, and international regulatory or law enforcement agencies;
the director shall maintain as confidential or privileged the document, material, or information if the entity that provided the director with the document, material, or information requests the director to do so or gives notice to the director that the document, material, or information is confidential or privileged under the law of the Enrolled SB 134 -12- jurisdiction supplying it;
(3) may disclose a document, material, or information that is subject to (a) of this section with a third-party service provider if the third-party service provider agrees in writing to maintain the confidentiality and privileged status of the document, material, or information;
and (4) may enter into agreements consistent with this section governing the sharing and use of a document, material, or information that is confidential or privileged or subject to (a) of this section.
(e) A person does not waive a claim of privilege or confidentiality that the SB0134A -11- SB 134 New Text Underlined [DELETED TEXT BRACKETED] 33-LS0253\B person possesses by providing a document, material, or information to the director under AS 21.96.25021.23.240 - 21.96.39921.23.399 or by the disclosure, receipt, or sharing of a document, material, or information under (d) of this section.
21.96.300.21.23.300.
(a) AS 21.96.25021.23.250 and 21.96.26021.23.260 do not apply to (1) a licensee, including an independent contractor, with fewer than 10 employees;
(b) AS 21.96.25021.23.240 - 21.96.39921.23.399 do not apply to a licensee subject to the Health Insurance Portability and Accountability Act of 1996 (P.L.
(c) If a licensee no longer qualifies for an exception to the applicability of AS 21.96.25021.23.240 - 21.96.39921.23.399 under this section, the licensee shall comply with -13- Enrolled SB 134 AS 21.96.25021.23.240 - 21.96.39921.23.399 within 180 days after the licensee no longer qualifies for the exception.
21.96.310.21.23.310.
(a) In addition to the director's power to examine or investigate under AS 21.06.120, the director may examine and investigate the affairs of a licensee to determine whether the licensee is or has been in violation of AS 21.96.25021.23.240 - 21.96.399.21.23.399.
The director may take necessary or appropriate action to enforce AS 21.96.25021.23.240 - 21.96.399.21.23.399.
SB 134 -12- SB0134A New Text Underlined [DELETED TEXT BRACKETED] 33-LS0253\B (b) In addition to any other penalty provided by law, a person who violates AS 21.96.25021.23.240 - 21.96.39921.23.399 is subject to the penalties provided under AS 21.27.440.
(c) AS 21.96.250 - 21.96.399 do not create or imply a private cause of action for a violation of AS 21.96.250 - 21.96.399.
21.96.399.21.23.399.
In AS 21.96.25021.23.240 - 21.96.399,21.23.399, (1) "consumer" means an individual who is a resident of thisthe state and whose nonpublic information is in a licensee's possession,possession custody, or control;
(3) "encrypt" means transforming of data into a form that resultslts in a low probability of assigning meaning without the use of a protective process or key;
Enrolled SB 134 -14- (5) "information system" means (A) a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of electronic information;
SB0134A -13- SB 134 New Text Underlined [DELETED TEXT BRACKETED] 33-LS0253\B (6) "licensee" (A) means a person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered, under the insurance laws of this state;title;
(7) "nonpublic information" means electronic information that is not publicly available information and that is (A) business-related information of a licensee, the tampering with which, or unauthorized disclosure, access, or use of which, would cause a material adverse effect to the business, operations, or security of the licensee;
(iii) ana financial account, credit card, or debit card number;
or (C) information or data, except age or gender, in any form or medium created by or derived from a health care provider or a consumer that can be -15- Enrolled SB 134 used to identify a particular consumer and relates to (i) the past, present, or future physical, mental, or behavioral health or condition of a consumer or a member of the consumer's family;
or (iii)(iii)payment payment for the provision of health care to a consumer;
SB 134 -14- SB0134A New Text Underlined [DELETED TEXT BRACKETED] 33-LS0253\B (8) "person" means an individual or a nongovernmental entity;
AS 21.42.375(e) is amended to read:
(e) In this section, (1) "diagnostic breast examination" means an examination of the breast using contrast-enhanced mammography, diagnostic mammography, breast magnetic resonance imaging, breast ultrasound, or other equipment dedicated specifically for mammography conducted to evaluate an abnormality (A) detected or suspected in a screening examination for breast cancer;
or (B) detected by another means of examination;
(2) "low-dose mammography screening" and "mammogram" mean the X-ray examination of the breast using equipment dedicated specifically for mammography, including the X-ray tube, filter, compression device, screens, films, and cassettes, with an average radiation exposure delivery of less than one rad mid- Enrolled SB 134 -16- breast, with two views for each breast;
(3) "supplemental breast examination" means an examination of the breast using contrast-enhanced mammography, diagnostic mammography, breast magnetic resonance imaging, breast ultrasound, or other equipment dedicated specifically for mammography conducted based on (A) the insured's personal or family medical history of breast cancer;
or (B) other factors that may increase the insured's risk of breast cancer.
* Sec.
3.
AS 21.42.375 is amended by adding a new subsection to read:
(f) Except as necessary to qualify a plan as a high deductible health plan eligible for a health savings account tax deduction under 26 U.S.C.
223 (Internal Revenue Code), a health care insurer that offers, issues, delivers, or renews a health care insurance plan in the individual or group market in the state that provides coverage for mammography screening, diagnostic breast examinations, and supplemental breast examinations may not impose cost sharing, a deductible, coinsurance, a copayment obligation, or another similar out-of-pocket expense on an insured for coverage of a low-dose mammography screening, diagnostic breast examination, or supplemental breast examination.
* Sec.
4.
(a) AS 21.96.290(a)(3),21.23.290(a)(3), enacted by sec.
1 of this Act, has the effect of changing Rule 26, Alaska Rules of Civil Procedure, by prohibiting discovery of evidence in the possession or control of the division of insurance that is provided by a licensee or an employee or agent acting on behalf of a licensee under AS 21.96.260(f)21.23.260(f) or 21.96.280(b)(2)21.23.280(b)(2) - (5), (8), (10), or (11) or that is obtained by the director in an investigation or examination under AS 21.96.310.21.23.310.
(b) AS 21.96.290(a)(4)21.23.290(a)(4) and (c), enacted by sec.
1 of this Act, have the effect of changing Rules 402 and 501, Alaska Rules of Evidence, by (1) creating a new privilege that would prevent the director of the division of insurance, or an individual acting under the authority of the director, from being permitted or -17- Enrolled SB 134 compelled to testify about confidential or privileged documents, materials, or information in a private civil action;
and (2) precluding admissibility of evidence in a private action of documents, materials, or other information in the possession or control of the division of insurance that is provided by a licensee or an employee or agent acting on behalf of a licensee under AS 21.96.260(f)21.23.260(f) or 21.96.280(b)(2)21.23.280(b)(2) - (5), (8), (10), or (11) or that is obtained by the director in an investigation or examination under AS 21.96.310.21.23.310.
3.5.
The uncodified law of the State of Alaska is amended by adding a new section to SB0134A -15- SB 134 New Text Underlined [DELETED TEXT BRACKETED] 33-LS0253\B read:
APPLICABILITY.
AS 21.42.375(e), as amended by sec.
2 of this Act, and AS 21.42.375(f), added by sec.
3 of this Act, apply to an insurance policy or contract issued, delivered, or renewed on or after the effective date of secs.
2 and 3 of this Act.
* Sec.
6.
The uncodified law of the State of Alaska is amended by adding a new section to read:
4.7.
AS 21.96.290(a)(3)21.23.290(a)(3) and(4)and (4) and (c), enacted by sec.
24 of this Act receives the two-thirds majority vote of each house required by art.
5.8.
Section 36 of this Act takes effect immediately under AS 01.10.070(c).
6.9.
If AS 21.96.25021.23.290(a)(3) and 21.96.260(a),(4) (b), (c)(1) - (6), (9), and (10),(c), and (d) - (g), enacted by sec.
1 of this Act, take effect, they take effect January 1, 2025.
7.10.
AS 21.96.260(c)(7)21.23.250 and (8),21.23.260(a), (b), (c)(1) - (6) and (9) - (11), and (d) - (g), enacted by sec.
8.11.
AS 21.23.260(c)(7) and (8), enacted by sec.
1 of this Act, take effect January 1, 2027.
* Sec.
12.
58 - 711 of this Act, this Act takes effect January 1, 2024.Enrolled SB 134 -18- 2025.
SB-19- 134Enrolled -16-SB SB0134A134 New Text Underlined [DELETED TEXT BRACKETED]
Show all 141 changed rows (101 more)
View plain text versions (5)
- Enrolled Enrolled SB 134 Current pdf
- SB 134 View text pdf
- CSSB 134(L&C) View text pdf
- CSSB 134(JUD) View text pdf
- HCS CSSB 134(JUD) View text pdf
AI-generated reading aid from the bill's amendatory text — verify against the official bill.
The bill establishes new sections under AS 21.23 concerning data security standards for insurance licensees in Alaska.
-
AS 21.23
Article 2. Insurance Data Security. Sec. 21.23.240. Purpose and construction. (a) AS 21.23.240 - 21.23.399 establish the exclusive state standard for data security for licensees and govern the investigation and notification of a cybersecurity event. (b) AS 21.23.240 - 21.23.399 may not be construed to (1) create or imply a private cause of action for violation of AS 21.23.240 - 21.23.399; or (2) prevent a private cause of action that would otherwise exist in the absence of AS 21.23.240 - 21.23.399.
This adds a new article defining the purpose and limitations of the insurance data security regulations.
-
AS 21.23
Sec. 21.23.250. Risk assessment. (a) A licensee shall conduct a risk assessment commensurate with the size and complexity of the licensee and in consideration of the nature and scope of the licensee's activities to evaluate the security and confidentiality of nonpublic information used by or in the possession or control of the licensee. [...]
This requires insurance licensees to conduct comprehensive risk assessments related to their nonpublic information.
-
AS 21.23
Sec. 21.23.260. Information security program. (a) A licensee shall develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment conducted under AS 21.23.250(a). [...]
This mandates that licensees maintain a written information security program tailored to the results of their risk assessment.
Action History
-
(S) EFFECTIVE DATE(S) OF LAW SEE CHAPTER
-
(S) LAW W/O GOV SIGNATURE 8/29 CH 39 SLA 24
-
(S) 9:25 A.M. 8/6/24 Transmitted to Governor
-
(S) EFFECTIVE DATE(S) SAME AS PASSAGE
-
(S) COURT RULE(S) SAME AS PASSAGE
-
(S) CONCUR AM OF (H) Y20 N-
-
(S) CONCUR MESSAGE READ AND TAKEN UP
-
(H) VERSION: HCS CSSB 134(JUD)
-
(H) TRANSMITTED TO (S) AS AMENDED
-
(H) EFFECTIVE DATE(S) SAME AS PASSAGE
-
(H) COURT RULE(S) SAME AS PASSAGE
-
(H) PASSED Y39 N1
-
(H) RETURN TO SECOND FOR AMS MOTION WITHDRAWN
-
(H) READ THE THIRD TIME HCS CSSB 134(JUD)
-
(H) CROSS SPONSOR(S): JOSEPHSON
-
(H) ADVANCED TO THIRD READING 5/14 CALENDAR
-
(H) AM NO 6 FAILED Y1 N38 E1
-
(H) AM NO 5 TABLED Y23 N16 E1
-
(H) AM NO 4 TABLED Y23 N16 E1
-
(H) AM NO 3 TABLED Y24 N15 E1
-
(H) AM NO 2 FAILED Y1 N38 E1
-
(H) AM NO 1 FAILED Y1 N38 E1
-
(H) JUD HCS ADOPTED Y38 N1 E1
-
(H) READ THE SECOND TIME
-
(H) RULES TO CALENDAR 5/13/2024
-
(H) -- MEETING CANCELED --
-
(H) RULES at 06:00 PM GRUENBERG 120
-
(H) FN2: ZERO(CED)
-
(H) FN1: ZERO(CED)
-
(H) AM: SUMNER, ALLARD
-
(H) NR: C.JOHNSON
-
(H) DP: GRAY, GROH, VANCE
-
(H) JUD RPT HCS(JUD) 3DP 1NR 2AM
-
(H) Minutes (HJUD)
-
(H) Moved HCS CSSB 134(JUD) Out of Committee -- Delayed to 1:30 PM --
-
(H) JUDICIARY at 01:00 PM GRUENBERG 120
-
(H) FIN REFERRAL REMOVED
-
(H) JUD WAIVED PUBLIC HEARING NOTICE, RULE 23
-
(H) JUD, FIN
-
(H) READ THE FIRST TIME - REFERRALS
-
(S) VERSION: CSSB 134(JUD)
-
(S) TRANSMITTED TO (H)
-
(S) EFFECTIVE DATE(S) SAME AS PASSAGE
-
(S) COURT RULE(S) SAME AS PASSAGE
-
(S) PASSED Y19 N- E1
-
(S) READ THE THIRD TIME CSSB 134(JUD)
-
(S) COSPONSOR(S): DUNBAR, GIESSEL, GRAY-JACKSON, CLAMAN
-
(S) ADVANCED TO THIRD READING 4/29 CAL
-
(S) JUD CS ADOPTED UC
-
(S) READ THE SECOND TIME
-
(S) RULES TO CALENDAR 4/26/2024
-
(S) FN1: ZERO(CED)
-
(S) NR: TOBIN, GIESSEL
-
(S) DP: CLAMAN, KIEHL
-
(S) JUD RPT CS 2DP 2NR NEW TITLE
-
(S) Moved CSSB 134(JUD) Out of Committee
-
(S) JUDICIARY at 01:30 PM BUTROVICH 205
-
(S) Heard & Held
-
(S) JUDICIARY at 01:30 PM BUTROVICH 205
-
(S) Heard & Held
-
(S) JUDICIARY at 01:30 PM BUTROVICH 205
-
(S) Heard & Held
-
(S) JUDICIARY at 01:30 PM BUTROVICH 205
-
(S) <Bill Hearing Rescheduled to 03/20/24> -- Delayed to 1:45 pm --
-
(S) JUDICIARY at 01:30 PM BUTROVICH 205
-
(S) FIN REFERRAL REMOVED
-
(S) FN1: ZERO(CED)
-
(S) DP: BJORKMAN, DUNBAR, BISHOP
-
(S) L&C RPT CS 3DP SAME TITLE
-
(S) Minutes (SL&C)
-
(S) Moved CSSB 134(L&C) Out of Committee
-
(S) LABOR & COMMERCE at 01:30 PM BELTZ 105 (TSBldg)
-
(S) Minutes (SL&C)
-
(S) Heard & Held
-
(S) LABOR & COMMERCE at 01:30 PM BELTZ 105 (TSBldg)
-
(S) L&C, JUD, FIN
-
(S) READ THE FIRST TIME - REFERRALS
Sponsors
- Andy Josephson · Cosponsor
- Matt Claman · Cosponsor
- Elvi Gray-Jackson · Cosponsor
- Cathy Giessel · Cosponsor
- Forrest Dunbar · Cosponsor
- James Kaufman · Primary
Sponsorship breakdown
Export CSV (upgrade) →1 sponsors · 5 co-sponsors · 59 not signed on
Sponsors (1)
Co-sponsors (5)
Not signed on (59)
59 members have not signed on to this bill.
Show all 59 →"Not signed on" means a member has not sponsored or co-sponsored this bill — it does not imply opposition. Members flagged Voted No have a recorded No vote on this bill.
Votes
Roll call published as PDF — view source.
Roll call published as PDF — view source.
Roll call published as PDF — view source.
Roll call published as PDF — view source.
Roll call published as PDF — view source.
Roll call published as PDF — view source.
Roll call published as PDF — view source.
Roll call published as PDF — view source.
Roll call published as PDF — view source.
Roll call published as PDF — view source.
Subjects
Frequently asked questions
- Who sponsors SB 134?
- SB 134 is sponsored by Andy Josephson (D), Matt Claman (D), Elvi Gray-Jackson (D), Cathy Giessel (R), Forrest Dunbar (D), and James Kaufman (R).
- What is the current status of SB 134?
- This bill has been enacted into law. Introduced April 21, 2023. Enacted.
- Where can I track SB 134?
- Track SB 134 free on One Click Politics — get push/email alerts when it moves.
Make your voice heard on SB 134
Find the representatives who decide this bill and tell them where you stand — for yourself, or mobilize your whole list in one click with One Click Politics advocacy software.
Stay ahead of SB 134
Last checked for changes 3 months ago · updated continuously
One Click Politics tracks every bill in Congress and all 50 states.
Track this bill →