HB 474 — AN ACT relating to insurance data security.

UNOFFICIALCHAPTER COPY149 221 RSCHAPTER 149 ( HB 474/EN474 ) AN ACT relating to insurance data security.

(4) "Information security program" means the administrative, technical, and physical safeguards that a licensee uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle nonpublic Page 1 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN information;

Legislative Research Commission PDF Version ACTS OF THE GENERAL ASSEMBLY 1.

Page 2 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN b.

(b) For purposes of this definition, a licensee has a reasonable basis to believe that information is lawfully made available to the general public if the Page 3 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN licensee has taken steps to determine:

CHAPTER 149 3 SECTION 4.

Page 4 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN (a) "Authorized individual" means an individual:

Protect the security and confidentiality of nonpublic information Page 5 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN and the security of the information system;

Legislative Research Commission PDF Version ACTS OF THE GENERAL ASSEMBLY (d) Assess the sufficiency of policies, procedures, information systems, and other safeguards in place to manage the threats identified under paragraph (b) of this subsection, including consideration of threats in each relevant area of the licensee's operations, including:

Page 6 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN 1.

Nature and scope of the licensee's activities, including its use of third-third-party party service providers;

Restrict physical access to nonpublic information to authorized Page 7 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN individuals only;

and CHAPTER 149 5 11.

Develop, implement, and maintain procedures for the secure disposal Page 8 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN of nonpublic information in any format;

Oversee the development, implementation, and maintenance of the Page 9 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN licensee's information security program prepared by the delegate or delegates;

(b) The incident response plan established under this subsection shall address Page 10 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN the following:

Legislative Research Commission PDF Version ACTS OF THE GENERAL ASSEMBLY 2.

The definition of clear roles, responsibilities, and levels of decision-decision-making making authority;

(10) (a) An employee, agent, representative, or designee of a licensee, who is also a licensee, shall be exempt from the requirements of this section and shall not Page 11 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN be required to develop its own information security program to the extent that the employee, agent, representative, or designee is covered by the information security program of the other licensee.

(2) If a licensee learns that a cybersecurity event has or may have occurred in a system maintained by a third-partythird- party service provider, the licensee shall complete, or confirm and document that the third-party service provider has completed, the steps listed in subsection (1)(b) of this section.

Page 12 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN (3) Each licensee shall maintain, and produce upon demand of the commissioner, records concerning all cybersecurity events for a period of at least five (5) years from the date of the cybersecurity event.

CHAPTER 149 7 (1) Each licensee shall notify the commissioner of a cybersecurity event involving nonpublic information that is in the possession of the licensee as promptly as possible, but in no event later than three (3) business days from a determination that a cybersecurity event has occurred, if:

(2) (a) In its notification to the commissioner under subsection (1) of this section, Page 13 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN the licensee shall provide, in an electronic form prescribed by the commissioner, the following information:

A description of how the information was exposed, lost, stolen, or breached, including the specific roles and responsibilities of third-third-party party service providers, if any;

Page 14 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN 11.

and Legislative Research Commission PDF Version ACTS OF THE GENERAL ASSEMBLY 14.

Page 15 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN (a) Investigation requirements under Section 5 of this Act;

(7) (a) Except as provided in paragraph (b) of this subsection, in the case of a cybersecurity event involving nonpublic information that is in the Page 16 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN possession, custody, or control of a licensee that is an insurer, or its third-third-party party service provider, and for which a consumer accessed the insurer's services through an independent insurance producer, the insurer shall notify the producers of record at the same time as all affected consumers when a licensee is required to notify consumers under KRS 365.732.

(1) (a) The commissioner shall have the power to examine and investigate the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of Section 4, 5, or 6 of this Act.

CHAPTER 149 9 (b) The power granted to the commissioner under this subsection shall be in addition to the powers of the commissioner under KRS 304.2-100.

(1) (a) Subject to paragraph (b) of this subsection and subsections (3) and (6) of this section, any documents, materials, or other information in the control or possession of the department that are furnished by a licensee, or an employee or agent acting on behalf of a licensee, under Section 4, 5, or 6 of Page 17 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN this Act or that are obtained by the commissioner in an investigation or examination under Section 7 of this Act shall:

and Page 18 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN 3.

Legislative Research Commission PDF Version ACTS OF THE GENERAL ASSEMBLY (a) A disclosure to the commissioner of documents, materials, or other information under this section;

Page 19 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN (b) Not be subject to KRS 61.870 to 61.884;

Parts 160 and 164, as amended, established pursuant to the Health Insurance Portability and Accountability Act of 1996, Pub.

164.404, as amended, at the same time as all affected Page 20 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN individuals;

Is a financial institution, as defined in KRS 304.9-135, that is subject to, governed by, and compliant with the privacy, security, and breach notification standards issued under Section 501 of the Gramm-Leach-Gramm-Leach-Bliley Bliley Act of 1999, 15 U.S.C.

CHAPTER 149 11 Section 13.

(a) Licensees shall have one year from the effective date of this Page 21 of 22 HB047420.100 - 1028 - XXXX Engrossed UNOFFICIAL COPY 22 RS HB 474/EN Act to implement subsections (1) to (3) and subsections (5) to (7) of Section 4 of this Act.

PageSigned 22by ofGovernor 22April HB047420.1008, -2022. 1028 - XXXX Engrossed