reglab/housing_qa huggingface dataset:
HI Rev Stat § 431:3B-102 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3B-102 Powers of the commissioner.

  §431:3B-102 Powers of the commissioner. (a) The licensee's regulator shall have the power to examine and investigate the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of this article.  (b) Any examination or investigation of a licensee domiciled in the State shall be conducted pursuant to section 431:2-301.7.  (c) Whenever the commissioner has reason to believe that a licensee has been or is engaged in conduct in the State that violates this article, the commissioner may take action that is necessary or appropriate to enforce the provisions of this article. [L 2021, c 112, pt of §2]
HI Rev Stat § 431:3B-104 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3B-104 Exceptions.

 §431:3B-104 Exceptions. (a) The following exceptions shall apply to this article:  (1) A licensee with fewer than ten employees, including any independent contractors, shall be exempt from part II;  (2) A licensee subject to the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, that has established and maintains an information security program pursuant to the statutes, rules, regulations, procedures, or guidelines established thereunder shall be considered to have met the requirements of part II of this article; provided that the licensee is compliant with and submits a written statement certifying its compliance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191; and  (3) An employee, agent, representative, or designee of a licensee, who is also a licensee, shall be exempt from part II of this article and shall not be required to develop its own information security program; provided that the employee, agent, representative, or designee is covered by the information security program of the other licensee.  (b) In the event that a licensee ceases to qualify for an exception pursuant to this section, the licensee shall have one hundred eighty days to comply with this article. [L 2021, c 112, pt of §2]
HI Rev Stat § 431:3B-105 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3B-105 Penalties.

 §431:3B-105 Penalties. In the case of a violation of this article, a licensee may be penalized in accordance with section 431:2-203. [L 2021, c 112, pt of §2]
HI Rev Stat § 431:3B-106 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3B-106 Private cause of action.

 §431:3B-106 Private cause of action. This article shall not be construed to create or imply a private cause of action for any violation of its provisions, and it shall not be construed to curtail a private cause of action that would otherwise exist in the absence of this article. [L 2021, c 112, pt of §2]
HI Rev Stat § 431:3B-107 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3B-107 Rules.

  §431:3B-107 Rules. The commissioner may adopt rules pursuant to chapter 91 as necessary to carry out the provisions of this article. [L 2021, c 112, pt of §2]
HI Rev Stat § 431:3B-201 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3B-201 Implementation of an information security program.

  §431:3B-201 Implementation of an information security program. Commensurate with the size and complexity of the licensee, the nature and scope of the licensee's activities, including its use of third-party service providers, and the sensitivity of the nonpublic information used by the licensee or in the licensee's possession, custody, or control, each licensee shall develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment and that contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system. [L 2021, c 112, pt of §2]
HI Rev Stat § 431:3B-202 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3B-202 Objectives of the information security program; risk assessment.

  §431:3B-202 Objectives of the information security program; risk assessment. (a) A licensee's information security program shall be designed to:  (1) Protect the security and confidentiality of nonpublic information and the security of the information system;  (2) Protect against any threats or hazards to the security or integrity of nonpublic information and the information system;  (3) Protect against unauthorized access to or use of nonpublic information, and minimize the likelihood of harm to any consumer; and  (4) Define and periodically reevaluate a schedule for retention of nonpublic information and a mechanism for its destruction when no longer needed.  (b) Regarding risk assessment, the licensee shall:  (1) Designate one or more employees, an affiliate, or a third-party service provider to act on behalf of the licensee who is responsible for the information security program;  (2) Identify reasonably foreseeable internal or external threats that could result in unauthorized access, transmission, disclosure, misuse, alteration, or destruction of nonpublic information, including the security of information systems and nonpublic information that are accessible to or held by third-party service providers;  (3) Assess the likelihood and potential damage of the reasonably foreseeable internal or external threats, taking into consideration the sensitivity of the nonpublic information;  (4) Assess the sufficiency of policies, procedures, information systems, and other safeguards in place to manage the reasonably foreseeable internal or external threats, including consideration of threats in each relevant area of the licensee's operations, including:  (A) Employee training and management;  (B) Information systems, including network and software design, as well as information classification, governance, processing, storage, transmission, and disposal; and  (C) Detecting, preventing, and responding to attacks, intrusions, or other systems failures; and  (5) Implement information safeguards to manage the threats identified in its ongoing assessment, and no less than annually, assess the effectiveness of the safeguards' key controls, systems, and procedures. [L 2021, c 112, pt of §2]
HI Rev Stat § 431:3B-203 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3B-203 Risk management.

 §431:3B-203 Risk management. Based on its risk assessment, the licensee shall:  (1) Design its information security program to mitigate the identified risks, commensurate with the size and complexity of the licensee's activities, including its use of third-party service providers, and the sensitivity of the nonpublic information used by the licensee or in the licensee's possession, custody, or control;  (2) Determine which security measures listed in this paragraph are appropriate and implement those security measures:  (A) Place access controls on information systems, including controls to authenticate and permit access only to authorized individuals to protect against the unauthorized acquisition of nonpublic information;  (B) Identify and manage the data, personnel, devices, systems, and facilities that enable the licensee to achieve business purposes in accordance with their relative importance to business objectives and the licensee's risk strategy;  (C) Restrict access at physical locations containing nonpublic information only to authorized individuals;  (D) Protect by encryption or other appropriate means, all nonpublic information while being transmitted over an external network and all nonpublic information stored on a laptop computer or other portable computing or storage device or media;  (E) Adopt secure development practices for in-house developed applications used by the licensee and procedures for evaluating, assessing, or testing the security of externally developed applications used by the licensee;  (F) Modify the information system in accordance with the licensee's information security program;  (G) Use effective controls, which may include multi-factor authentication procedures for any individual accessing nonpublic information;  (H) Regularly test and monitor systems and procedures to detect actual and attempted attacks on, or intrusions into, information systems;  (I) Include audit trails within the information security program designed to detect and respond to cybersecurity events and reconstruct material financial transactions sufficient to support normal operations and obligations of the licensee;  (J) Implement measures to protect against destruction, loss, or damage of nonpublic information due to environmental hazards, such as fire and water damage or other catastrophes or technological failures; and  (K) Develop, implement, and maintain procedures for the secure disposal of nonpublic information in any format;  (3) Include cybersecurity risks in the licensee's enterprise risk management process;  (4) Stay informed regarding emerging threats or vulnerabilities and use reasonable security measures when sharing information relative to the character of the sharing and the type of information shared; and  (5) Provide its personnel with cybersecurity awareness training that is updated as necessary to reflect risks identified by the licensee in the risk assessment. [L 2021, c 112, pt of §2]
HI Rev Stat § 431:3B-204 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3B-204 Oversight by board of directors.

  §431:3B-204 Oversight by board of directors. If the licensee has a board of directors, the board or an appropriate committee of the board shall, at a minimum:  (1) Require the licensee's executive management or its delegates to develop, implement, and maintain the licensee's information security program;  (2) Require the licensee's executive management or its delegates to report in writing at least annually, the following information:  (A) The overall status of the information security program and the licensee's compliance with this article; and  (B) Material matters related to the information security program, addressing issues such as risk assessment, risk management and control decisions, third-party service provider arrangements, results of testing, cybersecurity events or violations and management's responses thereto, and recommendations for changes in the information security program; and  (3) If executive management delegates any of its responsibilities under this part, it shall oversee the development, implementation, and maintenance of the licensee's information security program prepared by the delegate and shall receive a report from the delegate complying with the requirements of the report to the board of directors specified in paragraph (2). [L 2021, c 112, pt of §2]
HI Rev Stat § 431:3B-205 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3B-205 Oversight of third-party service provider arrangements.

  §431:3B-205 Oversight of third-party service provider arrangements. A licensee shall:  (1) Exercise due diligence in selecting its third-party service provider; and  (2) Where appropriate, require a third-party service provider to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to or held by the third-party service provider; provided that encrypted nonpublic information is not accessible to or held by the third-party service provider within the meaning of this paragraph if the third-party service provider does not possess the associated protective process or key necessary to assign meaning to the nonpublic information. [L 2021, c 112, pt of §2]
HI Rev Stat § 431:3B-206 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3B-206 Program adjustments.

 §431:3B-206 Program adjustments. The licensee shall monitor, evaluate, and adjust, as appropriate, the information security program consistent with any relevant changes in technology, the sensitivity of its nonpublic information, internal or external threats to information, and the licensee's own changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to information systems. [L 2021, c 112, pt of §2]
HI Rev Stat § 431:3B-207 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3B-207 Incident response plan.

 §431:3B-207 Incident response plan. (a) As part of its information security program, each licensee shall establish a written incident response plan designed to promptly respond to and recover from any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in its possession, the licensee's information systems, or the continuing functionality of any aspect of the licensee's business or operations.  (b) The incident response plan shall address the following areas:  (1) The internal process for responding to a cybersecurity event;  (2) The goals of the incident response plan;  (3) The definition of clear roles, responsibilities, and levels of decision-making authority;  (4) External and internal communications and information sharing;  (5) Identification of requirements for the remediation of any identified weaknesses in information systems and associated controls;  (6) Documentation and reporting regarding cybersecurity events and related incident response activities; and  (7) The evaluation and revision, as necessary, of the incident response plan following a cybersecurity event. [L 2021, c 112, pt of §2]
HI Rev Stat § 431:3B-208 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3B-208 Annual certification to commissioner

 §431:3B-208 Annual certification to commissioner. (a) Each insurer domiciled in the State shall annually submit to the commissioner a written statement by March 31, certifying that the insurer is in compliance with the requirements set forth in this part.  (b) Each insurer shall maintain all records, schedules, and data supporting this certificate for a period of five years for examination by the commissioner.  (c) To the extent an insurer has identified areas, systems, or processes that require material improvement, updating, or redesign, the insurer shall document the identification and the remedial efforts planned and underway to address those areas, systems, or processes. The documentation shall be available for inspection by the commissioner. [L 2021, c 112, pt of §2]
HI Rev Stat § 431:3B-301 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3B-301 Investigation of a cybersecurity event.

  §431:3B-301 Investigation of a cybersecurity event. (a) If the licensee learns that a cybersecurity event has or may have occurred, the licensee or third-party service provider designated to act on behalf of the licensee shall conduct a prompt investigation.  (b) During the investigation, the licensee or third-party service provider designated to act on behalf of the licensee shall, at a minimum, determine as much of the following information as possible:  (1) Whether a cybersecurity event has occurred;  (2) The nature and scope of the cybersecurity event; and  (3) Any nonpublic information that may have been involved in the cybersecurity event.  The licensee or third-party service provider designated to act on behalf of the licensee shall perform or oversee reasonable measures to restore the security of the information systems compromised in the cybersecurity event to prevent further unauthorized acquisition, release, or use of nonpublic information in the licensee's possession, custody, or control.  (c) If the licensee provides nonpublic information to a third-party service provider and learns that a cybersecurity event has or may have impacted the licensee's nonpublic information in a system maintained by a third-party service provider, the licensee shall meet the requirements of subsection (b) or confirm and document that the third-party service provider has met the requirements of subsection (b).  (d) The licensee shall maintain records concerning all cybersecurity events for a period of at least five years from the date of the cybersecurity event and shall produce those records upon demand of the commissioner. [L 2021, c 112, pt of §2]
HI Rev Stat § 431:3B-303 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3B-303 Notification to consumers.

 §431:3B-303 Notification to consumers. The licensee shall comply with chapter 487N, as applicable, and provide a copy of the notice sent to consumers under chapter 487N to the commissioner when a licensee is required to notify the commissioner under section 431:3B-302. [L 2021, c 112, pt of §2]
HI Rev Stat § 431:3B-304 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3B-304 Notice regarding cybersecurity events of third-party service providers.

 §431:3B-304 Notice regarding cybersecurity events of third-party service providers. (a) In the case of a cybersecurity event impacting a licensee's nonpublic information in a system maintained by a third-party service provider, of which the licensee has become aware, the licensee shall treat the event as it would under section 431:3B-302 unless the third-party service provider provides the notice required under section 431:3B-302.  (b) The computation of the licensee's deadlines shall begin on the day after the third-party service provider notifies the licensee of the cybersecurity event or the licensee otherwise has actual knowledge of the cybersecurity event, whichever is sooner.  (c) Nothing in this article shall prevent or abrogate an agreement between a licensee and another licensee, a third-party service provider, or any other party to fulfill any of the investigation requirements imposed under section 431:3B-301 or notice requirements imposed under this part. [L 2021, c 112, pt of §2]
HI Rev Stat § 431:3B-305 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3B-305 Notice regarding cybersecurity events of reinsures to insurers.

  §431:3B-305 Notice regarding cybersecurity events of reinsures to insurers. (a) In the case of a cybersecurity event involving nonpublic information that is used by the licensee that is acting as an assuming insurer or in the possession, custody, or control of a licensee that is acting as an assuming insurer and that does not have a direct contractual relationship with the affected consumers, the assuming insurer shall notify its affected ceding insurers and the commissioner of its state of domicile within three business days of making the determination that a cybersecurity event has occurred.  (b) In the case of a cybersecurity event involving nonpublic information that is in the possession, custody, or control of a third-party service provider of a licensee that is an assuming insurer, the assuming insurer shall notify its affected ceding insurers and the commissioner of its state of domicile within three business days of receiving notice from its third-party service provider that a cybersecurity event has occurred.  (c) The ceding insurers that have a direct contractual relationship with affected consumers shall fulfill the consumer notification requirements imposed under chapter 487N and any other notification requirements relating to a cybersecurity event imposed under this part. [L 2021, c 112, pt of §2]
HI Rev Stat § 431:3B-306 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3B-306 Notice regarding cybersecurity events of insurers to producers of record.

  §431:3B-306 Notice regarding cybersecurity events of insurers to producers of record. (a) In the case of a cybersecurity event involving nonpublic information that is in the possession, custody, or control of a licensee that is an insurer or its third-party service provider, and for which a consumer accessed the insurer's services through an independent insurance producer, the insurer shall notify the producers of record of all affected consumers as soon as practicable as directed by the commissioner.  (b) The insurer is exempt from this obligation in instances where it does not have the current producer of record information for any individual consumer. [L 2021, c 112, pt of §2]
HI Rev Stat § 431:3D-101 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3D-101 Scope and purpose.

 §431:3D-101 Scope and purpose. (a) This article shall apply to all insurers domiciled in this State unless exempt pursuant to section 431:3D-106.  (b) The purposes of this article shall be to:  (1) Provide the requirements for maintaining a risk management framework and completing an own risk and solvency assessment; and  (2) Provide guidance and instructions for filing an own risk and solvency assessment summary report with the commissioner. [L 2016, c 140, pt of §1]
HI Rev Stat § 431:3D-102 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3D-102 Definitions.

  §431:3D-102 Definitions. As used in this article:  "Insurance group" means those insurers and affiliates included within an insurance holding company system as defined in article 11.  "Insurer" shall have the same meaning as set forth in article 1, except that it shall not include:  (1) Agencies, authorities, or instrumentalities of the United States, its possessions and territories, the Commonwealth of Puerto Rico, the District of Columbia, or a state or political subdivision of a state;  (2) Fraternal benefit societies;  (3) Nonprofit medical and hospital service associations that are exempt from state and federal income taxes; or  (4) Unauthorized insurers.  "Own risk and solvency assessment" means a confidential internal assessment, appropriate to the nature, scale, and complexity of an insurer or insurance group and conducted by that insurer or insurance group, of the material and relevant risks associated with the insurer or insurance group's current business plan and the sufficiency of capital resources to support those risks.  "Own Risk and Solvency Assessment Guidance Manual" means the Own Risk and Solvency Assessment Guidance Manual as developed and adopted by the National Association of Insurance Commissioners and as amended from time to time. A change in the Own Risk and Solvency Assessment Guidance Manual shall take effect on the January 1 following the calendar year in which the changes have been adopted by the National Association of Insurance Commissioners.  "Own risk and solvency assessment summary report" means a confidential, high-level summary of an insurer or insurance group's own risk and solvency assessment. [L 2016, c 140, pt of §1]
HI Rev Stat § 431:3D-103 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3D-103 Risk management framework.

  §431:3D-103 Risk management framework. An insurer shall maintain a risk management framework to assist the insurer with identifying, assessing, monitoring, managing, and reporting its material and relevant risks. This requirement may be satisfied if the insurance group of which the insurer is a member maintains a risk management framework applicable to the operations of the insurer. [L 2016, c 140, pt of §1]
HI Rev Stat § 431:3D-104 (2021)
2021 Hawaii Revised Statutes|Title 24. Insurance|431. Insurance Code|431:3D-104 Own risk and solvency assessment requirement.

  §431:3D-104 Own risk and solvency assessment requirement. Subject to section 431:3D-106, an insurer or the insurance group of which the insurer is a member shall regularly conduct an own risk and solvency assessment consistent with a process comparable to the Own Risk and Solvency Assessment Guidance Manual. The own risk and solvency assessment shall be conducted no less than annually but also at any time when there are significant changes to the risk profile of the insurer or the insurance group of which the insurer is a member. [L 2016, c 140, pt of §1]