reglab/housing_qa huggingface dataset:
HI Rev Stat § 487J-1 (2021)
2021 Hawaii Revised Statutes|Title 26. Trade Regulation and Practice|487J. Personal Information Protection|487J-1 Definitions.

  §487J-1 Definitions. As used in this chapter:  "Affiliated" means businesses or persons who have contractual arrangements with, or are subject to the control of, the pharmacy benefit manager.  "Business" means a sole proprietorship, partnership, limited partnership, corporation, limited liability company, association, or any other form of business entity. The term also includes a financial institution organized, chartered, or holding a license or authorization certificate under the laws of this State, any other state, the United States, or any other country, or the parent or the subsidiary of any such financial institution. The term also includes an entity whose business is records destruction.  "Employee benefit plan" means any plan as defined in title 29 United States Code section 1002(3), as amended.  "Government agency" means any department, division, board, commission, public corporation, or other agency or instrumentality of the State or of any county.  "Health benefits plan" has the same meaning as in section 87A-1.  "Health information" has the same meaning as in 45 Code of Federal Regulations section 160.103, as may be amended.  "Managed care plan" has the same meaning as in section 432E-1.  "Marketing" means making a communication about a product or service that encourages a recipient of the communication to purchase or use the product or service.  "Personal information" has the same meaning as in section 487N-1.  "Redacted" means the rendering of data so that it is unreadable or is truncated so that no more than the last four digits of the identification number are accessible as part of the data.  "Pharmacy benefit manager" means any person, business, or entity that performs pharmacy benefit management, including but not limited to a person or entity under contract with a pharmacy benefit manager to perform pharmacy benefit management on behalf of a managed care company, nonprofit hospital or medical service organization, insurance company, third-party payor, or health program administered by the State.  "Scan" or "scanning" means to access the machine-readable zone of an individual's Hawaii identification card or driver's license with an electronic device capable of deciphering, in an electronically readable format, information electronically encoded on an individual's Hawaii identification card or driver's license. [L 2006, c 137, pt of §2; am L Sp 2008, c 10, §3; am L 2012, c 191, §2; am L 2013, c 225, §3] Revision Note  In this section, "pharmacy benefit manager" substituted for "pharmacy benefits manager" and "pharmacy benefit management" substituted for "pharmacy benefits management".
HI Rev Stat § 487J-3 (2021)
2021 Hawaii Revised Statutes|Title 26. Trade Regulation and Practice|487J. Personal Information Protection|487J-3 Penalties; civil action.

  §487J-3 Penalties; civil action. (a) Any business that violates any provision of this chapter shall be subject to penalties of not more than $2,500 for each violation. The attorney general or the executive director of the office of consumer protection may bring an action pursuant to this section. No such action may be brought against a government agency.  (b) In addition to any penalty provided for in subsection (a), any business that violates any provision of this chapter shall be liable to the injured party in an amount equal to the sum of any actual damages sustained by the injured party as a result of the violation. The court in any action brought under this section may award reasonable attorneys' fees to the prevailing party. No such action may be brought against a government agency.  (c) The penalties provided in this section shall be cumulative to the remedies or penalties available under all other laws of this State. [L 2006, c 137, pt of §2]
HI Rev Stat § 487J-4 (2021)
2021 Hawaii Revised Statutes|Title 26. Trade Regulation and Practice|487J. Personal Information Protection|487J-4 Reporting requirements.

  §487J-4 Reporting requirements. A government agency shall submit a written report to the legislature within twenty days after the discovery of a material occurrence of a social security number disclosure by the government agency that is prohibited by this chapter. The report shall contain information relating to the nature of the incident, the number of individuals affected by the incident, and any procedures that have been implemented to prevent the incident from reoccurring. In the event that a law enforcement agency informs the government agency that the report may impede a criminal investigation or jeopardize national security, the report to the legislature may be delayed until twenty days after the law enforcement agency has determined that the report will no longer impede the investigation or jeopardize national security. [L 2006, c 137, pt of §2]
HI Rev Stat § 487J-5 (2021)
2021 Hawaii Revised Statutes|Title 26. Trade Regulation and Practice|487J. Personal Information Protection|487J-5 Policy and oversight responsibility.

  §487J-5 Policy and oversight responsibility. (a) By September 1, 2009, each government agency shall designate an agency employee to have policy and oversight responsibilities for the protection of personal information.  (b) The designated agency employee shall:  (1) Ensure and coordinate agency compliance with this chapter, chapter 487N, and chapter 487R;  (2) Assist individuals who have identity theft and other privacy-related concerns;  (3) Provide education and information to agency staff on privacy and security issues;  (4) Coordinate with state, county, and federal law enforcement agencies on identity theft investigations; and  (5) Recommend policies and practices to protect individual privacy rights relating to the individual's personal information. [L Sp 2008, c 10, §2]
HI Rev Stat § 487J-7 (2021)
2021 Hawaii Revised Statutes|Title 26. Trade Regulation and Practice|487J. Personal Information Protection|487J-7 Pharmacy benefit managers; health information; prohibited marketing practices.

  §487J-7 Pharmacy benefit managers; health information; prohibited marketing practices. (a) A pharmacy benefit manager shall not:  (1) Use an individual's health information, or share an individual's health information with any pharmacy affiliated with or owned, wholly or in part, by the pharmacy benefit manager, for the purpose of marketing, unless:  (A) Use of the individual's health information is medically necessary to the health and safety of the individual;  (B) Use of the individual's health information is consistent with regulations of the federal Centers for Medicare and Medicaid, if the plan is governed by those rules; or   (C) The individual has affirmatively opted in, in writing, to use of the information;  (2) Sell or disseminate such information unless the sale or dissemination complies with all federal and state laws and the pharmacy benefit manager has received written approval for such sale or dissemination from the employee benefit plan, health benefits plan, or managed care plan sponsor, and the individual; or   (3) Directly contact an individual by any means, including via electronic delivery, telephonic, SMS text, or direct mail, for the purposes of marketing pharmacy benefit manager-owned pharmacies without the express written permission of the employee benefit plan, health benefits plan, or managed care plan sponsor, and the individual, unless the employee benefit plan, health benefits plan, or managed care plan sponsor first determines that the contact is medically necessary to the health and safety of the individual.  (b) Nothing in this section shall prohibit the use of a patient's health information that is used in conjunction with an insurer-authorized program to more effectively use prescription drugs to improve the health and safety of the individual.  (c) A pharmacy benefit manager shall provide each individual with an opportunity to affirmatively opt in to the sale or dissemination of their health information prior to entering into any arrangement for the lease, rental, dissemination, or sale of such information to any other entity, or to any subsidiary owned, wholly or in part, by the pharmacy benefit manager; provided that an individual may freely revoke the affirmative opt in at any time. [L 2013, c 225, §2] Revision Note  In this section, "pharmacy benefit managers" substituted for "pharmacy benefits managers", "pharmacy benefit manager" substituted for "pharmacy benefits manager", and "pharmacy benefit manager-owned pharmacies" substituted for "pharmacy benefits manager-owned pharmacies".
HI Rev Stat § 487N-1 (2021)
2021 Hawaii Revised Statutes|Title 26. Trade Regulation and Practice|487N. Security Breach of Personal Information|487N-1 Definitions

  §487N-1 Definitions. As used in this chapter, unless the context otherwise requires:  "Business" means a sole proprietorship, partnership, corporation, association, or other group, however organized, and whether or not organized to operate at a profit. The term includes a financial institution organized, chartered, or holding a license or authorization certificate under the laws of the State, any other state, the United States, or any other country, or the parent or the subsidiary of any such financial institution. The term also includes an entity whose business is records destruction.  "Council" means the information privacy and security council established under section 487N-5.  "Encryption" or "encrypted" means the use of an algorithmic process to transform data into a form in which the data is rendered unreadable or unusable without the use of a confidential process or key.  "Government agency" means any department, division, board, commission, public corporation, or other agency or instrumentality of the State or of any county.  "Personal information" means an individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:  (1) Social security number;  (2) Driver's license number or Hawaii identification card number; or  (3) Account number, credit or debit card number, access code, or password that would permit access to an individual's financial account. "Personal information" does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.  "Records" means any material on which written, drawn, spoken, visual, or electromagnetic information is recorded or preserved, regardless of physical form or characteristics.  "Redacted" means the rendering of data so that it is unreadable or is truncated so that no more than the last four digits of the identification number are accessible as part of the data.  "Security breach" means an incident of unauthorized access to and acquisition of unencrypted or unredacted records or data containing personal information where illegal use of the personal information has occurred, or is reasonably likely to occur and that creates a risk of harm to a person. Any incident of unauthorized access to and acquisition of encrypted records or data containing personal information along with the confidential process or key constitutes a security breach. Good faith acquisition of personal information by an employee or agent of the business for a legitimate purpose is not a security breach; provided that the personal information is not used for a purpose other than a lawful purpose of the business and is not subject to further unauthorized disclosure. [L 2006, c 135, pt of §2; am L 2008, c 19, §69; am L Sp 2008, c 10, §5]
HI Rev Stat § 487N-3 (2021)
2021 Hawaii Revised Statutes|Title 26. Trade Regulation and Practice|487N. Security Breach of Personal Information|487N-3 Penalties; civil action.

  §487N-3 Penalties; civil action. (a) Any business that violates any provision of this chapter shall be subject to penalties of not more than $2,500 for each violation. The attorney general or the executive director of the office of consumer protection may bring an action pursuant to this section. No such action may be brought against a government agency.  (b) In addition to any penalty provided for in subsection (a), any business that violates any provision of this chapter shall be liable to the injured party in an amount equal to the sum of any actual damages sustained by the injured party as a result of the violation. The court in any action brought under this section may award reasonable attorneys' fees to the prevailing party. No such action may be brought against a government agency.  (c) The penalties provided in this section shall be cumulative to the remedies or penalties available under all other laws of this State. [L 2006, c 135, pt of §2]
HI Rev Stat § 487N-4 (2021)
2021 Hawaii Revised Statutes|Title 26. Trade Regulation and Practice|487N. Security Breach of Personal Information|487N-4 Reporting requirements.

  §487N-4 Reporting requirements. A government agency shall submit a written report to the legislature within twenty days after discovery of a security breach at the government agency that details information relating to the nature of the breach, the number of individuals affected by the breach, a copy of the notice of security breach that was issued, the number of individuals to whom the notice was sent, whether the notice was delayed due to law enforcement considerations, and any procedures that have been implemented to prevent the breach from reoccurring. In the event that a law enforcement agency informs the government agency that notification may impede a criminal investigation or jeopardize national security, the report to the legislature may be delayed until twenty days after the law enforcement agency has determined that notice will no longer impede the investigation or jeopardize national security. [L 2006, c 135, pt of §2]
HI Rev Stat § 487N-6 (2021)
2021 Hawaii Revised Statutes|Title 26. Trade Regulation and Practice|487N. Security Breach of Personal Information|487N-6 Personal information security; best practices; websites.

 §487N-6 Personal information security; best practices; websites. (a) The council shall identify best practices to assist government agencies in improving security and privacy programs relating to personal information. No later than March 31, 2009, the council shall identify best practices relating to:  (1) Automated tools;  (2) Training;  (3) Processes; and  (4) Applicable standards.  (b) No later than July 31, 2009, the best practices identified by the council shall be posted on each government agency's website in a manner that is readily accessible by employees of the government agency. [L Sp 2008, c 10, pt of §4]
HI Rev Stat § 487N-7 (2021)
2021 Hawaii Revised Statutes|Title 26. Trade Regulation and Practice|487N. Security Breach of Personal Information|487N-7 Personal information system; government agencies; annual report.

  §487N-7 Personal information system; government agencies; annual report. (a) Effective January 1, 2009, any government agency that maintains one or more personal information systems shall submit to the council an annual report on the existence and character of each personal information system added or eliminated since the agency's previous annual report. The annual report shall be submitted no later than September 30 of each year.  (b) The annual report shall include:  (1) The name or descriptive title of the personal information system and its location;  (2) The nature and purpose of the personal information system and the statutory or administrative authority for its establishment;  (3) The categories of individuals on whom personal information is maintained, including:  (A) The approximate number of all individuals on whom personal information is maintained; and  (B) The categories of personal information generally maintained in the system, including identification of records that are:  (i) Stored in computer accessible records; or  (ii) Maintained manually;  (4) All confidentiality requirements relating to:  (A) Personal information systems or parts thereof that are confidential pursuant to statute, rule, or contractual obligation; and  (B) Personal information systems maintained on an unrestricted basis;  (5) Detailed justification of the need for statutory or regulatory authority to maintain any personal information system or part thereof on a confidential basis for all personal information systems or parts thereof that are required by law or rule;  (6) The categories of sources of personal information;  (7) The agency's policies and practices regarding personal information storage, duration of retention of information, and elimination of information from the system;  (8) The uses made by the agency of personal information contained in any personal information system;  (9) The identity of agency personnel, by job classification, and other agencies, persons, or categories to whom disclosures of personal information are made or to whom access to the personal information system may be granted, including the purposes of access and any restrictions on disclosure, access, and redisclosure;  (10) A list identifying all forms used by the agency in the collection of personal information; and  (11) The name, title, business address, and telephone number of the individual immediately responsible for complying with this section.  (c) For purposes of this section:  "Personal information system" means any manual or automated recordkeeping process that contains personal information and the name, personal number, or other identifying particulars of a data subject.  (d) Notwithstanding any other law to the contrary, this report shall be confidential and not disclosed publicly in any form or forum. [L Sp 2008, c 10, pt of §4]
HI Rev Stat § 487R-1 (2021)
2021 Hawaii Revised Statutes|Title 26. Trade Regulation and Practice|487R. Destruction of Personal Information Records|487R-1 Definitions.

  §487R-1 Definitions. As used in this chapter:  "Business" means a sole proprietorship, partnership, corporation, association, or other group, however organized and whether or not organized to operate at a profit. Except as provided in section 487R-2(e), the term includes a financial institution organized, chartered, or holding a license or authorization certificate under the laws of the State, any other state, the United States, or any other country, or the parent or the subsidiary of any such financial institution. The term also includes an entity whose business is records destruction.  "Disposal" means the discarding or abandonment of records containing personal information or the sale, donation, discarding, or transfer of any medium, including computer equipment or computer media, containing records of personal information, or other nonpaper media upon which records of personal information are stored, or other equipment for nonpaper storage of information.  "Government agency" means any department, division, board, commission, public corporation, or other agency or instrumentality of the State or any county.  "Personal information" means an individual's first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted:  (1) Social security number;  (2) Driver's license number or Hawaii identification card number; or   (3) Account number, credit or debit card number, access code, or password that would permit access to an individual's financial account. "Personal information" shall not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. "Encrypted", as used in this definition means the use of an algorithmic process to transform data into a form in which the data is rendered unreadable or unusable without the use of a confidential process or key.  "Records" means any material on which written, drawn, spoken, visual, or electromagnetic information is recorded or preserved, regardless of physical form or characteristics. [L 2006, c 136, pt of §2; am L 2008, c 19, §71]
HI Rev Stat § 487R-3 (2021)
2021 Hawaii Revised Statutes|Title 26. Trade Regulation and Practice|487R. Destruction of Personal Information Records|487R-3 Penalties; civil action.

  §487R-3 Penalties; civil action. (a) Any business that violates any provision of this chapter shall be subject to penalties of not more than $2,500 for each violation. The attorney general or the executive director of the office of consumer protection may bring an action pursuant to this section. No such action may be brought against a government agency.  (b) In addition to any penalty provided for in subsection (a), any business that violates any provision of this chapter shall be liable to the injured party in an amount equal to the sum of any actual damages sustained by the injured party as a result of the violation. The court in any action brought under this section may award reasonable attorneys' fees to the prevailing party. No such action may be brought against a government agency.  (c) The penalties provided in this section shall be cumulative to the remedies or penalties available under all other laws of this State. [L 2006, c 136, pt of §2]
HI Rev Stat § 487R-4 (2021)
2021 Hawaii Revised Statutes|Title 26. Trade Regulation and Practice|487R. Destruction of Personal Information Records|487R-4 Reporting requirements.

  §487R-4 Reporting requirements. A government agency shall submit a written report to the legislature within twenty days after the discovery of a material occurrence of unauthorized access to personal information records in connection with or after its disposal by or on behalf of the government agency. The report shall contain information relating to the nature of the incident, the number of individuals affected by the incident, and any procedures that have been implemented to prevent the incident from reoccurring. In the event that a law enforcement agency informs the government agency that the report may impede a criminal investigation or jeopardize national security, the report to the legislature may be delayed until twenty days after the law enforcement agency has determined that the report will no longer impede the investigation or jeopardize national security. [L 2006, c 136, pt of §2]
HI Rev Stat § 488-1 (2021)
2021 Hawaii Revised Statutes|Title 26. Trade Regulation and Practice|488. Legal Service Plans|488-1 Definitions.

  §488-1 Definitions. As used in this chapter:  "Accumulation or payment of money" or "accumulates funds" means the payment of funds by a member to the plan.  "Commissioner" means the insurance commissioner of the department of commerce and consumer affairs.  "Legal service plan" or "plan" means any arrangement by which a person as defined in section 431:1-212, or entity, not otherwise authorized to engage in the practice of law, offers to provide or arranges for the provision of legal services in exchange for any valuable consideration that is paid to the plan.  "Plan administrator" means those persons who have discretionary authority for the management of the plan or for the collection, management, or disbursement of plan moneys. [L 1976, c 156, pt of §1; am L 1982, c 204, §8; am L 1992, c 19, §1; am L 2008, c 19, §73; am L 2010, c 47, §1(1); am L 2011, c 186, §3] Revision Note  Definitions rearranged. Attorney General Opinions  Prepaid legal service plan whose membership is open to the public is a "group legal service plan". Att. Gen. Op. 86-22.