reglab/statecodes huggingface dataset:
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 25. Health Carrier Good Faith Estimates › 27-2-25-3. "Good Faith Estimate"

Sec. 3. As used in this chapter, "good faith estimate" means a health carrier's reasonable estimate of:
(1) the amount of the cost of a nonemergency health care service that the health carrier will:
(A) pay for; or
(B) reimburse to;
a covered individual; or
(2) the applicable benefit limitations of the nonemergency health care service a covered individual is entitled to receive;
that a health carrier provides upon request to a covered individual for whom a nonemergency health care service has been ordered.
As added by P.L.93-2020, SEC.13.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 25. Health Carrier Good Faith Estimates › 27-2-25-4. "Health Carrier"

Sec. 4. (a) As used in this chapter, "health carrier" means an entity:
(1) that is subject to this title and the administrative rules adopted under this title; and
(2) that enters into a contract to:
(A) provide health care services;
(B) deliver health care services;
(C) arrange for health care services; or
(D) pay for or reimburse any of the costs of health care services.
(b) The term includes the following:
(1) An insurer, as defined in IC 27-1-2-3(x), that issues a policy of accident and sickness insurance, as defined in IC 27-8-5-1(a).
(2) A health maintenance organization, as defined in IC 27-13-1-19.
(3) An administrator (as defined in IC 27-1-25-1(a)) that is licensed under IC 27-1-25.
(4) A state employee health plan offered under IC 5-10-8.
(5) A short term insurance plan (as defined by IC 27-8-5.9-3).
(6) Any other entity that provides a plan of health insurance, health benefits, or health care services.
(c) The term does not include:
(1) an insurer that issues a policy of accident and sickness insurance;
(2) a limited service health maintenance organization (as defined in IC 27-13-34-4); or
(3) an administrator;
that only provides coverage for, or processes claims for, dental or vision care services.
As added by P.L.93-2020, SEC.13.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 25. Health Carrier Good Faith Estimates › 27-2-25-5. "In Network"

Sec. 5. As used in this chapter, "in network", when used in reference to a practitioner, means that the health care services provided by the practitioner are subject to a health carrier's network plan.
As added by P.L.93-2020, SEC.13.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 25. Health Carrier Good Faith Estimates › 27-2-25-6. "Network"

Sec. 6. (a) As used in this chapter, "network" means a group of provider facilities and practitioners that:
(1) provide health care services to covered individuals; and
(2) have agreed to, or are otherwise subject to, maximum limits on the prices for the health care services to be provided to the covered individuals.
(b) The term includes the following:
(1) A network described in subsection (a) that is established pursuant to a contract between an insurer providing coverage under a group health policy and:
(A) individual provider facilities and practitioners;
(B) a preferred provider organization; or
(C) an entity that employs or represents providers, including:
(i) an independent practice association; and
(ii) a physician-hospital organization.
(2) A health maintenance organization, as defined in IC 27-13-1-19.
As added by P.L.93-2020, SEC.13.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 25. Health Carrier Good Faith Estimates › 27-2-25-7. "Network Plan"

Sec. 7. As used in this chapter, "network plan" means a plan of a health carrier that:
(1) requires a covered individual to receive; or
(2) creates incentives, including financial incentives, for a covered individual to receive;
health care services from one (1) or more providers that are under contract with, managed by, or owned by the health carrier.
As added by P.L.93-2020, SEC.13.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 25. Health Carrier Good Faith Estimates › 27-2-25-8. "Nonemergency Health Care Service"

Sec. 8. As used in this chapter, "nonemergency health care service" means a discrete service or series of services ordered by a practitioner for an episode of care for the:
(1) diagnosis;
(2) prevention;
(3) treatment;
(4) cure; or
(5) relief;
of a physical, mental, or behavioral health condition, illness, injury, or disease that is not provided on an emergency or urgent care basis.
As added by P.L.93-2020, SEC.13.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 25. Health Carrier Good Faith Estimates › 27-2-25-9. "Practitioner"

Sec. 9. (a) As used in this chapter, "practitioner" means:
(1) an individual who holds:
(A) an unlimited license, certificate, or registration;
(B) a limited or probationary license, certificate, or registration;
(C) a temporary license, certificate, registration, or permit;
(D) an intern permit; or
(E) a provisional license;
issued by the board (as defined in IC 25-0.5-11-1) regulating the profession in question; or
(2) an entity that:
(A) is owned by, or employs; or
(B) performs billing for professional health care services rendered by;
an individual described in subdivision (1).
(b) The term does not include the following:
(1) A dentist licensed under IC 25-14.
(2) An optometrist licensed under IC 25-24.
(3) A provider facility.
As added by P.L.93-2020, SEC.13. Amended by P.L.202-2021, SEC.17.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 25. Health Carrier Good Faith Estimates › 27-2-25-9.5. "Price"

Sec. 9.5. As used in this chapter, "price" means the negotiated rate between the:
(1) provider facility and practitioner; and
(2) covered individual's primary health carrier;
minus the amount that the health carrier will pay.
As added by P.L.93-2020, SEC.13.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 25. Health Carrier Good Faith Estimates › 27-2-25-10. "Provider"

Sec. 10. As used in this chapter, "provider" means:
(1) a provider facility; or
(2) a practitioner.
As added by P.L.93-2020, SEC.13.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 25. Health Carrier Good Faith Estimates › 27-2-25-11. "Provider Facility"

Sec. 11. As used in this chapter, "provider facility" means any of the following:
(1) A hospital licensed under IC 16-21-2.
(2) An ambulatory outpatient surgical center licensed under IC 16-21-2.
(3) A birthing center licensed under IC 16-21-2.
(4) Except for an urgent care facility (as defined by IC 27-1-46-10.5), a facility that provides diagnostic services to the medical profession or the general public.
(5) A laboratory where clinical pathology tests are carried out on specimens to obtain information about the health of a patient.
(6) A facility where radiologic and electromagnetic images are made to obtain information about the health of a patient.
(7) An infusion center that administers intravenous medications.
As added by P.L.93-2020, SEC.13. Amended by P.L.9-2022, SEC.51; P.L.36-2022, SEC.12; P.L.179-2022(ss), SEC.44.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 25. Health Carrier Good Faith Estimates › 27-2-25-12. Request for Good Faith Estimate; Requirements; Notice; Provision of Information From Practitioner and Provider Facility

Sec. 12. (a) A covered individual may request from the health carrier a good faith estimate of:
(1) the amount of the cost of the nonemergency health care service that the health carrier will:
(A) pay for; or
(B) reimburse to;
the covered individual; or
(2) the applicable benefit limitations of the ordered nonemergency health care service a covered individual is entitled to receive from the health carrier.
(b) If:
(1) a health carrier provides coverage to a covered individual through a network plan; and
(2) the health carrier receives a request for a good faith estimate from a covered individual for whom a nonemergency health care service has been ordered;
the health carrier shall inform the covered individual whether the provider facility in which the nonemergency health care service will be provided is in network and whether each scheduled practitioner who may provide the nonemergency health care service is in network.
(c) A health carrier that receives a request from a covered individual patient under subsection (b) shall, not more than five (5) business days after receiving relevant information, provide to the individual a good faith estimate as described in section 14 of this chapter.
(d) A health carrier must ensure that a good faith estimate states that the estimate provided under this section is only valid for thirty (30) days and that:
(1) the amount that the health carrier will:
(A) pay; or
(B) reimburse;
for or to the covered individual for the nonemergency health care services the individual receives; and
(2) the applicable benefit limitations of the nonemergency health care services the individual will receive;
may vary from the health carrier's good faith estimate based on the individual's medical needs.
(e) A health carrier may not charge an individual for information provided under this section.
(f) A practitioner and provider facility shall provide a health carrier with the information needed by the health carrier to comply with the requirements under this chapter not more than two (2) business days after receiving the request.
As added by P.L.93-2020, SEC.13.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 25. Health Carrier Good Faith Estimates › 27-2-25-13. Provision of Good Faith Estimate; Methods

Sec. 13. A health carrier may provide a good faith estimate to an individual under this chapter:
(1) in a writing delivered to the individual;
(2) by electronic mail; or
(3) through a mobile application or other Internet web based method, if available;
according to the preference expressed by the individual.
As added by P.L.93-2020, SEC.13.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 25. Health Carrier Good Faith Estimates › 27-2-25-14. Requirements of Good Faith Estimate; Provision of Information; Exemption From Penalties

Sec. 14. (a) A good faith estimate provided by a health carrier to an individual under this chapter must:
(1) in the case of an insurer or another health carrier that pays or reimburses the cost of health care services:
(A) provide a summary of the services and material items that the good faith estimate is based on;
(B) include a total figure that is a sum of the amounts referred to in clause (A); and
(C) state the out-of-pocket costs the covered individual will incur, if any, beyond the amount that the health carrier will pay or reimburse; and
(2) in the case of a health maintenance organization or another health carrier that provides health care services:
(A) provide a summary of the applicable benefit limitations of the health care services to which the covered individual is entitled; and
(B) state the out-of-pocket costs the covered individual will incur, if any, beyond being provided the health care services referred to in clause (A).
(b) A practitioner and provider facility shall provide a health carrier with the information needed by the health carrier to comply with the requirements under this chapter not more than two (2) business days after receiving the request.
(c) A health carrier is not subject to the penalties under section 16 of this chapter if:
(1) a provider facility or practitioner fails to provide the health carrier with the information as required under subsection (b);
(2) the health carrier provides the individual with a good faith estimate based on any information that the health carrier has; and
(3) the health carrier provides the individual with an updated good faith estimate after the provider facility or practitioner has provided the information required under subsection (b).
As added by P.L.93-2020, SEC.13.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 25. Health Carrier Good Faith Estimates › 27-2-25-15. Notice on Internet Web Site

Sec. 15. A health carrier that provides an Internet web site for the use of its covered individuals shall ensure that the Internet web site includes a printed notice that:
(1) is designed, lettered, and featured on the Internet web site so as to be conspicuous to and readable by any individual with normal vision who visits the Internet web site; and
(2) states the following, or words to the same effect: "A covered individual may at any time ask the health carrier for an estimate of the amount the health carrier will pay for or reimburse to a covered individual for nonemergency health care services that have been ordered for the covered individual or the applicable benefit limitations of the ordered nonemergency health care services a covered individual is entitled to receive from the health carrier. The law requires that an estimate be provided within 5 business days.".
As added by P.L.93-2020, SEC.13.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 25. Health Carrier Good Faith Estimates › 27-2-25-16. Health Carrier Satisfaction of Good Faith Estimate and Web Site Notice Requirements Through Compliance With Federal Law; Civil Penalty for Noncompliance; Civil Penalty Deposited in Fund

Sec. 16. (a) If a health carrier fails or refuses:
(1) to provide a good faith estimate as required by this chapter; or
(2) to provide notice on the health carrier's Internet web site as required by section 15 of this chapter;
the insurance commissioner may, after notice and hearing under IC 4-21.5, impose on the health carrier a civil penalty of not more than one thousand dollars ($1,000) for each day of noncompliance.
(b) A health carrier may satisfy the requirements of this chapter described in subsection (a)(1) and (a)(2) by complying with the requirements set forth in Section 2799A–1 of the federal Public Health Service Act, as added by Public Law 116-260.
(c) A civil penalty collected under subsection (a) shall be deposited in the department of insurance fund established by IC 27-1-3-28.
As added by P.L.93-2020, SEC.13. Amended by P.L.202-2021, SEC.18.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 25.5. Claims Data › 27-2-25.5-1. Submitting Claims Data; Requirements; Compliance With Federal Law

Sec. 1. (a) Not more than twice annually for a contract holder, a third party administrator, an insurer (as defined in IC 27-1-2-3(x)) that issues a policy of accident and sickness insurance (as defined in IC 27-8-5-1(a)), or a health maintenance organization (as defined in IC 27-13-1-19) that has contracted to administer a self-funded group plan or a fully insured group plan shall provide claims data to the contract holder for which the contract was entered into not later than fifteen (15) business days from a request for the claims data. The claims data must include the following:
(1) The effective date of coverage.
(2) The total number of covered individuals.
(3) The total monthly earned premium.
(4) The total monthly dollar value of paid claims, regardless of the period in which the claims were incurred.
(5) The:
(A) beginning and ending date of the period for which claims were paid; and
(B) percentage of claims that were paid in:
(i) less than thirty (30) days;
(ii) thirty (30) days to sixty (60) days;
(iii) sixty-one (61) days to ninety (90) days; and
(iv) over ninety (90) days.
(6) For groups insuring at least one hundred (100) employees:
(A) the reserve value as of the beginning of the period; and
(B) the reserve value as of the date through which the paid claims data was obtained.
(7) A description of each large or catastrophic claim exceeding fifty thousand dollars ($50,000), including:
(A) the diagnosis;
(B) the dollar amount of the claim;
(C) whether the claim is opened or closed; and
(D) the length of time the claim was open.
(8) Any other claims data requested by the contract holder.
(b) The department may prescribe the format and manner for the submission of the data described in subsection (a) with the purpose of ensuring that the information is provided in an easily readable manner.
(c) Information provided under this section must be provided in accordance with the federal Health Insurance Portability and Accountability Act, including 45 CFR Part 160 and Part 164, Subparts A and E.
As added by P.L.203-2023, SEC.22.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 25.5. Claims Data › 27-2-25.5-2. Violations; Fines

Sec. 2. (a) The department may assess a third party administrator, an insurer, or a health maintenance organization that violates section 1 of this chapter a fine of one thousand dollars ($1,000) per day for which the claims data is provided after the time frame set forth in section 1 of this chapter. A fine collected under this section shall be deposited into the payer affordability penalty fund established by IC 12-15-1-18.5.
(b) A person described in this section may appeal a fine assessed under this section in the manner prescribed by the department.
As added by P.L.203-2023, SEC.22.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 26. Public Forums by Health Carriers › 27-2-26-1. "Health Carrier"

Sec. 1. As used in this chapter, "health carrier" means the following entities:
(1) An insurer, as defined in IC 27-1-2-3(x), that issues a policy of accident and sickness insurance, as defined in IC 27-8-5-1(a).
(2) A health maintenance organization, as defined in IC 27-13-1-19.
(3) A state employee health plan offered under IC 5-10-8.
(4) A short term insurance plan (as defined by IC 27-8-5.9-3).
As added by P.L.151-2021, SEC.15.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 26. Public Forums by Health Carriers › 27-2-26-2. Public Forum; Video Meeting Allowed

Sec. 2. (a) Before December 31 of each year, a health carrier shall hold a public forum in which the health carrier shall:
(1) obtain feedback from the community about the health carrier's performance in the previous year; and
(2) discuss the premiums (as defined in IC 27-1-2-3(w)) charged by the health carrier.
(b) The public forum required under subsection (a) may be held, either all or in part, through an interactive real time audio and video meeting that is accessible to the community through the Internet.
As added by P.L.151-2021, SEC.15.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 26. Public Forums by Health Carriers › 27-2-26-3. Posting of Information; Requirements

Sec. 3. At least fourteen (14) days before the public forum required by this chapter is held, the health carrier shall post on the health carrier's Internet web site the following:
(1) A printed notice that:
(A) is designed, lettered, and featured on the Internet web site in a manner that is conspicuous to and readable by any individual with normal vision who visits the Internet web site;
(B) states the date, time, and location of the public forum; and
(C) states that the purpose of the public forum is to provide members of the community with an opportunity to:
(i) comment on the health carrier's performance in the previous year; and
(ii) discuss the premiums (as defined in IC 27-1-2-3(w)) charged by the health carrier.
(2) The following information concerning the subjects to be discussed at the public forum:
(A) The health carrier's Indiana based profits, if the health carrier is publicly traded.
(B) The premiums (as defined in IC 27-1-2-3(w)) charged by the health carrier.
(C) The health carrier's strategy to lower health care costs.
(D) Any increase in the health carrier's premiums, on average statewide, that occurred in the previous year for each health carrier.
(E) Annual audited financial reports, if required under IC 27-1-3.5-6 and if the health carrier is publicly traded.
As added by P.L.151-2021, SEC.15.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-2. "Authorized Individual"

Sec. 2. As used in this chapter, "authorized individual" means an individual authorized by the licensee to have access to the nonpublic information held by the licensee and its information systems.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-4. "Consumer"

Sec. 4. As used in this chapter, "consumer" means a resident of Indiana whose nonpublic information is in a licensee's possession, custody, or control.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-5. "Cybersecurity Event"

Sec. 5. As used in this chapter, "cybersecurity event" means an event resulting in unauthorized access to or a disruption or misuse of an information system or nonpublic information stored on the information system that has a reasonable likelihood of materially harming a consumer or any material part of the normal operations of the licensee. However, the term does not include the following:
(1) The unauthorized acquisition of encrypted nonpublic information if the encryption, process, or key is not also acquired, released, or used without authorization.
(2) An event in which a licensee has determined that the nonpublic information accessed by an unauthorized person has not been used or released and has been returned or destroyed.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-7. "Encrypted"

Sec. 7. As used in this chapter, "encrypted" means the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-8. "Information Security Program"

Sec. 8. As used in this chapter, "information security program" means the administrative, technical, and physical safeguards that a licensee uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle nonpublic information.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-9. "Information System"

Sec. 9. As used in this chapter, "information system" means either of the following:
(1) A discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of nonpublic information.
(2) Any specialized system, such as industrial or process control systems, telephone switching systems, private exchange systems, and environmental control systems.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-10. "Licensee"

Sec. 10. (a) As used in this chapter, "licensee" means a person that is:
(1) licensed, authorized to operate, or registered; or
(2) required to be licensed, authorized to operate, or registered;
under this title and the rules adopted under this title.
(b) The term does not include any of the following:
(1) A purchasing group or risk retention group that is chartered and licensed in another state.
(2) A person that is:
(A) acting as an assuming insurer; and
(B) domiciled in a state or jurisdiction other than Indiana.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-11. "Multi-Factor Authentication"

Sec. 11. As used in this chapter, "multi-factor authentication" means authentication through verification of at least two (2) of the following types of authentication factors:
(1) Knowledge factors, such as a password.
(2) Possession factors, such as a token or text message on a mobile phone.
(3) Inherence factors, such as a biometric characteristic.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-12. "Nonpublic Information"

Sec. 12. As used in this chapter, "nonpublic information" means electronic information that is not publicly available information and is described in either of the following subdivisions:
(1) Any information concerning a consumer, which because of name, number, personal mark, or other identifier can be used, in combination with any one (1) or more of the following data elements, to identify the consumer:
(A) Social Security number.
(B) Driver's license number or nondriver identification card number.
(C) Financial account number, credit card number, or debit card number.
(D) Any security code, access code, or password that would permit access to a consumer's financial account.
(E) Biometric records.
(2) Any information or data, except age or gender, in any form or medium created by or derived from a health care provider or a consumer that can be used to identify a consumer and relates to:
(A) the past, present, or future physical, mental, or behavioral health or condition of the consumer or a member of the consumer's family;
(B) the provision of health care to the consumer; or
(C) payment for the provision of health care provided to the consumer.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-13. "Publicly Available Information"

Sec. 13. As used in this chapter, "publicly available information" means any information that a licensee has a reasonable basis to believe is lawfully made available to the general public from:
(1) federal, state, or local government records;
(2) widely distributed media; or
(3) disclosures to the general public that are required to be made by federal, state, or local law.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-15. "Third Party Service Provider"

Sec. 15. As used in this chapter, "third party service provider" means a person that contracts with a licensee to maintain, process, store, or otherwise is permitted access to nonpublic information through its provision of services to the licensee.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-16. Information Security Program; Requirements

Sec. 16. (a) A licensee shall develop, implement, and maintain a comprehensive, written information security program that:
(1) is based on the risk assessment required under section 17 of this chapter; and
(2) contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information systems.
(b) An information security program must accomplish the following:
(1) Protect the security and confidentiality of nonpublic information and information systems.
(2) Protect against any threats or hazards to the security or integrity of nonpublic information and information systems.
(3) Protect against unauthorized access to or use of nonpublic information and minimize the likelihood of harm to a consumer.
(4) Define and periodically reevaluate a schedule for retention of nonpublic information and a procedure for its destruction when no longer needed.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-17. Risk Assessment; Requirements

Sec. 17. A licensee shall conduct a risk assessment of its information systems and treatment of nonpublic information by doing the following:
(1) Designating one (1) or more employees, an affiliate, or an outside vendor designated to act on behalf of the licensee information security program.
(2) Identifying reasonably foreseeable internal or external threats that could result in a cybersecurity event, including threats to information systems and nonpublic information held or accessed by third party service providers.
(3) Assessing the likelihood and potential damage of the threats identified in subdivision (2), taking into consideration the sensitivity of the nonpublic information.
(4) Assessing the sufficiency of the policies, procedures, information systems, and other safeguards currently in place to manage the threats identified in subdivision (2), including an assessment of threats in each relevant area of the licensee's operations, including the following:
(A) Employee training and management.
(B) Information systems, including network and software design, and information classification, governance, processing, storage, transmission, and disposal.
(C) Procedures for detecting, preventing, and responding to cybersecurity events or other systems failures.
(5) Implementing information safeguards to manage the threats identified under subdivision (2), and assessing the effectiveness of the safeguards' key controls, systems, and procedures at least one (1) time each year.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-18. Actions Required Based on Risk Assessment Results

Sec. 18. Based on the results of the risk assessment, a licensee shall do the following:
(1) Design its information security program to mitigate the identified risks, commensurate with:
(A) the licensee's size and complexity;
(B) the nature and scope of the licensee's activities; and
(C) the sensitivity of the nonpublic information in the licensee's control.
(2) Determine and implement appropriate security measures, which may include the following:
(A) Placing access controls on information systems, including controls to authenticate and permit only authorized individuals to have access to nonpublic information.
(B) Identifying and managing the data, personnel, devices, systems, and facilities that enable the licensee to achieve business purposes in accordance with their relative importance to business objectives and risk strategy.
(C) Restricting physical access to nonpublic information to authorized individuals only.
(D) Protecting by encryption or other appropriate means all nonpublic information while being transmitted over an external network and all nonpublic information stored on a laptop computer or other portable computing or storage device or media.
(E) Adopting secure development practices for in-house developed applications used by the licensee.
(F) Modifying information systems in accordance with the licensee's information security program.
(G) Using effective controls, which may include multi-factor authentication procedures for any employees accessing nonpublic information.
(H) Regularly testing and monitoring systems and procedures to detect actual and attempted attacks on, or intrusions into, information systems.
(I) Including audit trails within the information security program designed to detect and respond to a cybersecurity event and designed to reconstruct material financial transactions sufficient to support normal operations and obligations of the licensee.
(J) Implementing measures to protect against destruction, loss, or damage of nonpublic information due to environmental hazards, such as fire and water damage or other catastrophes or technological failures.
(K) Developing, implementing, and maintaining procedures for the secure disposal of nonpublic information in any format.
(3) Include cybersecurity risks in the licensee's enterprise risk management process.
(4) Stay informed regarding emerging threats or vulnerabilities.
(5) Use reasonable security measures when sharing information, relative to the character of the sharing and the type of information shared.
(6) Provide personnel with cybersecurity awareness training that is updated as necessary to reflect risks identified in the risk assessment.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-19. Board of Directors; Executive Management

Sec. 19. (a) If the licensee has a board of directors, the board of directors shall require the licensee's executive management or its delegates to develop, implement, and maintain the licensee's information security program.
(b) If the licensee's executive management delegates any of its responsibilities under this section, it shall:
(1) oversee the development, implementation, and maintenance of the licensee's information security program prepared by the delegate; and
(2) receive a report from the delegate concerning:
(A) the overall status of the information security program;
(B) the licensee's compliance with this chapter; and
(C) material matters related to the information security program addressing such issues as:
(i) risk assessment;
(ii) risk management and control decisions;
(iii) third party service provider arrangements;
(iv) results of testing;
(v) cybersecurity events and management's responses to cybersecurity events; and
(vi) recommendations for changes in the information security program.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-20. Incident Response Plan

Sec. 20. (a) As part of its information security program, a licensee shall establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event.
(b) An incident response plan must include the following:
(1) The internal process for responding to a cybersecurity event.
(2) The goals of the incident response plan.
(3) The definition of clear roles, responsibilities, and levels of decision making authority.
(4) External and internal communications and information sharing.
(5) Identification of requirements for the remediation of any identified weaknesses in information systems and associated controls.
(6) Documentation and reporting regarding cybersecurity events and related incident response activities.
(7) The evaluation and revision, as necessary, of the incident response plan.
(c) Annually, not later than April 15, each insurer domiciled in Indiana shall submit to the commissioner a written statement certifying that the insurer is in compliance with the requirements set forth in sections 16 through 19 of this chapter and this section. Each insurer shall maintain for examination by the department all records, schedules, and data supporting this certificate for a period of five (5) years. To the extent an insurer has identified areas, systems, or processes that require material improvement, updating, or redesign, the insurer shall document the identification of the areas, systems, or processes and the remedial efforts planned and underway to address the areas, systems, or processes. The documentation must be available for inspection by the commissioner.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-22. Notice to Ceding Insurers and Commissioner of Cybersecurity Event

Sec. 22. (a) In the case of a cybersecurity event involving nonpublic information that:
(1) is used by a licensee acting as an assuming insurer; or
(2) is in the possession, custody, or control of a licensee that:
(A) is acting as an assuming insurer; and
(B) does not have a direct contractual relationship with the affected consumers;
the assuming insurer shall notify its affected ceding insurers and the commissioner of its state of domicile within three (3) business days after making the determination that a cybersecurity event has occurred and the ceding insurers that have a direct contractual relationship with affected consumers shall fulfill the consumer notification requirements imposed under IC 24-4.9 and any other notification requirements relating to a cybersecurity event imposed under section 21(c) through 21(f) of this chapter.
(b) In the case of a cybersecurity event involving nonpublic information that is in the possession, custody, or control of a third party service provider of a licensee that is an assuming insurer:
(1) the assuming insurer shall notify its affected ceding insurers and the commissioner of its state of domicile within three (3) business days after receiving notice from its third party service provider that a cybersecurity event has occurred; and
(2) the ceding insurers that have a direct contractual relationship with affected consumers shall fulfill the consumer notification requirements imposed under IC 24-4.9 and any other notification requirements relating to a cybersecurity event imposed under section 21(c) through 21(f) of this chapter.
(c) Except for the obligations set forth in this section, a licensee acting as assuming insurer has no notice obligations relating to a cybersecurity event or other data breach under section 21 of this chapter or any other law of Indiana.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-23. Notice to Producers of Cybersecurity Event

Sec. 23. (a) In the case of a cybersecurity event:
(1) that involves nonpublic information:
(A) that is in the possession, custody, or control of a licensee that is an insurer or its third party service provider; and
(B) for which a consumer accessed the insurer's services through an independent insurance producer; and
(2) for which consumer notice is required by IC 24-4.9;
the insurer shall notify the producers of record of all affected consumers of the cybersecurity event not later than the time at which notice is provided to the affected consumers.
(b) The insurer is excused from the obligation set forth in subsection (a):
(1) for any producers who are not authorized by law or contract to sell, solicit, or negotiate on behalf of the insurer; and
(2) in those instances in which the insurer does not have the current producer of record information for an individual consumer.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-24. Powers of Commissioner

Sec. 24. (a) The commissioner may examine and investigate into the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of this chapter. This power is in addition to the other powers the commissioner has under this title. Any investigation or examination of a licensee under this section shall be conducted pursuant to IC 27-1.
(b) Whenever the commissioner has reason to believe that a licensee has been or is engaged in conduct in Indiana that violates this chapter, the commissioner may take action that is necessary or appropriate to enforce this chapter.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-26. Exemptions From Chapter

Sec. 26. (a) A licensee is exempt from sections 16 through 20 of this chapter if the licensee has:
(1) fewer than fifty (50) employees;
(2) less than five million dollars ($5,000,000) in gross annual revenue; or
(3) less than ten million dollars ($10,000,000) in year-end total assets.
(b) A licensee that:
(1) is subject to the federal Health Insurance Portability and Accountability Act (Pub.L. 104–191, 110 Stat. 1936, enacted August 21, 1996); and
(2) has established and maintains an information security program pursuant to that federal act and the regulations, procedures, or guidelines established under that act;
will be considered as meeting the requirements of this chapter, except for the notice requirements described in section 21 of this chapter.
(c) An individual who:
(1) is an employee, agent, representative, or designee of a licensee; and
(2) is also a licensee;
is exempt from sections 16 through 20 of this chapter and need not develop the individual's own information security program to the extent that the individual is covered by the information security program of the licensee of which the individual is an employee, agent, representative, or designee.
(d) A licensee shall be considered to have complied with sections 16 through 20 of this chapter if the licensee is affiliated with a financial institution (as defined in 15 U.S.C. 6809) that maintains an information security program in compliance with the Interagency Guidelines Establishing Standards for Safeguarding Consumer Information adopted under Sections 501 and 505(b) of the Gramm-Leach-Bliley Act (15 U.S.C. 6801 and 6805(b)).
(e) If a licensee ceases to qualify for an exception under subsection (a), (b), (c), or (d), the licensee must comply with sections 16 through 20 of this chapter not more than one hundred eighty (180) days after the licensee ceases to qualify for the exception.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-27. Suspension; Revocation

Sec. 27. If a licensee violates this chapter, the insurance commissioner may, after notice and hearing under IC 4-21.5, suspend or revoke the license, certificate of authority, or registration of the licensee.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-30. Exclusivity

Sec. 30. Notwithstanding any other provision of law, this chapter establishes the exclusive state standards applying to licensees for:
(1) data security;
(2) the investigation of a cybersecurity event; and
(3) notification to the insurance commissioner concerning a cybersecurity event.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-31. Financial Institutions

Sec. 31. The requirements of this chapter do not apply to a financial institution (as defined in 15 U.S.C. 6809), except to the extent the financial institution transacts insurance business.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 27. Insurance Data Security › 27-2-27-32. Affirmative Defense

Sec. 32. (a) A licensee that satisfies the requirements of this chapter is entitled to an affirmative defense to any cause of action sounding in tort that:
(1) is brought under the laws or in the courts of this state; and
(2) alleges that the failure to implement reasonable information security controls resulted in a data breach concerning nonpublic information.
(b) The affirmative defense available under this section does not limit any other affirmative defenses available to a licensee.
As added by P.L.130-2020, SEC.10.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 28. Notice of Material Change › 27-2-28-1. Application of Chapter

Sec. 1. (a) This chapter applies to a personal automobile or homeowner's policy that is issued, delivered, amended, or renewed after June 30, 2024.
(b) This chapter does not apply to notices required by the federal Fair Credit Reporting Act (15 U.S.C. 1681 et seq.).
As added by P.L.226-2023, SEC.20.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 28. Notice of Material Change › 27-2-28-2. "Automobile Policy"

Sec. 2. As used in this chapter, "automobile policy" means a policy providing one (1) or more of the types of insurance described in Class 2(f) of IC 27-1-5-1.
As added by P.L.226-2023, SEC.20.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 28. Notice of Material Change › 27-2-28-3. "Homeowner's Policy"

Sec. 3. As used in this chapter, "homeowner's policy" means a policy that provides:
(1) coverage for:
(A) damage to or the destruction of:
(i) a structure; or
(ii) a unit within a structure;
that is used as a residence by one (1) or more individuals; and
(B) damage to or the loss of personal property that is present in the structure or unit described in clause (A);
caused by perils such as fire, hail, and lightning; and
(2) coverage against the civil liability of the policyholder arising from bodily injury or property damage incurred by others.
As added by P.L.226-2023, SEC.20.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 28. Notice of Material Change › 27-2-28-4. "Insured"

Sec. 4. As used in this chapter, "insured" means an individual who is the first named insured on the declarations page of a personal automobile or homeowner's policy.
As added by P.L.226-2023, SEC.20.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 28. Notice of Material Change › 27-2-28-5. "Insurer"

Sec. 5. As used in this chapter, "insurer" refers to an insurer (as defined in IC 27-1-2-3) that issues a personal automobile or homeowner's policy.
As added by P.L.226-2023, SEC.20.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 28. Notice of Material Change › 27-2-28-6. "Material Change"

Sec. 6. (a) As used in this chapter, "material change" means:
(1) an increase of more than ten percent (10%) over the expiring premium for; or
(2) another adverse or unfavorable change in the terms of coverage or amount of;
insurance in connection with a personal automobile or homeowner's policy.
(b) The term does not include the following:
(1) An increase in the insurer's filed rate plan and automatic inflationary increases.
(2) An additional premium due to a change initiated by the insured, such as:
(A) adding or removing vehicles or drivers;
(B) adding an endorsement;
(C) adding additional coverages;
(D) adding covered premises; or
(E) increasing coverage limits or deductibles.
(3) An additional premium due to a change in risk exposure as a result of the insured's participation in a usage based or telematics insurance program.
(4) Changes resulting from a property inspection.
As added by P.L.226-2023, SEC.20.
2023 Indiana Code › Title 27. Insurance › Article 2. Powers and Duties of Insurers › Chapter 28. Notice of Material Change › 27-2-28-7. "Personal Automobile or Homeowner's Policy"

Sec. 7. As used in this chapter, "personal automobile or homeowner's policy" means:
(1) an automobile policy; or
(2) a homeowner's policy;
that is underwritten on an individual basis for an individual, family, or household.
As added by P.L.226-2023, SEC.20.