reglab/statecodes huggingface dataset:
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3-409 Supplemental provisions; rules; exceptions.

§431:3-409 Supplemental provisions; rules; exceptions.
(a) This part is supplemental to any other laws of this State, and shall not preclude or limit any other powers or duties of the commissioner under those laws, including but not limited to article 15.
(b) The commissioner may adopt rules pursuant to chapter 91 necessary for the implementation of this part.
(c) The commissioner may exempt from the application of this part any domestic property and casualty insurer that:
(1) Writes direct business in this State;
(2) Writes direct annual premiums of $2,000,000 or less; and
(3) Assumes no reinsurance in excess of five per cent of direct premiums written.
(d) The commissioner may exempt from the application of this part any domestic benefit society or health maintenance organization that:
(1) Writes direct business only in this State;
(2) Assumes no reinsurance in excess of five per cent of direct premiums written; and
(3) Writes direct annual premiums for comprehensive medical business of $2,000,000 or less; or
(4) Is a benefit society or health maintenance organization that covers fewer than two-thousand lives. [L 1994, c 190, pt of §1; am L 1995, c 61, §2 as superseded by c 232, §4; am L 1997, c 75, §12; am L 1999, c 128, §2; am L 2011, c 80, §6]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3-410 Foreign insurers.

§431:3-410 Foreign insurers.
(a) Any foreign insurer, upon the written request of the commissioner, shall submit to the commissioner a risk-based capital report as of the end of the calendar year just ended by the later of:
(1) The date a risk-based capital report would be required to be filed by a domestic insurer under this part; or
(2) Fifteen days after the request is received by the foreign insurer.
Any foreign insurer, at the written request of the commissioner, shall promptly submit to the commissioner a copy of any risk-based capital plan that is filed with the insurance commissioner of any other state.
(b) In the event of a company action level event, regulatory action level event, or authorized control level event with respect to any foreign insurer as determined under the risk-based capital statute applicable in the state of domicile of the insurer, or if no risk-based capital provision is in force in that state, under this part, if the insurance commissioner of the state of domicile of the foreign insurer fails to require the foreign insurer to file a risk-based capital plan in the manner specified under the risk-based capital law of that state, or if no risk-based capital provision is in force in that state, under section 431:3-403, the commissioner may require the foreign insurer to file a risk-based capital plan with the commissioner. In this event, the failure of the foreign insurer to file a risk-based capital plan with the commissioner shall be grounds to order the insurer to cease and desist from writing new insurance business in this State.
(c) In the event of a mandatory control level event with respect to any foreign insurer, if no domiciliary receiver has been appointed with respect to the foreign insurer under the rehabilitation and liquidation statute applicable in the state of domicile of the foreign insurer, the commissioner may make application to the circuit court of the first judicial circuit of this State under article 15 with respect to the liquidation of property of foreign insurers found in this State, and the occurrence of the mandatory control level event shall be considered adequate grounds for the application. [L 1994, c 190, pt of §1; am L 1995, c 61, §2 as superseded by c 232, §4; am L 1997, c 75, §13; am L 1999, c 128, §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3-411 Severability.

§431:3-411 Severability.
If any provision of this part, or the application thereof to any person or circumstance, is held invalid, such determination shall not affect the provisions or application of this part which can be given effect without the invalid provision or application, and to that end the provisions of this part are severable. [L 1994, c 190, pt of §1; am L 1995, c 61, §2 as superseded by c 232, §4; am L 1999, c 128, §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3-412 Notices.

§431:3-412 Notices.
All notices by the commissioner to an insurer which may result in regulatory action hereunder shall be effective upon dispatch if transmitted by registered or certified mail or, in the case of any other transmission, shall be effective upon the insurer's receipt of the notice. [L 1994, c 190, pt of §1; am L 1995, c 61, §2 as superseded by c 232, §4; am L 1999, c 128, §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3-413 Phase-in provision.

§431:3-413 Phase-in provision.
(a) For risk-based capital reports required to be filed by life or health insurers with respect to 1994, the following requirements shall apply in lieu of sections 431:3-403, 431:3-404, 431:3-405, and 431:3-406:
(1) In the event of a company action level event with respect to a domestic insurer, the commissioner shall take no regulatory action hereunder;
(2) In the event of a regulatory action level event under section 431:3-404(a)(1), (2), or (3), the commissioner shall take the actions required under section 431:3-403;
(3) In the event of a regulatory action level event under section 431:3-404(a)(4), (5), (6), (7), (8), or (9), or an authorized control level event, the commissioner shall take the actions required under section 431:3-404 with respect to the insurer; and
(4) In the event of a mandatory control level event with respect to an insurer, the commissioner shall take the actions required under section 431:3-405 with respect to the insurer.
(b) For risk-based capital reports required to be filed by property and casualty insurers with respect to 1997, the following requirements shall apply in lieu of sections 431:3-403, 431:3-404, 431:3-405, and 431:3-406:
(1) In the event of a company action level event with respect to a domestic insurer, the commissioner shall take no regulatory action hereunder;
(2) In the event of a regulatory action level event under section 431:3-404(a)(1), (2), or (3), the commissioner shall take the actions required under section 431:3-403;
(3) In the event of a regulatory action level event under section 431:3-404(a)(4), (5), (6), (7), (8), or (9), or an authorized control level event, the commissioner shall take the actions required under section 431:3-404 with respect to the insurer; and
(4) In the event of a mandatory control level event with respect to an insurer, the commissioner shall take the actions required under section 431:3-405 with respect to the insurer. [L 1994, c 190, pt of §1; am L 1995, c 61, §2 as superseded by c 232, §4; am L 1997, c 75, §14; am L 1999, c 128, §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3-414 Immunity.

§431:3-414 Immunity.
There shall be no liability on the part of, and no cause of action shall rise against, the State, the commissioner, or the insurance division or its employees, agents, or independent contractors for any action taken by them in the performance of their powers and duties under this part. [L 1997, c 75, §1]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3A-101 Purpose; scope; applicability.

Note
Personal information protection requirements. L Sp 2008, c 10, § §7 to 15.
Cross References
Information privacy and security council; personal information security, see § §487N-5 to 487N-7.
Personal information policy and oversight responsibilities for government agencies, see §487J-5.
PART I. GENERAL PROVISIONS
§431:3A-101 Purpose; scope; applicability.
(a) This article governs the treatment of nonpublic personal financial information about individuals by all insurance licensees. This article:
(1) Requires licensees to provide notice to individuals about its privacy policies and practices;
(2) Establishes the conditions under which a licensee may disclose nonpublic personal financial information about individuals to affiliates and nonaffiliated third parties; and
(3) Provides methods for individuals to prevent a licensee from disclosing that information.
(b) This article shall apply to nonpublic personal financial information about individuals who obtain or are claimants or beneficiaries of a licensee's products or services primarily for personal, family, or household purposes. This article shall not apply to information about companies or about individuals that obtain products or services for business, commercial, or agricultural purposes.
(c) Notice provisions under part II of this article shall not apply to licensees in liquidation or receivership. [L 2001, c 220, pt of §1]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3A-201 Initial privacy notice to consumers required.

§431:3A-201 Initial privacy notice to consumers required.
(a) A licensee shall provide a clear and conspicuous notice that accurately reflects its privacy policies and practices to a consumer:
(1) Not later than when the licensee establishes a customer relationship, except as provided in subsection (d); and
(2) Before the licensee discloses any nonpublic personal financial information about the consumer to any nonaffiliated third party, if the licensee makes a disclosure other than as authorized by sections 431:3A-402 and 431:3A-403.
(b) A licensee shall not be required to provide an initial notice to a consumer under subsection (a)(2) if:
(1) The licensee does not disclose any nonpublic personal financial information about the consumer to any nonaffiliated third party, other than as authorized by sections 431:3A-402 and 431:3A-403, and the licensee does not have a customer relationship with the consumer; provided that for purpose of this paragraph, a licensee establishes a customer relationship at the time the licensee and the consumer enter into a continuing relationship; and
(2) A notice has been provided by an affiliated licensee, if the notice clearly identifies all licensees to whom the notice applies and is accurate with respect to the licensee and the other institutions.
(c) When an existing customer obtains a new insurance product or service from a licensee that is to be used primarily for personal, family, or household purposes, the licensee shall be deemed to satisfy the initial notice requirements of subsection (a) if:
(1) The licensee provides a revised privacy notice, under section 431:3A-205, that covers the customer's new insurance product or service; or
(2) The initial, revised, or annual notice that the licensee most recently provided to that customer was accurate with respect to the new insurance product or service, in which case the licensee does not need to provide a new privacy notice under subsection (a).
(d) A licensee may provide the initial notice under subsection (a)(1) within a reasonable time after the licensee establishes a customer relationship if:
(1) Establishing the customer relationship is not at the customer €™s election; or
(2) Providing notice not later than when the licensee establishes a customer relationship would substantially delay the customer €™s transaction and the customer agrees to receive the notice at a later time.
(e) When a licensee is required to deliver an initial privacy notice by this section, the licensee shall deliver it according to section 431:3A-206. If the licensee uses a short-form initial notice for noncustomers according to section 431:3A-203(c), the licensee may deliver its privacy notice according to section 431:3A-206. [L 2001, c 220, pt of §1; am L 2003, c 212, §31]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3A-202 Annual privacy notice to customers required.

§431:3A-202 Annual privacy notice to customers required.
(a) Except as provided in subsection (b), a licensee shall provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices not less than annually during the continuation of the customer relationship. For the purposes of this section, "annually" means at least once in any period of twelve consecutive months during which that relationship exists. A licensee may define the twelve-consecutive-month period, but the licensee shall apply it to the customer on a consistent basis.
(b) A licensee shall not be required to provide an annual notice to a customer under this section if the licensee:
(1) Has provided nonpublic personal financial information to nonaffiliated third parties in accordance with section 431:3A-401, 431:3A-402, or 431:3A-403; and
(2) Has not changed its policies and practices relating to the disclosure of nonpublic personal information from the most recent notice sent to customers in accordance with this section or section 431:3A-201.
(c) A licensee shall not be required to provide an annual notice to a former customer. A former customer is an individual with whom a licensee no longer has a continuing relationship.
(d) If a licensee is required under this section to deliver an annual privacy notice, the licensee shall deliver it according to section 431:3A-206. [L 2001, c 220, pt of §1; am L 2019, c 200, §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3A-204 Form of opt out notice to consumers and opt out methods.

§431:3A-204 Form of opt out notice to consumers and opt out methods.
(a) A licensee shall provide an opt out notice to each of the licensee's consumers that is clear and conspicuous and accurately explains the right to opt out. The notice shall state:
(1) That the licensee discloses or reserves the right to disclose nonpublic personal financial information about its consumer to a nonaffiliated third party;
(2) That the consumer has the right to opt out of that disclosure; and
(3) A reasonable means by which the consumer may exercise the opt out right.
(b) A licensee may provide the opt out notice together with or on the same written or electronic form as the initial notice the licensee provides in accordance with section 431:3A-201.
(c) If a licensee provides the opt out notice later than required for the initial notice in accordance with section 431:3A-201, the licensee shall also include a copy of the initial notice with the opt out notice in writing or, if the consumer agrees, electronically.
(d) If two or more consumers jointly obtain an insurance product or service from a licensee, the licensee may provide a single opt out notice. The licensee €™s opt out notice shall explain that any of the joint consumers may exercise the right to opt out; provided that the licensee may:
(1) Treat an opt out direction by a joint consumer as applying to all of the associated joint consumers; or
(2) Permit each joint consumer to opt out separately; provided that if a licensee permits each joint consumer to opt out separately, the licensee shall permit one of the joint consumers to opt out on behalf of all of the joint consumers.
A licensee may not require all joint consumers to opt out before it implements any opt out direction.
(e) A licensee shall comply with a consumer €™s opt out direction as soon as reasonably practicable after the licensee receives it.
(f) A consumer may exercise the right to opt out at any time.
(g) A consumer €™s direction to opt out under this section shall be effective until the consumer revokes it in writing or, if the consumer agrees, electronically. When a customer relationship terminates, the customer €™s opt out direction shall continue to apply to the nonpublic personal financial information that the licensee collected during or related to that relationship. If the individual subsequently establishes a new customer relationship with the licensee, the opt out direction that applied to the former relationship shall not apply to the new relationship.
(h) If a licensee is required to deliver an opt out notice by this section, the licensee shall deliver it in accordance with section 431:3A-206. [L 2001, c 220, pt of §1]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3A-205 Revised privacy notices.

§431:3A-205 Revised privacy notices.
(a) Except as otherwise provided in this article, a licensee shall not, directly or through an affiliate, disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party other than as described in the initial notice that the licensee provided to that consumer under section 431:3A-201, unless:
(1) The licensee has provided to the consumer a clear and conspicuous revised notice that accurately describes its policies and practices;
(2) The licensee has provided to the consumer a new opt out notice;
(3) The licensee has given the consumer a reasonable opportunity, before the licensee discloses the information to the nonaffiliated third party, to opt out of the disclosure; and
(4) The consumer does not opt out.
(b) If a licensee is required to deliver a revised privacy notice under subsection (a), the licensee shall deliver it in accordance with section 431:3A-206. [L 2001, c 220, pt of §1]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3A-206 Delivery.

§431:3A-206 Delivery.
(a) A licensee shall provide any notices required under this article so that each consumer can reasonably be expected to receive actual notice in writing or, if the consumer agrees, electronically.
(b) A licensee may reasonably expect that a customer will receive actual notice of the licensee's annual privacy notice if:
(1) The customer uses the licensee's web site to access insurance products and services electronically and agrees to receive notices at the web site and the licensee posts its current privacy notice continuously in a clear and conspicuous manner on the web site; or
(2) The customer has requested that the licensee refrain from sending any information regarding the customer relationship, and the licensee's current privacy notice remains available to the customer upon request.
(c) A licensee shall not provide any notice required under this article solely by oral explanation of the notice, either in person or over the telephone.
(d) For customers only, a licensee shall provide the initial notice required by section 431:3A-201(a), the annual notice required by section 431:3A-202(a), and the revised notice required by section 431:3A-205, so that the customer can retain them or obtain them later in writing or, if the customer agrees, electronically.
(e) A licensee may provide a joint notice from the licensee and one or more of its affiliates or other financial institutions, as identified in the notice, if the notice is accurate with respect to the licensee and the other institutions. A licensee also may provide a notice on behalf of another financial institution.
(f) If two or more consumers jointly obtain an insurance product or service from a licensee, the licensee may satisfy the initial, annual, and revised notice requirements of sections 431:3A-201(a), 431:3A-202(a), and 431:3A-205(a), by providing one notice to those consumers jointly. [L 2001, c 220, pt of §1]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3A-301 Limits on disclosure of nonpublic personal financial information to nonaffiliated third parties.

§431:3A-301 Limits on disclosure of nonpublic personal financial information to nonaffiliated third parties.
(a) Except as otherwise authorized under this article, a licensee may not disclose, directly or through any affiliate, any nonpublic personal financial information about a consumer to a nonaffiliated third party unless:
(1) The licensee has provided to the consumer an initial notice as required under section 431:3A-201;
(2) The licensee has provided to the consumer an opt out notice as required under section 431:3A-204;
(3) The licensee has given the consumer a reasonable opportunity, before it discloses the information to the nonaffiliated third party, to opt out of the disclosure; and
(4) The consumer does not opt out.
(b) A licensee shall comply with this section, whether or not the licensee and the consumer have established a customer relationship. If a licensee fails to comply with this section, the licensee may not disclose, directly or through any affiliate, any nonpublic personal financial information about a consumer that the licensee has collected, whether or not the licensee collected it before or after receiving the direction to opt out from the consumer.
(c) A licensee may allow a consumer to select certain nonpublic personal financial information or certain nonaffiliated third parties with respect to which the consumer wishes to opt out. [L 2001, c 220, pt of §1]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3A-302 Limits on redisclosure and reuse of nonpublic personal financial information.

§431:3A-302 Limits on redisclosure and reuse of nonpublic personal financial information.
(a) If a licensee receives nonpublic personal financial information from a nonaffiliated financial institution under an exception in section 431:3A-402 or 431:3A-403, the licensee's disclosure and use of that information shall be as follows:
(1) The licensee may disclose the information to the affiliates of the financial institution from which the licensee received the information;
(2) The licensee may disclose the information to its affiliates who may disclose and use the information only to the extent that the licensee may disclose and use the information; and
(3) The licensee may disclose and use the information pursuant to an exception under section 431:3A-402 or 431:3A-403, in the ordinary course of business to carry out the activity covered by the exception under which the licensee received the information.
(b) If a licensee receives nonpublic personal financial information from a nonaffiliated financial institution other than under an exception in section 431:3A-402 or 431:3A-403, the licensee may disclose the information only:
(1) To the affiliates of the financial institution from which the licensee received the information;
(2) To its affiliates who may disclose the information only to the extent that the licensee may disclose the information; and
(3) To any other person, if the disclosure would be lawful if made directly to that person by the financial institution from which the licensee received the information.
(c) If a licensee discloses nonpublic personal financial information to a nonaffiliated third party under an exception in section 431:3A-402 or 431:3A-403, the third party may disclose and use that information, as follows:
(1) Disclose to the licensee's affiliates;
(2) Disclose to its affiliates, who may disclose and use the information only to the extent that the third party may disclose and use the information; and
(3) Disclose and use the information pursuant to an exception under section 431:3A-402 or 431:3A-403 in the ordinary course of business to carry out the activity covered by the exception under which it received the information.
(d) If a licensee discloses nonpublic personal financial information to a nonaffiliated third party other than under an exception under section 431:3A-402 or 431:3A-403, the third party may disclose the information only:
(1) To the licensee's affiliates;
(2) To the third party's affiliates who may disclose the information only to the extent the third party can disclose the information; and
(3) To any other person, if the disclosure would be lawful if the licensee made it directly to that person. [L 2001, c 220, pt of §1; am L 2003, c 212, §32]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3A-303 Limits on sharing account number information for marketing purposes.

§431:3A-303 Limits on sharing account number information for marketing purposes.
(a) A licensee shall not disclose, directly or through an affiliate other than to a consumer reporting agency, a policy number or similar form of access number or access code for a consumer €™s policy or transaction account to any nonaffiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer.
(b) Subsection (a) does not apply if a licensee discloses a policy number or similar form of access number or access code:
(1) To the licensee €™s service provider solely in order to perform marketing for the licensee €™s own products or services, if the service provider is not authorized to directly initiate charges to the account;
(2) To a licensee who is a producer solely in order to perform marketing for the licensee €™s own products or services; or
(3) To a participant in an affinity or similar program if the participants in the program are identified to the customer when the customer enters into the program. [L 2001, c 220, pt of §1]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3A-401 Exception to opt out requirements for disclosure of nonpublic personal financial information for service providers and for joint marketing.

§431:3A-401 Exception to opt out requirements for disclosure of nonpublic personal financial information for service providers and for joint marketing.
(a) The opt out requirements in sections 431:3A-204 and 431:3A-301 shall not apply if a licensee provides nonpublic personal financial information to a nonaffiliated third party to perform services for the licensee or functions on the licensee €™s behalf, if the licensee:
(1) Provides the initial notice in accordance with section 431:3A-201; and
(2) Enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information, including use under an exception in sections 431:3A-402 and 431:3A-403 in the ordinary course of business to carry out those purposes.
(b) The services a nonaffiliated third party performs for a licensee under subsection (a) include marketing of the licensee €™s own products or services or marketing of financial products or services offered pursuant to joint agreements between the licensee and one or more financial institutions.
(c) For purposes of this section, "joint agreement" means a written contract pursuant to which a licensee and one or more financial institutions jointly offer, endorse, or sponsor a financial product or service. [L 2001, c 220, pt of §1]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3A-501 Protection of Fair Credit Reporting Act.

§431:3A-501 Protection of Fair Credit Reporting Act.
Nothing in this article shall be construed to modify, limit, or supersede the federal Fair Credit Reporting Act, Title 15 United States Code section 1681, et seq., as amended, and no inference shall be drawn on the basis of the provisions of this article regarding whether information is transaction or experience information under Title 15 United States Code section 602, et seq., as amended. [L 2001, c 220, pt of §1]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3A-502 Nondiscrimination.

§431:3A-502 Nondiscrimination.
A licensee shall not unfairly discriminate against any consumer or customer because that consumer or customer has opted out from the disclosure of nonpublic personal financial information under this article. [L 2001, c 220, pt of §1]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3A-503 Violation.

§431:3A-503 Violation.
A violation of this article shall be deemed an unfair method of competition or unfair or deceptive trade act or practice in the business of insurance in violation of section 431:13-102. [L 2001, c 220, pt of §1]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3B-102 Powers of the commissioner.

§431:3B-102 Powers of the commissioner.
(a) The licensee's regulator shall have the power to examine and investigate the affairs of any licensee to determine whether the licensee has been or is engaged in any conduct in violation of this article.
(b) Any examination or investigation of a licensee domiciled in the State shall be conducted pursuant to section 431:2-301.7.
(c) Whenever the commissioner has reason to believe that a licensee has been or is engaged in conduct in the State that violates this article, the commissioner may take action that is necessary or appropriate to enforce the provisions of this article. [L 2021, c 112, pt of §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3B-104 Exceptions.

§431:3B-104 Exceptions.
(a) The following exceptions shall apply to this article:
(1) A licensee with fewer than ten employees, including any independent contractors, shall be exempt from part II;
(2) A licensee subject to the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, that has established and maintains an information security program pursuant to the statutes, rules, regulations, procedures, or guidelines established thereunder shall be considered to have met the requirements of part II of this article; provided that the licensee is compliant with and submits a written statement certifying its compliance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191; and
(3) An employee, agent, representative, or designee of a licensee, who is also a licensee, shall be exempt from part II of this article and shall not be required to develop its own information security program; provided that the employee, agent, representative, or designee is covered by the information security program of the other licensee.
(b) In the event that a licensee ceases to qualify for an exception pursuant to this section, the licensee shall have one hundred eighty days to comply with this article. [L 2021, c 112, pt of §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3B-106 Private cause of action.

§431:3B-106 Private cause of action.
This article shall not be construed to create or imply a private cause of action for any violation of its provisions, and it shall not be construed to curtail a private cause of action that would otherwise exist in the absence of this article. [L 2021, c 112, pt of §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3B-201 Implementation of an information security program.

§431:3B-201 Implementation of an information security program.
Commensurate with the size and complexity of the licensee, the nature and scope of the licensee's activities, including its use of third-party service providers, and the sensitivity of the nonpublic information used by the licensee or in the licensee's possession, custody, or control, each licensee shall develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment and that contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system. [L 2021, c 112, pt of §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3B-202 Objectives of the information security program; risk assessment.

§431:3B-202 Objectives of the information security program; risk assessment.
(a) A licensee's information security program shall be designed to:
(1) Protect the security and confidentiality of nonpublic information and the security of the information system;
(2) Protect against any threats or hazards to the security or integrity of nonpublic information and the information system;
(3) Protect against unauthorized access to or use of nonpublic information, and minimize the likelihood of harm to any consumer; and
(4) Define and periodically reevaluate a schedule for retention of nonpublic information and a mechanism for its destruction when no longer needed.
(b) Regarding risk assessment, the licensee shall:
(1) Designate one or more employees, an affiliate, or a third-party service provider to act on behalf of the licensee who is responsible for the information security program;
(2) Identify reasonably foreseeable internal or external threats that could result in unauthorized access, transmission, disclosure, misuse, alteration, or destruction of nonpublic information, including the security of information systems and nonpublic information that are accessible to or held by third-party service providers;
(3) Assess the likelihood and potential damage of the reasonably foreseeable internal or external threats, taking into consideration the sensitivity of the nonpublic information;
(4) Assess the sufficiency of policies, procedures, information systems, and other safeguards in place to manage the reasonably foreseeable internal or external threats, including consideration of threats in each relevant area of the licensee's operations, including:
(A) Employee training and management;
(B) Information systems, including network and software design, as well as information classification, governance, processing, storage, transmission, and disposal; and
(C) Detecting, preventing, and responding to attacks, intrusions, or other systems failures; and
(5) Implement information safeguards to manage the threats identified in its ongoing assessment, and no less than annually, assess the effectiveness of the safeguards' key controls, systems, and procedures. [L 2021, c 112, pt of §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3B-203 Risk management.

§431:3B-203 Risk management.
Based on its risk assessment, the licensee shall:
(1) Design its information security program to mitigate the identified risks, commensurate with the size and complexity of the licensee's activities, including its use of third-party service providers, and the sensitivity of the nonpublic information used by the licensee or in the licensee's possession, custody, or control;
(2) Determine which security measures listed in this paragraph are appropriate and implement those security measures:
(A) Place access controls on information systems, including controls to authenticate and permit access only to authorized individuals to protect against the unauthorized acquisition of nonpublic information;
(B) Identify and manage the data, personnel, devices, systems, and facilities that enable the licensee to achieve business purposes in accordance with their relative importance to business objectives and the licensee's risk strategy;
(C) Restrict access at physical locations containing nonpublic information only to authorized individuals;
(D) Protect by encryption or other appropriate means, all nonpublic information while being transmitted over an external network and all nonpublic information stored on a laptop computer or other portable computing or storage device or media;
(E) Adopt secure development practices for in-house developed applications used by the licensee and procedures for evaluating, assessing, or testing the security of externally developed applications used by the licensee;
(F) Modify the information system in accordance with the licensee's information security program;
(G) Use effective controls, which may include multi-factor authentication procedures for any individual accessing nonpublic information;
(H) Regularly test and monitor systems and procedures to detect actual and attempted attacks on, or intrusions into, information systems;
(I) Include audit trails within the information security program designed to detect and respond to cybersecurity events and reconstruct material financial transactions sufficient to support normal operations and obligations of the licensee;
(J) Implement measures to protect against destruction, loss, or damage of nonpublic information due to environmental hazards, such as fire and water damage or other catastrophes or technological failures; and
(K) Develop, implement, and maintain procedures for the secure disposal of nonpublic information in any format;
(3) Include cybersecurity risks in the licensee's enterprise risk management process;
(4) Stay informed regarding emerging threats or vulnerabilities and use reasonable security measures when sharing information relative to the character of the sharing and the type of information shared; and
(5) Provide its personnel with cybersecurity awareness training that is updated as necessary to reflect risks identified by the licensee in the risk assessment. [L 2021, c 112, pt of §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3B-204 Oversight by board of directors.

§431:3B-204 Oversight by board of directors.
If the licensee has a board of directors, the board or an appropriate committee of the board shall, at a minimum:
(1) Require the licensee's executive management or its delegates to develop, implement, and maintain the licensee's information security program;
(2) Require the licensee's executive management or its delegates to report in writing at least annually, the following information:
(A) The overall status of the information security program and the licensee's compliance with this article; and
(B) Material matters related to the information security program, addressing issues such as risk assessment, risk management and control decisions, third-party service provider arrangements, results of testing, cybersecurity events or violations and management's responses thereto, and recommendations for changes in the information security program; and
(3) If executive management delegates any of its responsibilities under this part, it shall oversee the development, implementation, and maintenance of the licensee's information security program prepared by the delegate and shall receive a report from the delegate complying with the requirements of the report to the board of directors specified in paragraph (2). [L 2021, c 112, pt of §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3B-205 Oversight of third-party service provider arrangements.

§431:3B-205 Oversight of third-party service provider arrangements.
A licensee shall:
(1) Exercise due diligence in selecting its third-party service provider; and
(2) Where appropriate, require a third-party service provider to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to or held by the third-party service provider; provided that encrypted nonpublic information is not accessible to or held by the third-party service provider within the meaning of this paragraph if the third-party service provider does not possess the associated protective process or key necessary to assign meaning to the nonpublic information. [L 2021, c 112, pt of §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3B-206 Program adjustments.

§431:3B-206 Program adjustments.
The licensee shall monitor, evaluate, and adjust, as appropriate, the information security program consistent with any relevant changes in technology, the sensitivity of its nonpublic information, internal or external threats to information, and the licensee's own changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to information systems. [L 2021, c 112, pt of §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3B-207 Incident response plan.

§431:3B-207 Incident response plan.
(a) As part of its information security program, each licensee shall establish a written incident response plan designed to promptly respond to and recover from any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in its possession, the licensee's information systems, or the continuing functionality of any aspect of the licensee's business or operations.
(b) The incident response plan shall address the following areas:
(1) The internal process for responding to a cybersecurity event;
(2) The goals of the incident response plan;
(3) The definition of clear roles, responsibilities, and levels of decision-making authority;
(4) External and internal communications and information sharing;
(5) Identification of requirements for the remediation of any identified weaknesses in information systems and associated controls;
(6) Documentation and reporting regarding cybersecurity events and related incident response activities; and
(7) The evaluation and revision, as necessary, of the incident response plan following a cybersecurity event. [L 2021, c 112, pt of §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3B-208 Annual certification to commissioner

§431:3B-208 Annual certification to commissioner
. (a) Each insurer domiciled in the State shall annually submit to the commissioner a written statement by March 31, certifying that the insurer is in compliance with the requirements set forth in this part.
(b) Each insurer shall maintain all records, schedules, and data supporting this certificate for a period of five years for examination by the commissioner.
(c) To the extent an insurer has identified areas, systems, or processes that require material improvement, updating, or redesign, the insurer shall document the identification and the remedial efforts planned and underway to address those areas, systems, or processes. The documentation shall be available for inspection by the commissioner. [L 2021, c 112, pt of §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3B-301 Investigation of a cybersecurity event.

§431:3B-301 Investigation of a cybersecurity event.
(a) If the licensee learns that a cybersecurity event has or may have occurred, the licensee or third-party service provider designated to act on behalf of the licensee shall conduct a prompt investigation.
(b) During the investigation, the licensee or third-party service provider designated to act on behalf of the licensee shall, at a minimum, determine as much of the following information as possible:
(1) Whether a cybersecurity event has occurred;
(2) The nature and scope of the cybersecurity event; and
(3) Any nonpublic information that may have been involved in the cybersecurity event.
The licensee or third-party service provider designated to act on behalf of the licensee shall perform or oversee reasonable measures to restore the security of the information systems compromised in the cybersecurity event to prevent further unauthorized acquisition, release, or use of nonpublic information in the licensee's possession, custody, or control.
(c) If the licensee provides nonpublic information to a third-party service provider and learns that a cybersecurity event has or may have impacted the licensee's nonpublic information in a system maintained by a third-party service provider, the licensee shall meet the requirements of subsection (b) or confirm and document that the third-party service provider has met the requirements of subsection (b).
(d) The licensee shall maintain records concerning all cybersecurity events for a period of at least five years from the date of the cybersecurity event and shall produce those records upon demand of the commissioner. [L 2021, c 112, pt of §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3B-303 Notification to consumers.

§431:3B-303 Notification to consumers.
The
licensee shall comply with chapter 487N, as applicable, and provide a copy of the notice sent to consumers under chapter 487N to the commissioner when a licensee is required to notify the commissioner under section 431:3B-302. [L 2021, c 112, pt of §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3B-304 Notice regarding cybersecurity events of third-party service providers.

§431:3B-304 Notice regarding cybersecurity events of third-party service providers.
(a) In the case of a cybersecurity event impacting a licensee's nonpublic information in a system maintained by a third-party service provider, of which the licensee has become aware, the licensee shall treat the event as it would under section 431:3B-302 unless the third-party service provider provides the notice required under section 431:3B-302.
(b) The computation of the licensee's deadlines shall begin on the day after the third-party service provider notifies the licensee of the cybersecurity event or the licensee otherwise has actual knowledge of the cybersecurity event, whichever is sooner.
(c) Nothing in this article shall prevent or abrogate an agreement between a licensee and another licensee, a third-party service provider, or any other party to fulfill any of the investigation requirements imposed under section 431:3B-301 or notice requirements imposed under this part. [L 2021, c 112, pt of §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3B-305 Notice regarding cybersecurity events of reinsures to insurers.

§431:3B-305 Notice regarding cybersecurity events of reinsures to insurers.
(a) In the case of a cybersecurity event involving nonpublic information that is used by the licensee that is acting as an assuming insurer or in the possession, custody, or control of a licensee that is acting as an assuming insurer and that does not have a direct contractual relationship with the affected consumers, the assuming insurer shall notify its affected ceding insurers and the commissioner of its state of domicile within three business days of making the determination that a cybersecurity event has occurred.
(b) In the case of a cybersecurity event involving nonpublic information that is in the possession, custody, or control of a third-party service provider of a licensee that is an assuming insurer, the assuming insurer shall notify its affected ceding insurers and the commissioner of its state of domicile within three business days of receiving notice from its third-party service provider that a cybersecurity event has occurred.
(c) The ceding insurers that have a direct contractual relationship with affected consumers shall fulfill the consumer notification requirements imposed under chapter 487N and any other notification requirements relating to a cybersecurity event imposed under this part. [L 2021, c 112, pt of §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3B-306 Notice regarding cybersecurity events of insurers to producers of record.

§431:3B-306
Notice regarding cybersecurity events of insurers to producers of record.
(a) In the case of a cybersecurity event involving nonpublic information that is in the possession, custody, or control of a licensee that is an insurer or its third-party service provider, and for which a consumer accessed the insurer's services through an independent insurance producer, the insurer shall notify the producers of record of all affected consumers as soon as practicable as directed by the commissioner.
(b) The insurer is exempt from this obligation in instances where it does not have the current producer of record information for any individual consumer. [L 2021, c 112, pt of §2]
2023 Hawaii Revised Statutes › Title 24. Insurance › 431. Insurance Code › 431:3D-101 Scope and purpose.

§431:3D-101 Scope and purpose.
(a) This article shall apply to all insurers domiciled in this State unless exempt pursuant to section 431:3D-106.
(b) The purposes of this article shall be to:
(1) Provide the requirements for maintaining a risk management framework and completing an own risk and solvency assessment; and
(2) Provide guidance and instructions for filing an own risk and solvency assessment summary report with the commissioner. [L 2016, c 140, pt of §1]