reglab/statecodes huggingface dataset:
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 38 - Retroactive Denial of Reimbursements › Section 3802 - Definitions

§ 3802. Definitions.
The following words and phrases when used in this chapter shall have the meanings given to them in this section unless the context clearly indicates otherwise:
"Abuse."
Incidents or practices of providers, physicians or suppliers of services and equipment which are inconsistent with accepted sound medical, business or fiscal practices.
"Fraud."
Any activity defined as an offense under 18 Pa.C.S. § 4117 (relating to insurance fraud).
"Health care provider."
A person, corporation, facility, institution or other entity licensed, certified or approved by the Commonwealth to provide health care or professional medical services. The term includes, but is not limited to, a physician, chiropractor, optometrist, professional nurse, certified nurse-midwife, podiatrist, hospital, nursing home, ambulatory surgical center or birth center.
"Insurer."
A health insurance entity licensed in this Commonwealth to issue any individual or group health, sickness or accident policy or subscriber contract or certificate that provides medical or health care coverage by a health care facility or licensed health care provider that is offered or governed under any of the following:
(1) The act of May 17, 1921 (P.L.682, No.284), known as The Insurance Company Law of 1921, including section 630 and Article XXIV thereof.
(2) The act of December 29, 1972 (P.L.1701, No.364), known as the Health Maintenance Organization Act.
(3) The act of May 18, 1976 (P.L.123, No.54), known as the Individual Accident and Sickness Insurance Minimum Standards Act.
(4) Chapter 61 (relating to hospital plan corporations) or 63 (relating to professional health services plan corporations).
"Reimbursement."
Payments made to a health care provider by an insurer.
"Waste."
The overutilization of professional medical services or the misuse of resources by a health care provider.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 38 - Retroactive Denial of Reimbursements › Section 3803 - Retroactive denial of reimbursement

§ 3803. Retroactive denial of reimbursement.
(a) General rule.--
Except as provided in section 3804 (relating to exceptions to retroactive denial of reimbursement), an insurer may not retroactively deny reimbursement as a result of an overpayment determination more than 24 months after the date the insurer initially paid the health care provider. An insurer that retroactively denies reimbursement to a health care provider under this chapter shall do so based upon coding guidelines and policies in effect at the time the service subject to the retroactive denial was rendered.
(b) Written notice.--
An insurer that retroactively denies reimbursement to a health care provider under subsection (a) shall provide the health care provider with a written statement specifying the basis for the retroactive denial.
Cross References.
Section 3803 is referred to in sections 3804, 3806 of this title.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 38 - Retroactive Denial of Reimbursements › Section 3804 - Exceptions to retroactive denial of reimbursement

§ 3804. Exceptions to retroactive denial of reimbursement.
The provisions of section 3803 (relating to retroactive denial of reimbursement) do not apply if an insurer retroactively denies reimbursement to a health care provider because any of the following apply:
(1) The information submitted to the insurer constitutes fraud, waste or abuse as defined in this chapter.
(2) The claim submitted to the insurer was a duplicate claim.
(3) Denial was required by a Federal or State government plan.
(4) Services were subject to coordination of benefits with another insurer, the medical assistance program or the Medicare program.
Cross References.
Section 3804 is referred to in sections 3803, 3805 of this title.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 38 - Retroactive Denial of Reimbursements › Section 3805 - Coordination of benefits

§ 3805. Coordination of benefits.
If an insurer retroactively denies reimbursement for services as a result of coordination of benefits under the provisions of section 3804(4) (relating to exceptions to retroactive denial of reimbursement), the health care provider shall have 12 months from the date of the denial, unless the entity responsible for payment permits a longer time period, to submit a claim for reimbursement for the service to such entities.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 38 - Retroactive Denial of Reimbursements › Section 3806 - Tolling

§ 3806. Tolling.
An insurer may request medical or billing records in writing from a health care provider under section 3803 (relating to retroactive denial of reimbursement). The health care provider shall provide the necessary records to the insurer within 60 days of the request. The period of time in which the health care provider is gathering the requested documentation shall be added to the 24-month period.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 39 - Corporate Governance Annual Disclosure › Section 3901 - Purposes and scope of chapter

§ 3901. Purposes and scope of chapter.
(a) Purposes.--
The purposes of this chapter are to:
(1) Provide the commissioner a summary of an insurer or insurance group's corporate governance structure, policies and practices to permit the commissioner to gain and maintain an understanding of the insurer or insurance group's corporate governance framework.
(2) Outline the requirements for completing and filing a CGAD with the commissioner.
(3) Provide for the confidential treatment of the CGAD and related information containing confidential and sensitive information related to an insurer or insurance group's internal operations and proprietary and trade secret information which, if made public, could potentially cause the insurer or insurance group competitive harm or disadvantage.
(b) Scope.--
The requirements of this chapter shall apply to:
(1) an insurer that is domiciled in this Commonwealth; or
(2) an insurance group of which this Commonwealth is the lead state.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 39 - Corporate Governance Annual Disclosure › Section 3902 - Definitions

§ 3902. Definitions.
The following words and phrases when used in this chapter shall have the meanings given to them in this section unless the context clearly indicates otherwise:
"Board."
The board of directors of the filing entity.
"CGAD-related information."
The CGAD or any documents, materials or other information, including proprietary and trade secret information or documents, related to an insurer or insurance group's CGAD.
"Commissioner."
The Insurance Commissioner of the Commonwealth.
"Corporate governance annual disclosure"
or
"CGAD."
The confidential report filed by the insurer or insurance group in accordance with the requirements of this chapter.
"Department."
The Insurance Department of the Commonwealth.
"Insurance Company Law."
The act of May 17, 1921 (P.L.682, No.284), known as The Insurance Company Law of 1921.
"Insurance group."
The insurers and affiliates included within an insurance holding company system as defined in section 1401 of the Insurance Company Law.
"Insurer."
A fraternal benefit society, a health maintenance organization, a preferred provider organization, a company, an association, an exchange, a hospital plan corporation as defined in and subject to Chapter 61 (relating to hospital plan corporations) or a professional health services plan corporation subject to Chapter 63 (relating to professional health services plan corporations) authorized by the commissioner to transact the business of insurance in this Commonwealth.
"Lead state."
The state responsible for coordination and communication among state regulators regarding oversight of an insurance group, as determined by the department in consultation with other regulators with domestic insurers in the insurance group.
"NAIC."
The National Association of Insurance Commissioners or successor organization and its affiliates and subsidiaries.
"Senior management."
A corporate officer or other high-level management official responsible for reporting information to the board of directors at regular intervals, providing information to shareholders or providing information to regulators.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 39 - Corporate Governance Annual Disclosure › Section 3903 - Submittal of CGAD

§ 3903. Submittal of CGAD.
(a) General rule.--
(1) Beginning January 1, 2020, a domestic insurer or an insurance group of which this Commonwealth is the lead state shall submit to the department a CGAD no later than June 1 of each calendar year.
(2) If a domestic insurer is a member of an insurance group of which this Commonwealth is not the lead state, the insurer shall submit the report required by this section to the commissioner of the lead state for the insurance group in accordance with the laws of the lead state.
(b) Exception.--
An insurer or insurance group not required to submit a CGAD to the department under subsection (a) shall submit a copy of the most current version of its CGAD to the department upon the commissioner's request.
(c) Amendments.--
Each year following the initial filing of the CGAD, the filing entity shall file an amended version of the previously filed CGAD indicating where changes have been made. If no changes were made in the information or activities reported by the filing entity, the filing should so state.
(d) Format.--
The filing entity may exercise discretion regarding the appropriate format for providing the information required in this chapter and may customize the CGAD to provide the most relevant information necessary to permit the department to understand the corporate governance structure, policies and practices utilized by the filing entity. The department shall include a sample template on its publicly accessible Internet website.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 39 - Corporate Governance Annual Disclosure › Section 3905 - Review of CGAD

§ 3905. Review of CGAD.
(a) Procedures for review.--
The review of the CGAD and any additional requests for information shall be made by or through the lead state or, in the case of an insurer that is not part of an insurance group, the department.
(b) Duplicative filings.--
An insurer or insurance group providing information substantially similar to the information required by this chapter in other documents provided to the department, including proxy statements filed in conjunction with registration requirements or other Federal or State filings provided to the department, is not required to duplicate that information in the CGAD but shall only be required to cross-reference the document in which the information is included.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 39 - Corporate Governance Annual Disclosure › Section 3906 - Third-party consultants

§ 3906. Third-party consultants.
(a) Assistance with review.--
The department may retain, at the insurer or insurance group's expense, third-party consultants, including attorneys, actuaries, accountants and other experts not otherwise a part of the department's staff as may be reasonably necessary to assist the department in reviewing the CGAD, CGAD-related information or the insurer's or insurance group's compliance with this chapter. Before retaining a third-party consultant, the department shall consider all of the following:
(1) The complexity of the corporate governance structure of the insurer or insurance group.
(2) Whether subject matter expertise to effectively review the report is available within the department.
(b) Advisory capacity.--
A person retained under subsection (a) shall be under the direction and control of the department and shall act in a purely advisory capacity.
(c) Confidentiality.--
Each third-party consultant shall be subject to the same confidentiality standards and requirements as the department.
(d) Verification.--
As part of the retention process, a third-party consultant shall verify to the department, with notice to the insurer or insurance group, that it:
(1) is free of a conflict of interest;
(2) will comply with the confidentiality standards and requirements of this chapter; and
(3) has internal procedures in place to monitor compliance with this section.
(e) Written consent.--
A retention agreement with a third-party consultant shall expressly require the written consent of the insurer or insurance group prior to making information provided under this chapter public.
Cross References.
Section 3906 is referred to in section 3907 of this title.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 39 - Corporate Governance Annual Disclosure › Section 3908 - Penalties

§ 3908. Penalties.
An insurer or insurance group that fails to timely file a CGAD as required under this chapter or by regulation shall be required, after notice and hearing, to pay a penalty of $200 for each day's delay. The maximum penalty under this section shall be $25,000 per year.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 39 - Corporate Governance Annual Disclosure › Section 3910 - Construction

§ 3910. Construction.
Nothing in this chapter shall be construed to prescribe or impose corporate governance standards and internal procedures in addition to those required under applicable State corporate law. Notwithstanding the foregoing, nothing in this chapter shall be construed to limit the commissioner's authority or the rights or obligations of third parties under Article IX of the act of May 17, 1921 (P.L.789, No.285), known as The Insurance Department Act of 1921.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 39 - Corporate Governance Annual Disclosure › Section 3911 - Severability

§ 3911. Severability.
(a) General rule.--
Except as provided in subsection (b):
(1) The provisions of this chapter are severable.
(2) If a provision of this chapter or its application to a person or circumstance is held invalid, the invalidity does not affect other provisions or applications of this chapter that can be given effect without the invalid provision or application.
(b) Exception.--
If the addition of section 3907 (relating to confidentiality) is held invalid, independent of its application to a person or circumstance, the remaining provisions or applications of this chapter are void.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 40 - Medication Sychronization › Section 4001 - Definitions

§ 4001. Definitions.
The following words and phrases when used in this chapter shall have the meanings given to them in this section unless the context clearly indicates otherwise:
"Health insurance policy."
An individual or group policy, subscriber contract, certificate or plan issued by an insurer that provides medical or health care coverage. The term does not include any of the following:
(1) An accident only policy.
(2) A credit only policy.
(3) A long-term care or disability income policy.
(4) A specified disease policy.
(5) A Medicare supplement policy.
(6) A TRICARE policy, including a Civilian Health and Medical Program of the Uniformed Services (CHAMPUS) supplement policy.
(7) A fixed indemnity policy.
(8) A dental only policy.
(9) A vision only policy.
(10) A workers' compensation policy.
(11) An automobile medical payment policy.
(12) Another similar policy providing for limited benefits.
"Insurer."
An entity licensed by the department with accident and health authority to issue a health insurance policy that is offered or governed under any of the following:
(1) The act of May 17, 1921 (P.L.682, No.284), known as The Insurance Company Law of 1921, including section 630 and Article XXIV of that act.
(2) The act of December 29, 1972 (P.L.1701, No.364), known as the Health Maintenance Organization Act.
(3) Chapter 61 (relating to hospital plan corporations) or 63 (relating to professional health services plan corporations).
"Maintenance medication."
A medication prescribed for a chronic, long-term condition and taken on a regular, recurring basis.
"Medication synchronization."
The coordination of prescription drug filling or refilling by a pharmacy or dispensing physician for a health insurance enrollee taking two or more maintenance medications for the purpose of improving medication adherence.
"Pharmacy."
As defined in section 2 of the act of September 27, 1961 (P.L.1700, No.699), known as the Pharmacy Act.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 40 - Medication Sychronization › Section 4002 - Prorated daily cost-sharing rate

§ 4002. Prorated daily cost-sharing rate.
A health insurance policy shall permit and apply a prorated daily cost-sharing rate to maintenance medications that are dispensed by a pharmacy as a partial supply if the pharmacist or prescriber determines the fill or refill to be in the best interest of the patient and the patient requests or agrees to a partial supply for the purpose of medication synchronization. The fill or refill under this section shall be limited to three times per year for each maintenance medication for a covered individual. For each clinically necessary synchronization thereafter, approval may be required at the discretion of the health insurance policy.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 40 - Medication Sychronization › Section 4003 - Denial of coverage

§ 4003. Denial of coverage.
(a) Partial supply.--
A health insurance policy providing prescription drug coverage may not deny coverage for the dispensing of a maintenance medication that is dispensed by a network pharmacy on the basis that the dispensing is for a partial supply if the prescriber or pharmacist determines the fill or refill to be in the best interest of the patient and the patient requests or agrees to a partial supply for the purpose of medication synchronization.
(b) Denial codes.--
The health insurance policy shall accept early refill and partial supply requests for maintenance medications dispensed for the purpose of medication synchronization using the submission clarification and message codes as adopted by the National Council for Prescription Drug Programs or alternative codes provided by the health insurance policy.
(c) Compliance.--
Nothing in this chapter may prohibit a health insurance policy from using other methods to comply with this chapter.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 40 - Medication Sychronization › Section 4004 - Certain payment structures prohibited

§ 4004. Certain payment structures prohibited.
(a) Prorated dispensing fees.--
A health insurance plan providing prescription drug coverage may not use payment structures incorporating prorated dispensing fees.
(b) Full payment.--
Dispensing fees for a partial supply or refilled prescriptions shall be paid in full for each maintenance medication dispensed, regardless of any prorated copay for the beneficiary or fee paid for alignment services.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 40 - Medication Sychronization › Section 4005 - Application of chapter

§ 4005. Application of chapter.
(a) Prescription drugs.--
This chapter does not apply to prescription drugs that are:
(1) unit-of-use packaging for which medication synchronization is not possible; or
(2) controlled substances classified in Schedule II under section 4(2) of the act of April 14, 1972 (P.L.233, No.64), known as The Controlled Substance, Drug, Device and Cosmetic Act.
(b) Health insurance policies.--
This chapter shall apply to health insurance policies as follows:
(1) For a health insurance policy for which either rates or forms are required to be filed with the Federal Government or the Insurance Department, this chapter shall apply to a health insurance policy for which a form or rate is first permitted to be used on or after the effective date of this section.
(2) For a health insurance policy for which neither rates nor forms are required to be filed with the Federal Government or the Insurance Department, this chapter shall apply to a health insurance policy issued or renewed on or after the effective date of this section.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 43 - Mental Health Parity and Access to Addiction Treatment › Section 4302 - Definitions

§ 4302. Definitions.
The following words and phrases when used in this chapter shall have the meanings given to them in this section unless the context clearly indicates otherwise:
"Health insurance policy."
As follows:
(1) An insurance policy, subscriber contract, certificate or plan that provides medical or health care coverage, including emergency services.
(2) The term does not include any of the following types of policies:
(i) Accident only.
(ii) Fixed indemnity.
(iii) Credit.
(iv) Dental only.
(v) Vision only.
(vi) Specified disease.
(vii) Medicare supplement.
(viii) Civilian Health and Medical Program of the Uniformed Services (CHAMPUS) supplement.
(ix) Long-term care.
(x) Disability income.
(xi) Workers' compensation.
(xii) Automobile medical payment insurance.
"Insurer."
An entity licensed by the department with accident and health authority to issue a health insurance policy that is offered or governed under any of the following:
(1) The act of May 17, 1921 (P.L.682, No.284), known as The Insurance Company Law of 1921, including section 630 and Article XXIV of that act.
(2) The act of December 29, 1972 (P.L.1701, No.364), known as the Health Maintenance Organization Act.
(3) Chapter 61 (relating to hospital plan corporations) or 63 (relating to professional health services plan corporations).
"MHPAEA."
The Paul Wellstone and Pete Domenici Mental Health Parity and Addiction Equity Act of 2008 (Public Law 110-343, 122 Stat. 3881).
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 43 - Mental Health Parity and Access to Addiction Treatment › Section 4303 - Annual attestation

§ 4303. Annual attestation.
(a) Statement regarding MHPAEA compliance.--
For the form for each health insurance policy offered, issued or renewed by an insurer, the insurer shall annually file with the department a statement attesting to the insurer's documented analyses of efforts to comply with MHPAEA and the Federal regulations relating to mental health and substance use disorder parity as of the date of the attestation.
(b) Statement regarding MHPAEA nonapplicability.--
For the form for each insurance policy offered, issued or renewed by an insurer in this Commonwealth that is required to be filed but to which MHPAEA does not apply, the insurer shall annually file with the department a statement attesting to the nonapplicability of MHPAEA to the policy form.
(c) Filing.--
Each attestation required under this section must be filed by April 30 of each year or with the form filing, whichever is earlier.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 45 - Insurance Data Security › Section 4511 - Differentiation between types of information

§ 4511. Differentiation between types of information.
For purposes of determining what constitutes publicly available information, a licensee is deemed to have a reasonable basis to believe that information is lawfully made available to the general public if the licensee has taken steps to determine:
(1) that the information is of the type that is available to the general public; and
(2) whether a consumer is able to direct that the information not be made available to the general public and, if so, that the consumer has not done so.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 45 - Insurance Data Security › Section 4512 - Risk assessment

§ 4512. Risk assessment.
A licensee shall conduct a risk assessment, which must:
(1) Identify reasonably foreseeable internal or external threats that could result in unauthorized access, transmission, disclosure, misuse, alteration or destruction of nonpublic information, including the security of information systems and nonpublic information that are accessible to, or held by, third-party service providers.
(2) Assess the likelihood and potential damage of threats, taking into consideration the sensitivity of the nonpublic information.
(3) Assess the sufficiency of policies, procedures, information systems and other safeguards in place to manage threats in each relevant area of the licensee's operations, including:
(i) Employee training and management.
(ii) Information systems, including network and software design and information classification, governance, processing, storage, transmission and disposal.
(iii) Detection, prevention and response to attacks, intrusions or other system failures.
(4) Implement information safeguards to manage the threats identified in its ongoing assessment.
(5) At least annually, assess the effectiveness of the safeguards' key controls, systems and procedures.
Cross References.
Section 4512 is referred to in sections 4502, 4514, 4516, 4521, 4532, 4536 of this title.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 45 - Insurance Data Security › Section 4514 - Corporate oversight

§ 4514. Corporate oversight.
(a) Duties.--
If a licensee has a board of directors, the board or an appropriate committee of the board shall, at a minimum:
(1) Require the licensee's executive management or delegates to develop, implement and maintain the licensee's information security program.
(2) Require the licensee's executive management or delegates to report in writing at least annually, the following information:
(i) The overall status of the information security program and the licensee's compliance with this chapter.
(ii) Material matters related to the information security program, addressing issues such as:
(A) Risk assessment, risk management and control decisions.
(B) Third-party service provider arrangements.
(C) The results of testing.
(D) Cybersecurity events.
(E) Any violation of this chapter and management's responses to the violation.
(F) Recommendations for changes in the information security program.
(b) Delegation.--
If the executive management of a licensee delegates any of its responsibilities under this section or section 4512 (relating to risk assessment), 4513 (relating to information security program) or 4515 (relating to oversight of third-party service provider arrangements), the executive management shall oversee the development, implementation and maintenance of the licensee's information security program prepared by the delegated entity, which shall provide a written report to the executive management in accordance with the reporting requirements of this chapter.
Cross References.
Section 4514 is referred to in sections 4516, 4521, 4532, 4536 of this title.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 45 - Insurance Data Security › Section 4515 - Oversight of third-party service provider arrangements

§ 4515. Oversight of third-party service provider arrangements.
A licensee shall:
(1) Exercise due diligence in selecting its third-party service provider.
(2) Require a third-party service provider to implement appropriate administrative, technical and physical measures to protect and secure the information systems and nonpublic information that are accessible to, or held by, the third-party service provider.
Cross References.
Section 4515 is referred to in sections 4514, 4516, 4521, 4532, 4536 of this title.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 45 - Insurance Data Security › Section 4516 - Certification

§ 4516. Certification.
(a) Requirement.--
No later than the April 15 that is at least one year after the effective date of this section, and each April 15 thereafter, each insurer domiciled in this Commonwealth shall submit to the commissioner, in the form and manner prescribed by the department, a written statement certifying that the insurer is in compliance with the requirements of sections 4512 (relating to risk assessment), 4513 (relating to information security program), 4514 (relating to corporate oversight) and 4515 (relating to oversight of third-party service provider arrangements).
(b) Documentation.--
(1) Each insurer shall maintain all records, schedules and data supporting the certification under this section for a period of five years and shall make that information available for examination by the department.
(2) To the extent that an insurer has identified areas, systems or processes that require material improvement, updating or redesign, the insurer shall document the identification and the remedial efforts planned and underway to address the areas, systems or processes. The documentation shall be available for inspection by the department.
Cross References.
Section 4516 is referred to in sections 4521, 4532, 4536 of this title.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 45 - Insurance Data Security › Section 4517 - Investigation of cybersecurity event

§ 4517. Investigation of cybersecurity event.
(a) Requirement.--
If a licensee discovers that a cybersecurity event has or may have occurred regarding the licensee, the licensee or an outside vendor or service provider designated to act on behalf of the licensee shall conduct a prompt investigation.
(b) Determination.--
During an investigation under this section, the licensee or an outside vendor or service provider designated to act on behalf of the licensee shall, at a minimum, do as much of the following as possible:
(1) Determine whether a cybersecurity event has occurred.
(2) Assess the nature and scope of the cybersecurity event.
(3) Identify any nonpublic information that may have been involved in the cybersecurity event.
(4) Perform or oversee reasonable measures to restore the security of the information systems compromised in the cybersecurity event in order to prevent further unauthorized acquisition, release or use of nonpublic information in the licensee's possession, custody or control.
(c) Third-party service provider.--
If the licensee learns that a cybersecurity event has or may have occurred in a system maintained by a third-party service provider, the licensee shall complete the steps specified in subsection (b) or confirm and document that the third-party service provider has completed those steps.
(d) Records.--
A licensee shall maintain records concerning all cybersecurity events for a period of at least five years from the date of the cybersecurity event and shall produce those records upon demand of the commissioner.
Cross References.
Section 4517 is referred to in section 4535 of this title.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 45 - Insurance Data Security › Section 4521 - Power to examine licensees

§ 4521. Power to examine licensees.
(a) Insurers.--
The commissioner shall have the powers provided under Article IX of the act of May 17, 1921 (P.L.789, No.285), known as The Insurance Department Act of 1921, to examine and investigate an insurer to determine whether the insurer has been or is engaged in conduct in violation of section 4512 (relating to risk assessment), 4513 (relating to information security program), 4514 (relating to corporate oversight), 4515 (relating to oversight of third-party service provider arrangements) or 4516 (relating to certification).
(b) Licensees other than insurers.--
(1) The commissioner shall have the power to examine and investigate a licensee not subject to Article IX of The Insurance Department Act of 1921 to determine whether the licensee has engaged in conduct in violation of this chapter.
(2) Each licensee subject to examination in accordance with paragraph (1) shall keep all books, records, accounts, papers, documents and any computer or other recordings relating to compliance with this chapter in the manner and time periods as the department, in its discretion, may require in order that the department's authorized representatives may verify and ascertain whether the company or person has complied with the requirements of this chapter.
(3) Each licensee subject to examination in accordance with paragraph (1) from whom information is sought and the officers, directors, employees and agents of the licensee shall provide to the examiners timely, convenient and free access at all reasonable hours at the licensee's offices to all books, records, accounts, papers, documents and any computer or other recordings relating to the property, assets, business and affairs of the licensee being examined. The following apply:
(i) The officers, directors, employees and agents of the licensee shall facilitate the examination and aid in the examination insofar as it is in their power to do so.
(ii) The refusal of a licensee by its officers, directors, employees or agents to submit to examination or to comply with any reasonable written request of the examiners shall be grounds for suspension, revocation, refusal or nonrenewal of any license or authority held by the licensee to engage in an insurance or other business subject to the department's jurisdiction.
(iii) A proceeding for suspension, revocation, refusal or nonrenewal of any license or authority shall be conducted in accordance with 2 Pa.C.S. (relating to administrative law and procedure).
(c) Authorized actions by commissioner.--
Notwithstanding and in addition to the powers specified under this section, whenever the commissioner has reason to believe that a licensee has been or is engaged in conduct in this Commonwealth that violates this chapter, the commissioner may take an action that is necessary or appropriate to enforce the provisions of this chapter.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 45 - Insurance Data Security › Section 4522 - Penalties

§ 4522. Penalties.
Upon the determination, after notice and hearing, that this chapter has been violated, the commissioner may impose the following penalties:
(1) Suspension or revocation of the licensee's license, authorization to operate or registration.
(2) Refusal to issue or renew a license, authorization to operate or registration.
(3) A cease and desist order.
(4) For each violation of this chapter that a licensee knew or reasonably should have known was a violation, a penalty of not more than $5,000, not to exceed an aggregate penalty of $100,000 in a single calendar year.
(5) For each violation of this chapter that a licensee did not know nor reasonably should have known was a violation, a penalty of not more than $1,000, not to exceed an aggregate penalty of $20,000 in a single calendar year.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 45 - Insurance Data Security › Section 4532 - Exemptions

§ 4532. Exemptions.
(a) Licensee criteria.--
A licensee meeting any of the following criteria shall be exempt from sections 4512 (relating to risk assessment), 4513 (relating to information security program), 4514 (relating to corporate oversight), 4515 (relating to oversight of third-party service provider arrangements) and 4516 (relating to certification):
(1) The licensee has fewer than 10 employees.
(2) The licensee has less than $5,000,000 in gross revenue.
(3) The licensee has less than $10,000,000 in year-end total assets.
(b) Federal law.--
A licensee that is subject to and governed by the privacy, security and breach notification rules issued by the United States Department of Health and Human Services under 45 CFR Pts. 160 (relating to general administrative requirements) and 164 (relating to security and privacy), established in accordance with the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191, 110 Stat. 1936) and the Health Information Technology for Economic and Clinical Health Act (Public Law 111-5, 123 Stat. 226-279 and 467-496), and which maintains nonpublic information in the same manner as protected health information shall be deemed to comply with the requirements of this chapter except for the notification requirements of section 4518(a), (b) and (c) (relating to notification of cybersecurity event).
(c) Employees, agents, representatives and designees.--
An employee, agent, representative or designee of a licensee, who is also a licensee, shall be exempt from sections 4512, 4513, 4514, 4515 and 4516 and need not develop its own information security program to the extent that the employee, agent, representative or designee is covered by the information security program of the other licensee.
(d) Compliance.--
If a licensee ceases to qualify for an exemption under this section, the licensee shall have 180 days to comply with this chapter.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 45 - Insurance Data Security › Section 4534 - Construction with other laws

§ 4534. Construction with other laws.
(a) Private cause of action.--
Nothing in this chapter shall be construed to:
(1) Create or imply a private cause of action for a violation of this chapter.
(2) Curtail a private cause of action that otherwise exists in the absence of this chapter.
(b) Exclusive standards.--
Notwithstanding any other provision of law, this chapter shall establish the exclusive State standards applicable to licensees for data security, the licensees' investigation of a cybersecurity event and notification to the commissioner.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 45 - Insurance Data Security › Section 4535 - Prevention or abrogation of agreements

§ 4535. Prevention or abrogation of agreements.
Nothing in this chapter shall prevent or abrogate an agreement between a licensee and another licensee, a third-party service provider or any other party to fulfill any of the investigation requirements imposed under section 4517 (relating to investigation of cybersecurity event) or notice requirements imposed under section 4518 (relating to notification of cybersecurity event).
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 45 - Insurance Data Security › Section 4536 - Initial compliance

§ 4536. Initial compliance.
Licensees shall have one year from the effective date of this section to implement sections 4512 (relating to risk assessment), 4513 (relating to information security program), 4514 (relating to corporate oversight) and 4516 (relating to certification) and two years from the effective date of this section to implement section 4515 (relating to oversight of third-party service provider arrangements).
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 61 - Hospital Plan Corporations › Extra - Chapter Notes

Enactment.
Chapter 61 was added November 15, 1972, P.L.1063, No.271, effective in 90 days.
Cross References.
Chapter 61 is referred to in sections 3802, 3902, 4001, 4302, 4502, 9103 of this title;
            section 4117 of Title 18 (Crimes and Offenses); sections 4304.1, 4326 of Title 23
            (Domestic Relations); sections 3302, 3303 of Title 35 (Health and Safety); section
            6160 of Title 42 (Judiciary and Judicial Procedure); section 7309 of Title 51 (Military
            Affairs); section 1719 of Title 75 (Vehicles).
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 61 - Hospital Plan Corporations › Section 6101 - Definitions

§ 6101. Definitions.
The following words and phrases when used in this chapter shall have, unless the context clearly indicates otherwise, the meanings given to them in this section:
"Hospital plan corporation."
A corporation not-for-profit engaged in the business of maintaining and operating a nonprofit hospital plan.
"Nonprofit hospital plan."
A plan whereby for prepayment, periodical or lump sum payment hospitalization or related health benefits may be provided to subscribers to such plan.
Cross References.
Section 6101 is referred to in section 6301 of this title; section 102 of Title 15 (Corporations and Unincorporated Associations).
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 61 - Hospital Plan Corporations › Section 6102 - Certification of hospital plan corporations

§ 6102. Certification of hospital plan corporations.
(a) General rule.
--A corporation not-for-profit incorporated for the purpose of establishing, maintaining and operating a nonprofit hospital plan shall not commence business until it shall have received from the department a certificate of authority authorizing the corporation to establish, maintain and operate such a nonprofit hospital plan.
(b) Exemption.
--The provisions of subsection (a) of this section shall not apply to any nonprofit corporation incorporated with the approval of the department under the former provisions of section 218 of the Nonprofit Corporation Law of 1933. For the purposes of this chapter such a corporation shall be deemed to be a holder of a certificate of authority issued under this section.
(c) Form of application.
--Every application for a certificate of authority under this section shall be made to the department in writing and shall be in such form and contain such information as the regulations of the department may require.
(d) Standards for issuance of certificate.
--A certificate of authority shall be issued by order of the department only if and when the department shall find and determine that the application complies with the provisions of this chapter and the regulations of the department thereunder.
(e) Procedure before department.
--For the purpose of enabling the department to make the finding or determination required by subsection (d) of this section, the department, by publication of notice in the Pennsylvania Bulletin, shall afford reasonable opportunity for hearing, which shall be public, and, before or after any such hearing, it may make such inquiries, audits and investigations, and may require the submission of such supplemental studies and information, as it may deem necessary or proper to enable it to reach a finding or determination. The department, in granting a certificate of authority, may impose such conditions as it may deem to be just and reasonable. In every case the department shall make a finding or determination in writing, stating whether or not the application has been approved, and, if it has been approved in part only, specifying the part which has been approved and the part which has been denied. Any holder of a certificate of authority, exercising the authority conferred thereby, shall be deemed to have waived any and all objections to the terms and conditions of such certificate.
(f) Judicial review.
--Orders of the department upon an application for a certificate of authority under this section shall be subject to judicial review in the manner and within the time provided by law.
Cross References.
Section 6102 is referred to in sections 6124, 6304, 6329 of this title.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 61 - Hospital Plan Corporations › Section 6103 - Exemptions applicable to certified hospital plan corporations

§ 6103. Exemptions applicable to certified hospital plan
corporations.
(a) General insurance laws.
--A hospital plan corporation holding a certificate of authority under this chapter shall not be subject to the laws of this Commonwealth now in force relating to the business of insurance, and no statute hereafter enacted relating to the business of insurance shall apply to such a corporation unless such statute shall specifically refer and apply to a corporation subject to this chapter.
(b) Tax laws.
--Every hospital plan corporation holding a certificate of authority under this chapter is hereby declared to be a charitable and benevolent institution, and all its funds and investments shall be exempt from taxation by the Commonwealth and its political subdivisions.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 61 - Hospital Plan Corporations › Section 6105 - Penalties

§ 6105. Penalties.
Any person who violates any of the provisions of this chapter, or any regulation or order of the department made pursuant thereto, any person who hinders or prevents the department in the discharge of any duty imposed on it by this chapter, any person who fraudulently procures or attempts to procure any benefit from any hospital plan corporation holding a certificate of authority under this chapter, and any person who willfully makes any false statement in any proceeding or report under this chapter, shall be guilty of a misdemeanor, and, upon conviction thereof, shall be sentenced to pay a fine of not more than $3,000 or to be imprisoned for not more than six months, or both, in the discretion of the court. Any act or default by any corporation, association, or common law trust, in violation of any provision of this chapter or of any regulation or order of the department made pursuant thereto, shall be deemed to be the act or default of the officers or directors who participated in authorizing or effecting such act or default or who knowingly permitted it.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 61 - Hospital Plan Corporations › Section 6121 - Eligible hospitals

§ 6121. Eligible hospitals.
Any hospital plan corporation may enter into contracts for the rendering of hospitalization to any of its subscribers only with hospitals operated by the Commonwealth, or its agencies, or by political subdivisions, or by corporations organized under the laws of this Commonwealth for hospital purposes, or with such other hospitals as are approved by the Department of Public Welfare.
References
in Text.
The Department of Public Welfare, referred to in this section, was redesignated as the Department of Human Services by Act 132 of 2014.
Cross References.
Section 6121 is referred to in section 6124 of this title.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 61 - Hospital Plan Corporations › Section 6122 - Action as agent under Federal and other programs

§ 6122. Action as agent under Federal and other programs.
(a) General rule.
--Any hospital plan corporation may, with the approval of the department, act as a contracting agency or organization under section 1841 of Title XVIII of the Federal Social Security Act, as amended or supplemented, with power to perform all the services which may be required of a contracting agency or organization thereunder and may perform administrative services similar or related to those which may be required of an agency or organization thereunder in connection with a Federal, State or local governmental health care program and may perform administrative services similar or related to those which may be required of such an agency or organization in connection with or associated with nongovernmental organizations, individuals, groups and agencies in the health care field.
(b) Legislative amendment of stated purposes of existing corporations.
--The stated purposes of all existing hospital plan corporations are hereby amended so as to include the performance of the activities authorized by subsection (a) of this section.
2023 Pennsylvania Consolidated & Unconsolidated Statutes › Title 40 - INSURANCE › Chapter 61 - Hospital Plan Corporations › Section 6123 - Investment of funds

§ 6123. Investment of funds.
Any statute to the contrary notwithstanding, funds of any hospital plan corporation, equal to its reserves, shall be invested in compliance with the requirements of law for the investment of the capital and reserves of life insurance companies. The funds of any such corporation, equal to its surplus, shall be invested in compliance with the requirements of law for the investment of the surplus of life insurance companies.