reglab/statecodes huggingface dataset:
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:44 - Insurance fraud prevention unit › Section 20:06:44:01 - Definitions

Current through Register Vol. 51, page 10, July 15, 2024
Terms used in this chapter mean:
(1) "Director," the director of the Division of Insurance, Department of Labor and Regulation;
(2) "Division," the Division of Insurance, Department of Labor and Regulation;
(3) "Department," the Department of Labor and Regulation;
(4) "Designee," the Department of Labor and Regulation, the attorney general, any state's attorney, any duly constituted criminal investigative department or agency of the state of South Dakota or of the United States, any county or municipal law enforcement agency having investigative jurisdiction, and any other person whose services are contracted for by the insurance fraud prevention unit;
(5) "Insurer," in addition to those persons defined under SDCL subdivision 58-1-2(12), any person or entity transacting insurance with a certificate of authority issued by the director. The term also means health maintenance organizations, legal service insurance corporations, prepaid limited health service organizations, dental and other similar health service plans, and, notwithstanding SDCL subdivision 58-1-3(1), fraternal benefit societies;
(6) "Criminal intelligence information," information associated with an identifiable individual, group, organization, or event, which information was compiled by a law enforcement agency in the course of conducting an investigation into a criminal conspiracy, projecting a potential criminal operation, or producing an estimate of future criminal activities; or in relation to the reliability of information derived from reports of informants or investigators or from any type of surveillance; and
(7) "Criminal investigative records," any document compiled or recorded pursuant to statutory authority that is associated with an individual, group, organization, or event, which record was compiled by a law enforcement agency in the course of conducting an investigation of a crime. This includes records or files about a crime derived from reports of officers, deputies, agents, informants, or investigators or from any type of surveillance.
General Authority:
SDCL  58-4A-13.
Law Implemented:
SDCL  58-4A-13.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:44 - Insurance fraud prevention unit › Section 20:06:44:02 - Standards and criteria for qualification as a nonprofit organization

Current through Register Vol. 51, page 10, July 15, 2024
To qualify as a nonprofit organization as described under SDCL subdivision 58-4A-13(7) the organization must:
(1) Be organized as a not for profit organization under the laws of the state in which its principal place of business is;
(2) Have as its principal purpose either the detection and prevention of insurance fraud or the detection and prevention of crime, or both;
(3) Either limit its membership to designees or insurers or to any entity or person described in SDCL  58-4A-13 or agree not to release any criminal intelligence information which it may possess to any of its members who are not designees or insurers or any entity or person described in SDCL  58-4A-13; and
(4) If the organization transmits information on-line, it must have a system that meets industry standard security measures for the storing and transmission of criminal intelligence information.
General Authority:
SDCL  58-4A-13.
Law Implemented:
SDCL  58-4A-13.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:44 - Insurance fraud prevention unit › Section 20:06:44:03 - Procedures for recognition as a nonprofit organization

Current through Register Vol. 51, page 10, July 15, 2024
Any organization that seeks recognition as a nonprofit organization under SDCL subdivision  58-4A-13 (7) shall comply with the following procedure:
(1) Submit a written request to the director;
(2) Include documentation to establish that it meets the standards and criteria to become recognized as a nonprofit organization; and
(3) Sign an acknowledgement form proscribed by the director that its organization will not release any criminal intelligence information within its possession to any person or entity other than designees or insurers or any entity or person described in SDCL  58-4A-13.
Upon receipt of the request to become recognized as a nonprofit organization, the director shall conduct a timely review of the request and documentation to determine if the organization meets the standards and criteria set forth in §
										20:06:44:02. After review, the director shall issue a written decision and provide a copy to the requesting organization.
General Authority:
SDCL  58-4A-13.
Law Implemented:
SDCL 58-4A-13.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:01 - Purpose and scope

Current through Register Vol. 51, page 10, July 15, 2024
(1) Purpose. This chapter governs the treatment of nonpublic personal health information and nonpublic personal financial information about individuals by all licensees of the state insurance division. This chapter:
(A) Requires a licensee to provide notice to individuals about its privacy policies and practices;
(B) Describes the conditions under which a licensee may disclose nonpublic personal health information and nonpublic personal financial information about individuals to affiliates and nonaffiliated third parties;
(C) Provides methods for individuals to prevent a licensee from disclosing that information; and
(D) Establishes standards for developing and implementing administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:02 - Rule of construction

Current through Register Vol. 51, page 10, July 15, 2024
The examples in this chapter and the sample clauses in Appendix A of this chapter are not exclusive. Compliance with an example or use of a sample clause, to the extent applicable, constitutes compliance with this chapter.
General Authority:
SDCL  58-2-40,  58-2-41.
Law Implemented:
SDCL  58-2-40,  58-2-41.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:04 - Initial privacy notice to consumers required

Current through Register Vol. 51, page 10, July 15, 2024
(1) Initial notice requirement. A licensee shall provide a clear and conspicuous notice that accurately reflects its privacy policies and practices to:
(A) Customer. An individual who becomes the licensee's customer, not later than when the licensee establishes a customer relationship, except as provided in subdivision 20:06:45:04(5); and
(B) Consumer. A consumer, before the licensee discloses any nonpublic personal financial information about the consumer to any nonaffiliated third party, if the licensee makes a disclosure other than as authorized by §§
										20:06:45:14  and 20:06:45:15.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:05 - Annual privacy notice to customers required

Current through Register Vol. 51, page 10, July 15, 2024
(1)
(A) General rule. A licensee shall provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices not less than annually during the continuation of the customer relationship. Annually means at least once in any period of 12 consecutive months during which that relationship exists. A licensee may define the 12-consecutive-month period, but the licensee shall apply it to the customer on a consistent basis.
(B) Example. A licensee provides a notice annually if it defines the 12-consecutive-month period as a calendar year and provides the annual notice to the customer once in each calendar year following the calendar year in which the licensee provided the initial notice. For example, if a customer opens an account on any day of year 1, the licensee shall provide an annual notice to that customer by December 31 of year 2.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:06 - Information to be included in privacy notices

Current through Register Vol. 51, page 10, July 15, 2024
(1) General rule. The initial, annual, and revised privacy notices that a licensee provides under §§
									20:06:45:04, 20:06:45:05, and 20:06:45:08 shall include each of the following items of information, in addition to any other information the licensee wishes to provide, that applies to the licensee and to the consumers to whom the licensee sends its privacy notice:
(A) The categories of nonpublic personal financial information that the licensee collects;
(B) The categories of nonpublic personal financial information that the licensee discloses;
(C) The categories of affiliates and nonaffiliated third parties to whom the licensee discloses nonpublic personal financial information, other than those parties to whom the licensee discloses information under §§
										20:06:45:14  and 20:06:45:15;
(D) The categories of nonpublic personal financial information about the licensee's former customers that the licensee discloses and the categories of affiliates and nonaffiliated third parties to whom the licensee discloses nonpublic personal financial information about the licensee's former customers, other than those parties to whom the licensee discloses information under §§
										20:06:45:14  and 20:06:45:15;
(E) If a licensee discloses nonpublic personal financial information to a nonaffiliated third party under §
										20:06:45:13  (and no other exception in §§
										20:06:45:14  and 20:06:45:15  applies to that disclosure), a separate description of the categories of information the licensee discloses and the categories of third parties with whom the licensee has contracted;
(F) An explanation of the consumer's right under subdivision 20:06:45:10(1) to opt out of the disclosure of nonpublic personal financial information to nonaffiliated third parties, including the methods by which the consumer may exercise that right at that time;
(G) Any disclosures that the licensee makes under § 603(d)(2)(A)(iii) of the federal Fair Credit Reporting Act (15 U.S.C. 1681 a(d)(2)(A)(iii)) (that is, notices regarding the ability to opt out of disclosures of information among affiliates);
(H) The licensee's policies and practices with respect to protecting the confidentiality and security of nonpublic personal information; and
(I) Any disclosure that the licensee makes under subdivision 20:06:45:06(2).
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:07 - Form of opt out notice to consumers and opt out methods

Current through Register Vol. 51, page 10, July 15, 2024
(1)
(A) Form of opt out notice. If a licensee is required to provide an opt out notice under subdivision 20:06:45:10(1), it shall provide a clear and conspicuous notice to each of its consumers that accurately explains the right to opt out under that section. The notice shall state:
(1) That the licensee discloses or reserves the right to disclose nonpublic personal financial information about its consumer to a nonaffiliated third party;
(2) That the consumer has the right to opt out of that disclosure; and
(3) A reasonable means by which the consumer may exercise the opt out right.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:08 - Revised privacy notices

Current through Register Vol. 51, page 10, July 15, 2024
(1) General rule. Except as otherwise authorized in this chapter, a licensee may not, directly or through an affiliate, disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party other than as described in the initial notice that the licensee provided to that consumer under §
									20:06:45:04, unless:
(A) The licensee has provided to the consumer a clear and conspicuous revised notice that accurately describes its policies and practices;
(B) The licensee has provided to the consumer a new opt out notice;
(C) The licensee has given the consumer a reasonable opportunity, before the licensee discloses the information to the nonaffiliated third party, to opt out of the disclosure; and
(D) The consumer does not opt out.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:09 - Delivery

Current through Register Vol. 51, page 10, July 15, 2024
(1) How to provide notices. A licensee shall provide any notices that this chapter requires so that each customer can reasonably be expected to receive actual notice in writing or, if the consumer agrees, electronically.
(2)
(A) Examples of reasonable expectation of actual notice. A licensee may reasonably expect that a consumer will receive actual notice if the licensee:
(1) Hand-delivers a printed copy of the notice to the consumer;
(2) Mails a printed copy of the notice to the last known address of the consumer separately, or in a policy, billing, or other written communication;
(3) For a consumer who conducts transactions electronically, posts the notice on the electronic site and requires the consumer to acknowledge receipt of the notice as a necessary step to obtaining a particular insurance product or service; or
(4) For an isolated transaction with a consumer, such as the licensee providing an insurance quote or selling the consumer travel insurance, posts the notice and requires the consumer to acknowledge receipt of the notice as a necessary step to obtaining the particular insurance product or service.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:10 - Limits on disclosure of nonpublic personal financial information to nonaffiliated third parties

Current through Register Vol. 51, page 10, July 15, 2024
(1)
(A) Conditions for disclosure. Except as otherwise authorized in this chapter, a licensee may not, directly or through any affiliate, disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party unless:
(1) The licensee has provided to the consumer an initial notice as required under §
											20:06:45:04;
(2) The licensee has provided to the consumer an opt out notice as required in §
											20:06:45:07;
(3) The licensee has given the consumer a reasonable opportunity, before it discloses the information to the nonaffiliated third party, to opt out of the disclosure; and
(4) The consumer does not opt out.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:11 - Limits on redisclosure and reuse of nonpublic personal financial information

Current through Register Vol. 51, page 10, July 15, 2024
(1)
(A) Information the licensee receives under an exception. If a licensee receives nonpublic personal financial information from a nonaffiliated financial institution under an exception in §
										20:06:45:14  or 20:06:45:15, the licensee's disclosure and use of that information is limited as follows:
(1) The licensee may disclose the information to the affiliates of the financial institution from which the licensee received the information;
(2) The licensee may disclose the information to its affiliates, but the licensee's affiliates may, in turn, disclose and use the information only to the extent that the licensee may disclose and use the information; and
(3) The licensee may disclose and use the information pursuant to an exception in §
											20:06:45:14  or 20:06:45:15, in the ordinary course of business to carry out the activity covered by the exception under which the licensee received the information.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:12 - Limits on sharing account number information for marketing purposes

Current through Register Vol. 51, page 10, July 15, 2024
(1) General prohibition on disclosure of account numbers. A licensee may not, directly or through an affiliate, disclose, other than to a consumer reporting agency, a policy number or similar form of access number or access code for a consumer's policy or transaction account to any nonaffiliated third party for use in telemarketing, direct mail marketing, or other marketing through electronic mail to the consumer.
(2) Exceptions. Subdivision 20:06:45:12(1) does not apply if a licensee discloses a policy number or similar form of access number or access code:
(A) To the licensee's service provider solely in order to perform marketing for the licensee's own products or services, as long as the service provider is not authorized to directly initiate charges to the account;
(B) To a licensee who is a producer solely in order to perform marketing for the licensee's own products or services; or
(C) To a participant in an affinity or similar program where the participants in the program are identified to the customer when the customer enters into the program.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:13 - Exception to opt out requirements for disclosure of nonpublic personal financial information for service providers and joint marketing

Current through Register Vol. 51, page 10, July 15, 2024
(1) General rule.
(A) The opt out requirements in §§
										20:06:45:07  and 20:06:45:10  do not apply when a licensee provides nonpublic personal financial information to a nonaffiliated third party to perform services for the licensee or functions on the licensee's behalf, if the licensee:
(1) Provides the initial notice in accordance with §
											20:06:45:04; and
(2) Enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information, including use under an exception in §
											20:06:45:14  or 20:06:45:15  in the ordinary course of business to carry out those purposes.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:14 - Exceptions to notice and opt out requirements for disclosure of nonpublic personal financial information for processing and servicing transactions

Current through Register Vol. 51, page 10, July 15, 2024
(1) Exceptions for processing transactions at consumer's request. The requirements for initial notice in subdivision 20:06:45:04(1)(B), the opt out in §§
									20:06:45:07  and 20:06:45:10, and service providers and joint marketing in §
									20:06:45:13  do not apply if the licensee discloses nonpublic personal financial information as necessary to effect, administer, or enforce a transaction that a consumer requests or authorizes, or in connection with:
(A) Servicing or processing an insurance product or service that a consumer requests or authorizes, or adjusting a claim submitted by a consumer;
(B) Maintaining or servicing the consumer's account with a licensee, or with another entity as part of a private label credit card program or other extension of credit on behalf of such entity;
(C) A proposed or actual securitization, secondary market sale (including sales of servicing rights), or similar transaction related to a transaction of the consumer;
(D) Reinsurance or stop loss or excess loss insurance; or
(E) Informing a policyholder or the policyholder's producer or broker when necessary with respect to a claim asserted or paid under the policy and servicing or processing such claim.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:16 - Protection of Fair Credit Reporting Act

Current through Register Vol. 51, page 10, July 15, 2024
Nothing in this chapter may be construed to modify, limit, or supersede the operation of the federal Fair Credit Reporting Act (15 U.S.C. 1681
et seq
.), and no inference shall be drawn on the basis of the provisions of this chapter regarding whether information is transaction or experience information under § 603 of that Act.
General Authority:
SDCL  58-2-40,  58-2-41.
Law Implemented:
SDCL  58-2-40,  58-2-41.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:17 - Nondiscrimination

Current through Register Vol. 51, page 10, July 15, 2024
A licensee may not discriminate against any consumer or customer because that consumer or customer has opted out from the disclosure of his or her nonpublic personal financial information pursuant to the provisions of this chapter. A licensee may not discriminate against a consumer or customer because that consumer or customer has not granted authorization for the disclosure of his or her nonpublic personal health information pursuant to the provisions of this chapter.
General Authority:
SDCL  58-2-40,  58-2-41.
Law Implemented:
SDCL  58-2-40,  58-2-41.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:18 - Effective date

Current through Register Vol. 51, page 10, July 15, 2024
(1) Effective date. This chapter is effective July 1, 2001.
(2)
(A) Notice requirement for consumers who are the licensee's customers on the compliance date. By July 1, 2001, a licensee shall provide an initial notice, as required by §
										20:06:45:04, to consumers who are the licensee's customers on July 1, 2001.
(B) Example. A licensee provides an initial notice to consumers who are its customers on July 1, 2001, if, by that date, the licensee has established a system for providing an initial notice to all new customers and has mailed the initial notice to all the licensee's existing customers.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:19 - Obligation to provide information to director

Current through Register Vol. 51, page 10, July 15, 2024
Nothing in this chapter shall in any way affect the obligations of any licensee to provide information to the director under the laws and rules of this state.
General Authority:
SDCL  58-2-40,  58-2-41.
Law Implemented:
SDCL  58-2-40,  58-2-41.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:20 - Information security program

Current through Register Vol. 51, page 10, July 15, 2024
Each licensee shall implement a comprehensive written information security program that includes administrative, technical, and physical safeguards for the protection of customer information. The administrative, technical, and physical safeguards included in the information security program shall be appropriate to the size and complexity of the licensee and the nature and scope of its activities.
Licensed producers must determine the level of safeguards appropriate for their business. For those licensed producers that require only a minimum level of safeguards based upon their size and complexity, the appropriate level of safeguards may consist of the following:
(1) Physical safeguards ensuring that nonpublic personal information is under lock when agency personnel are not present to ensure its privacy; and
(2) Technical safeguards ensuring that any electronic information that can be potentially accessed by another person or entity be guarded by an appropriate software program; and
(3) Administrative safeguards that outline agency procedures indicating that nonpublic personal information is not to be provided to persons other than the insured, insurer or its representatives, or others as necessary to carry out the transaction or claim of the insured or customer or requests of the insured or customer and that spell out the specific physical and technical safeguards that are required by the agency.
General Authority:
SDCL  58-2-40,  58-2-41.
Law Implemented:
SDCL  58-2-40,  58-2-41.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:21 - Objectives of information security program

Current through Register Vol. 51, page 10, July 15, 2024
A licensee's information security program shall be designed to:
(A) Ensure the security and confidentiality of customer information;
(B) Protect against any anticipated threats or hazards to the security or integrity of the information; and
(C) Protect against unauthorized access to or use of the information that could result in substantial harm or inconvenience to any customer.
General Authority:
SDCL  58-2-40,  58-2-41.
Law Implemented:
SDCL  58-2-40,  58-2-41.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:22 - Examples of methods of development and implementation

Current through Register Vol. 51, page 10, July 15, 2024
The actions and procedures described in §§
									20:06:45:23  to 20:06:45:26, inclusive, are examples of methods of implementing the requirements of §§
									20:06:45:20  and 20:06:45:21. These examples are non-exclusive illustrations of actions and procedures that licensees may follow to implement §§
									20:06:45:20  and 20:06:45:21.
General Authority:
SDCL  58-2-40,  58-2-41.
Law Implemented:
SDCL  58-2-40,  58-2-41.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:23 - Assess risk

Current through Register Vol. 51, page 10, July 15, 2024
The licensee:
(A) Identifies reasonably foreseeable internal or external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer information systems;
(B) Assesses the likelihood and potential damage of these threats, taking into consideration the sensitivity of customer information; and
(C) Assesses the sufficiency of policies, procedures, customer information systems and other safeguards in place to control risks.
General Authority:
SDCL  58-2-40,  58-2-41.
Law Implemented:
SDCL  58-2-40,  58-2-41.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:24 - Manage and control risk

Current through Register Vol. 51, page 10, July 15, 2024
The licensee:
(A) Designs its information security program to control the identified risks, commensurate with the sensitivity of the information, as well as the complexity and scope of the licensee's activities;
(B) Trains staff, as appropriate, to implement the licensee's information security program; and
(C) Regularly tests or otherwise regularly monitors the key controls, systems, and procedures of the information security program. The frequency and nature of these tests or other monitoring practices are determined by the licensee's risk assessment.
General Authority:
SDCL  58-2-40,  58-2-41.
Law Implemented:
SDCL  58-2-40,  58-2-41.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:25 - Oversee service provider arrangements

Current through Register Vol. 51, page 10, July 15, 2024
The licensee:
(A) Exercises appropriate due diligence in selecting its service providers; and
(B) Requires its service providers to implement appropriate measures designed to meet the objectives of §§
									20:06:45:20  to 20:06:45:26, inclusive, and, where indicated by the licensee's risk assessment, takes appropriate steps to confirm that its service providers have satisfied these obligations.
General Authority:
SDCL  58-2-40,  58-2-41.
Law Implemented:
SDCL  58-2-40,  58-2-41.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:26 - Adjust the program

Current through Register Vol. 51, page 10, July 15, 2024
The licensee monitors, evaluates, and adjusts, as appropriate, the information security program in light of any relevant changes in technology, the sensitivity of its customer information, internal or external threats to information, and the licensee's own changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to customer information systems.
General Authority:
SDCL  58-2-40,  58-2-41.
Law Implemented:
SDCL  58-2-40,  58-2-41.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:27 - Disclosure of nonpublic personal health information

Current through Register Vol. 51, page 10, July 15, 2024
A licensee may not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer whose nonpublic personal health information is sought to be disclosed.
This rule does not prohibit, restrict, or require an authorization for the disclosure on nonpublic personal health information by a licensee for the performance of the following insurance functions by or on behalf of the licensee: claims administration; claims adjustment and management; detection; investigation or reporting of actual or potential fraud, misrepresentation, or criminal activity; underwriting; policy placement or issuance; loss control; ratemaking and guaranty fund functions; reinsurance and excess loss insurance; risk management; case management; disease management; quality assurance; quality improvement; performance evaluation; provider credentialing verification; utilization review; peer review activities; actuarial, scientific, medical, or public policy research; grievance procedures; internal administration of compliance, managerial, and information systems; policyholder service functions; auditing; reporting; database security; administration of consumer disputes and inquiries; external accreditation standards; the replacement of a group benefit plan or workers compensation policy or program; activities in connection with a sale, merger, transfer, or exchange of all or part of a business or operating unit; any activity that permits disclosure without authorization pursuant to the federal Health Insurance Portability and Accountability Act privacy rules promulgated by the U.S. Department of Health and Human Services; disclosure that is required, or is one of the lawful or appropriate methods, to enforce the licensee's rights or the rights of other persons engaged in carrying out a transaction or providing a product or service that a consumer requests or authorizes; and any activity otherwise permitted by law, required pursuant to governmental reporting authority, or to comply with legal process. Additional insurance functions may be added with the approval of the director to the extent they are necessary for appropriate performance of insurance functions and are fair and reasonable to the interest of consumers.
General Authority:
SDCL  58-2-40.
Law Implemented:
SDCL  58-2-40.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:28 - Authorization to disclose nonpublic personal health information

Current through Register Vol. 51, page 10, July 15, 2024
An authorization to disclose nonpublic personal health information pursuant to §
									20:06:45:27  shall be in written or electronic form and contain all of the following:
(1) The identity of the consumer or customer who is the subject of the nonpublic personal health information;
(2) A general description of the types of nonpublic personal health information to be disclosed;
(3) General descriptions of the parties to whom the licensee discloses nonpublic personal health information, the purpose of the disclosure, and how the information will be used;
(4) The signature of the consumer or customer who is the subject of the nonpublic personal health information or the individual who is legally empowered to grant authority and the date signed; and
(5) Notice of the length of time for which the authorization is valid and that the consumer or customer may revoke the authorization at any time and the procedure for making a revocation.
The authorization shall specify a length of time for which the authorization shall remain valid, which in no event may be for more than 24 months.
A consumer or customer who is the subject of nonpublic personal health information may revoke an authorization provided pursuant to §
										20:06:45:27  at any time, subject to the rights of an individual who acted in reliance on the authorization prior to notice of the revocation.
A licensee shall retain the authorization or a copy thereof in the record of the individual who is the subject of nonpublic personal health information.
General Authority:
SDCL  58-2-40.
Law Implemented:
SDCL  58-2-40.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:29 - Authorization delivery

Current through Register Vol. 51, page 10, July 15, 2024
A request for authorization and an authorization form may be delivered to a customer as part of an opt-out notice pursuant to §
									20:06:45:09  if the request and the authorization form are clear and conspicuous. An authorization form is not required to be delivered to the consumer or customer or included in any other notices unless the licensee intends to disclose protected health information pursuant to §
									20:06:45:27.
General Authority:
SDCL  58-2-40.
Law Implemented:
SDCL  58-2-40.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:30 - Relationship to federal rules

Current through Register Vol. 51, page 10, July 15, 2024
Irrespective of whether a licensee is subject to the federal Health Insurance Portability and Accountability Act privacy rule as promulgated by the U.S. Department of Health and Human Services, if a licensee complies with all requirements of the federal rule except for its effective date provision, the licensee is not subject to the provisions of this chapter.
General Authority:
SDCL  58-2-40.
Law Implemented:
SDCL  58-2-40.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:45 - Privacy of consumer financial and health information › Section 20:06:45:31 - Relationship to state laws

Current through Register Vol. 51, page 10, July 15, 2024
Nothing in this chapter preempts or supercedes existing state law related to medical records, or health or insurance information privacy.
General Authority:
SDCL  58-2-40.
Law Implemented:
SDCL  58-2-40.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:46 - HIPAA rules - Nondiscrimination in the group market › Section 20:06:46:01 - Definitions

Current through Register Vol. 51, page 10, July 15, 2024
Terms used in this chapter mean:
(1) "Affiliation period," a period of time that must expire before health insurance coverage provided by a carrier becomes effective, and during which the carrier is not required to provide benefits;
(2) "Beneficiary," a person designated by a participant, or by the terms of an employee benefit plan, who is or may become entitled to a benefit thereunder;
(3) "Enrollment date," the first day of coverage or, if there is a waiting period, the first day of the waiting period, whichever is earlier;
(4) "Medical condition," any condition, whether physical or mental, including any condition resulting from illness, injury, accident, pregnancy, or congenital malformation. For purposes of this definition, genetic information is not a condition;
(5) "Participant," any employee or former employee of an employer, or any member or former member of an employee organization, who is or may become eligible to receive a benefit of any type from an employee benefit plan which covers employees of such employer or members of such organization, or whose beneficiaries may be eligible to receive any such benefit;
(6) "Waiting period," with respect to a health benefit plan and an individual, who is a potential enrollee in the plan, the period that must pass with respect to the individual before the individual is eligible to be covered for benefits under the terms of the plan. For purposes of calculating periods of creditable coverage, a waiting period is not to be considered a gap in coverage.
General Authority:
SDCL  58-18-79.
Law Implemented:
SDCL  58-18-79.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:46 - HIPAA rules - Nondiscrimination in the group market › Section 20:06:46:02 - Criteria that cannot be used to determine benefit eligibility

Current through Register Vol. 51, page 10, July 15, 2024
A carrier may not use health status; medical condition, including both physical and mental illnesses; claims experience; receipt of health care; medical history; genetic information; evidence of insurability, including acts arising out of domestic violence or participation in activities, such as motorcycling, snowmobiling, all-terrain vehicle riding, horseback riding, skiing, and other similar activities; or disability in determining the eligibility of an individual for coverage under a plan. Nothing in this section requires a health plan to offer or provide particular benefits other than those provided under the terms of the plan or prevents a plan or issuer from establishing limitations or restrictions on the amount, level, extent, or nature of the benefits for similarly situated individuals enrolled in the plan or coverage. For purposes of this section, health factor does not include the decision whether to elect health insurance coverage, including the time chosen to enroll, such as under special enrollment or late enrollment.
General Authority:
SDCL  58-18-79.
Law Implemented:
SDCL  58-18-79.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:46 - HIPAA rules - Nondiscrimination in the group market › Section 20:06:46:03 - Rules for eligibility may not discriminate based on any health factor

Current through Register Vol. 51, page 10, July 15, 2024
A carrier subject to this chapter may not establish a rule for eligibility, including continued eligibility, regarding enrollment for benefits under the plan, that discriminates based on any health factor that relates to the individual or dependent of the individual. Rules of eligibility include those relating to:
(1) Enrollment;
(2) The effective date of coverage;
(3) Waiting or affiliation periods;
(4) Late and special enrollment;
(5) Eligibility for benefit packages, including rules for individuals to change their selection among benefit packages;
(6) Benefits, including rules relating to covered benefits, benefit restrictions, and cost-sharing mechanisms, such as coinsurance, copayments, and deductibles, as described in §§
									20:06:46:06  to 20:06:46:08, inclusive;
(7) Continued eligibility; and
(8) Terminating coverage, including disenrollment, of an individual under the plan.
Nothing in this section prohibits a carrier subject to this chapter from establishing more favorable rules of eligibility for individuals with an adverse health factor, such as disability, than for individuals without the adverse health factor.
General Authority:
SDCL  58-18-79.
Law Implemented:
SDCL  58-18-79.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:46 - HIPAA rules - Nondiscrimination in the group market › Section 20:06:46:04 - Condition of enrollment or continued enrollment may not require additional premium for similarly situated individuals

Current through Register Vol. 51, page 10, July 15, 2024
A carrier subject to this chapter may not require an individual, as a condition of enrollment or continued enrollment under the plan, to pay a premium or contribution rate that is greater than the premium or contribution rate for a similarly situated individual enrolled in the plan based on any health factor that relates to the individual or a dependent of the individual. In determining an individual's premium or contribution rate, discounts, rebates, payments-in-kind, and any other premium differential mechanisms shall be taken into account.
Nothing in this section restricts the aggregate amount that a carrier subject to this chapter may charge an employer for coverage under a plan, except that a carrier subject to this chapter may not quote or charge an employer a different premium than that quoted or charged an individual in a group of similarly situated individuals based on a health factor unless permitted under SDCL chapter 58-18 B.
General Authority:
SDCL  58-18-79.
Law Implemented:
SDCL  58-18-79.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:46 - HIPAA rules - Nondiscrimination in the group market › Section 20:06:46:05 - Premium or contribution differential based on completion of a bona fide wellness program

Current through Register Vol. 51, page 10, July 15, 2024
Notwithstanding §
									20:06:46:04, a carrier subject to this chapter may establish a premium or contribution differential based on whether an individual has complied with the requirements of a bona fide wellness program.
A carrier subject to this chapter with a cost-sharing mechanism, such as a deductible, payment, or coinsurance, that requires a higher payment from an individual, based on a health factor of that individual or dependent of that individual, than for a similarly situated individual under the plan, does not violate §§
									20:06:46:06  and 20:06:46:07, if the payment differential is based on whether the individual has complied with the requirements of a bona fide wellness program.
General Authority:
SDCL  58-18-79.
Law Implemented:
SDCL  58-18-79.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:46 - HIPAA rules - Nondiscrimination in the group market › Section 20:06:46:06 - Benefit restrictions must be uniformly applied to all similarly situated individuals

Current through Register Vol. 51, page 10, July 15, 2024
Except as required by this section, §
									20:06:46:03  does not require a carrier subject to this chapter to provide coverage for any particular benefit to any group of similarly situated individuals.
(1) A carrier subject to this chapter shall make the benefits provided under a plan available uniformly to all similarly situated individuals, as those groups are determined under §§
									20:06:46:09  to 20:06:46:12, inclusive.
(2) For any restriction on a benefit or benefits provided under a plan, a carrier subject to this chapter shall apply the restriction uniformly to all similarly situated individuals and may not direct the restriction, as determined based on all of the relevant facts and circumstances, at individual participants or beneficiaries based on any health factor of the participants or beneficiaries.
(3) A carrier subject to this chapter may impose annual, lifetime, or other limits on benefits and may require a deductible, copayment, coinsurance, or other cost-sharing requirement in order to obtain a benefit under the plan if the limit or cost-sharing requirement applies uniformly to all similarly situated individuals and is not directed at individual participants or beneficiaries based on any health factor of the participants or beneficiaries.
(4) For purpose of this section, a plan amendment applicable to all individuals in one or more groups of similarly situated individuals under the plan and made effective no earlier than the first day of the first plan year after the amendment is adopted is not considered per se to be directed at any individual participants or beneficiaries.
General Authority:
SDCL  58-18-79.
Law Implemented:
SDCL  58-18-79.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:46 - HIPAA rules - Nondiscrimination in the group market › Section 20:06:46:07 - Treatment resulting from domestic violence or a medical condition

Current through Register Vol. 51, page 10, July 15, 2024
If a carrier subject to this chapter generally provides benefits for a type of injury, the plan or carrier may not deny an individual participant or beneficiary benefits otherwise provided under the plan for treatment of the injury if the injury results from an act of domestic violence or a medical condition.
General Authority:
SDCL  58-18-79.
Law Implemented:
SDCL  58-18-79.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:46 - HIPAA rules - Nondiscrimination in the group market › Section 20:06:46:08 - Preexisting condition exclusion requirements

Current through Register Vol. 51, page 10, July 15, 2024
Section 20:06:46:03 does not prohibit a carrier subject to this chapter from imposing a preexisting condition exclusion period if the preexisting exclusion period:
(1) Complies with the requirements for imposing a preexisting condition exclusion period pursuant to §§
									20:06:40:01, 20:06:40:04, 20:06:40:08, 20:06:40:09, 20:06:40:10, 20:06:40:15, and SDCL  58-18-45;
(2) Is applied uniformly to all similarly situated individuals, as those groups are determined under §§
									20:06:46:09  to 20:06:46:12, inclusive; and
(3) Is not directed at individual participants or beneficiaries based on any health factor of the participants or beneficiaries.
For purposes of §§
										20:06:46:06  to 20:06:46:12, inclusive, a plan amendment relating to a preexisting condition exclusion that is applicable to all individuals in one or more groups of similarly situated individuals under the plan and made effective no earlier than the first day of the first plan year after the amendment is adopted is not considered per se to be directed at any individual participants or beneficiaries.
General Authority:
SDCL  58-18-79.
Law Implemented:
SDCL  58-18-79.
South Dakota Administrative Rules › Title 20 - PUBLIC SAFETY › Article 20:06 - INSURANCE › Chapter 20:06:46 - HIPAA rules - Nondiscrimination in the group market › Section 20:06:46:09 - Treatment of similarly situated individuals

Current through Register Vol. 51, page 10, July 15, 2024
Sections 20:06:46:06 to 20:06:46:12, inclusive, apply only within a group of individuals who are treated as similarly situated individuals.
General Authority:
SDCL  58-18-79.
Law Implemented:
SDCL  58-18-79.