(1) To protect personal identifying information, as defined in section 6-1-713 (2), from unauthorized access, use, modification, disclosure, or destruction, a covered entity that maintains, owns, or licenses personal identifying information of an individual residing in the state shall implement and maintain reasonable security procedures and practices that are appropriate to the nature of the personal identifying information and the nature and size of the business and its operations.
(2) Unless a covered entity agrees to provide its own security protection for the information it discloses to a third-party service provider, the covered entity shall require that the third-party service provider implement and maintain reasonable security procedures and practices that are:
(a) Appropriate to the nature of the personal identifying information disclosed to the third-party service provider; and
(b) Reasonably designed to help protect the personal identifying information from unauthorized access, use, modification, disclosure, or destruction.
(3) For the purposes of subsection (2) of this section, a disclosure of personal identifying information does not include disclosure of information to a third party under circumstances where the covered entity retains primary responsibility for implementing and maintaining reasonable security procedures and practices appropriate to the nature of the personal identifying information and the covered entity implements and maintains technical controls that are reasonably designed to:
(a) Help protect the personal identifying information from unauthorized access, use, modification, disclosure, or destruction; or
(b) Effectively eliminate the third party's ability to access the personal identifying information, notwithstanding the third party's physical possession of the personal identifying information.
(4) A covered entity that is regulated by state or federal law and that maintains procedures for protection of personal identifying information pursuant to the laws, rules, regulations, guidances, or guidelines established by its state or federal regulator is in compliance with this section.
(5) For the purposes of this section, third-party service provider means an entity that has been contracted to maintain, store, or process personal identifying information on behalf of a covered entity.
Source: L. 2018: Entire section added, (HB 18-1128), ch. 266, p. 1633, � 2, effective September 1.
6-1-714. Unfair drug pricing practice - deceptive trade practice - definitions. (1) As used in this section, unless the context otherwise requires:
(a) Emergency means a declaration made by the department of public health and environment pursuant to section 25-1.5-101 (1)(aa), C.R.S., after the department has determined that there is a shortage of drugs critical to public safety.
(b) Unfair drug pricing means charging a consumer an unconscionable amount for the sale of a drug. Unfair drug pricing occurs if:
(I) The price charged by a wholesaler, distributor, or retailer exceeds by more than ten percent the average price for the drug charged by that wholesaler, distributor, or retailer during the thirty days immediately preceding the declaration of an emergency; and
(II) The increase in the amount charged by a wholesaler, distributor, or retailer is not attributable to cost factors of the retailer, including, but not limited to, replacement costs, taxes, and transportation costs incurred by that wholesaler, distributor, or retailer.
(2) A person engages in a deceptive trade practice when, in the course of such person's business, vocation, or occupation, the person engages in the practice of unfair drug pricing.
Source: L. 2005: Entire section added, p. 372, � 2, effective April 22.