Title XIII, COMMERCE (Ch. 505 - 554I)

1. This chapter shall not apply to a licensee that is subject to, and in compliance with, the Health Insurance Portability and Accountability Act . The licensee shall annually submit to the commissioner a written certification of the licensee’s compliance with HIPAA. 2. This chap…

A licensee that violates this chapter shall be subject to penalties pursuant to section 505.7A and chapter 507B . 2021 Acts, ch 79, §14, 17

1. The commissioner may adopt rules pursuant to chapter 17A as necessary to administer this chapter . 2. The commissioner may take any enforcement action under the commissioner’s authority to enforce compliance with this chapter . 2021 Acts, ch 79, §15, 17

If any provision of this chapter or its application to any person or circumstance is held invalid, the invalidity shall not affect other provisions or applications of this chapter which can be given effect without the invalid provision or application, and to this end the provisio…

1. Notwithstanding any provision of law to the contrary, this chapter establishes the exclusive state standards for data security, and the investigation and notification of cybersecurity events, applicable to licensees. 2. This chapter shall not be construed to create or imply a …

As used in this chapter , unless the context otherwise requires: 1. “Authorized individual” means an individual known to and screened by a licensee and determined to be necessary and appropriate to have access to nonpublic information held by the licensee and the licensee’s infor…

1. a. Commensurate with the size and complexity of a licensee, the nature and scope of a licensee’s activities including the licensee’s use of third-party service providers, and the sensitivity of nonpublic information used by the licensee or that is in the licensee’s possession,…

1. A licensee shall exercise due diligence in the selection of third-party service providers, conduct oversight of all third-party service provider arrangements, and require all third-party service providers to implement appropriate administrative, technical, and physical measure…

1. If a licensee discovers that a cybersecurity event has occurred, or that a cybersecurity event may have occurred, the licensee, or the outside vendor or third-party service provider the licensee has designated to act on behalf of the licensee, shall conduct a prompt investigat…

1. A licensee shall notify the commissioner no later than three business days from the date of the licensee’s confirmation of a cybersecurity event if any of the following conditions apply: a. The licensee is an insurer who is domiciled in this state, or is a producer whose home …

1. In the event of a cybersecurity event involving nonpublic information a licensee shall comply with the notification requirements pursuant to section 715C.2 , and all other applicable notification requirements pursuant to federal or state law. 2. If a licensee is required to pr…

1. If a licensee becomes aware of a cybersecurity event in an information system maintained by a third-party service provider of the licensee, the licensee shall comply with section 507F.7 , or the licensee may obtain a written certification from the third-party service provider …