of the Insurance Article

REVISED BULLETIN NO. 23-18 DATE: October 20, 2023 TO: All insurers, nonprofit health service plans, health maintenance organizations, dental organizations, managing general agents, and third party administrators doing business in Maryland RE: § 33-103 of the Insurance Article The purpose of this Bulletin is to remind all carriers, as defined in § 33-101(c) of the Insurance Article1, of the requirements of § 33-103. As of October 1, 2023, carriers are required to have in place a comprehensive written information security program based on the carrier’s risk assessment (“information security plan”) and a written incident response plan (“response plan”) designed to promptly respond to, and recover from, a cybersecurity event. A carrier that does not fall into an exception noted in Section 5 of the Act must be in compliance with the provisions of § 33-103 of the Insurance Article, other than § 33- 103(h), on or before October 1, 2023. A carrier that is required to be in compliance as of October 1, 2023, but is not, should contact the Maryland Insurance Administration (“Administration”) to discuss the status of implementation. The Administration may require a carrier to provide a copy of its written information security plan, its event response plan, or both, at any time. Carriers that report a cybersecurity event to the Administration should expect to be asked for a copy of both plans. 1 Unless otherwise specified, all statutory references herein are to the Insurance Article of the Annotated Code of Maryland. KATHLEEN A. BIRRANE Commissioner TAMMY R. J. LONGAN Acting Deputy Commissioner MARY M. KWEI Associate Commissioner Market Regulation & Professional Licensing WES MOORE Governor ARUNA MILLER Lt. Governor 200 St. Paul Place, Suite 2700, Baltimore, Maryland 21202 Direct Dial: 410-468-2113 Fax: 410-468-2020 Email: Mary.Kwei@maryland.gov 1-800-492-6116 TTY: 1-800-735-2258 www.insurance.maryland.gov Carriers that are subject to § 33-103 are required to file a certification of compliance with the Administration on or before April 15 of each year. Carriers are exempt from filing the certification if they meet the following requirements: (1)(i) is domiciled in another United States insuring jurisdiction that has adopted a law or regulation that is substantially similar to [§ 33-103]; (ii) is subject to that law or regulation; (iii) is required to file a certification of compliance with its domestic regulator under that law or regulation; and (iv) actually files the required certification with its domestic regulator; or (2)(i) is a member of an insurance holding company system, as defined in § 7–101 of this article; and (ii) has implemented and is subject to an information security program that has been approved and is maintained by another carrier within the same insurance holding company system that meets all of the criteria set forth in item (1) of this subsection. The Administration has received inquiries from companies that are not domiciled in New York, but file certifications of compliance under New York law. The inquiries ask whether the New York filing would be sufficient to exempt the carriers from filing a certification with the Administration. Unless the carrier is domiciled in New York, then filing a certification with New York is not sufficient to exempt the carrier from compliance with Maryland law. The Administration will provide additional details of how to file the certification early in 2024. The Administration plans to have a form for filing on its website. Questions or comments may be sent to Mary Kwei, Associate Commissioner, Market Regulation and Professional Licensing, Maryland Insurance Administration, 200 Saint Paul Place, Suite 2700, Baltimore, MD 21202, or call 410-468-2113, or email to mary.kwei@maryland.gov KATHLEEN A. BIRRANE Commissioner signature on file with original By: _____________________ Mary M. Kwei Associate Commissioner Market Regulation & Professional Licensing