Chapter 420-P Insurance Data Security Law, Additional Guidance Regarding Submission of Certifications

The State of New Hampsh· Insurance De ar ire 21 South Fruit StrPet s ~tmen t C , UI e 14 oncord, NH 03301 (603) 271-2261 F TDD A ax (603) 271-1406 ccess: Relay NH 1-800-735-2964 CChrist?P?er R. Nicolopoulos omm1ss1oner Alexander K. Feldvebel Deputy Commissioner Bulletin Docket No: INS 20-013-AB To: All Insurers and Licensees From: Christopher R. Nicolopoulos, Commissioner C..R..JJ. Date: April 10, 2020 Re: SChbapt~r ~20-P Ins~ance_ Data Security Law, Additional Guidance Regarding u m1ss10n of Cert1ficatwns During its 2019 session, the legislature enacted a new chapter, RSA 420-P, relating to insurance data security. RSA 420-P became effective January 1, 2020. On January 2, 2020, the Insurance Department issued Bulletin INS-20-001-AB providing information regarding the new requirements of the Insurance Data Security Law. The purpose of this bulletin is to provide additional guidance regarding filing annual certifications and safe harbor exceptions. Information Security Program: Licensees (unless excepted) must develop, implement, and maintain a comprehensive written information security program that complies with the requirements of RSA 420-P:4. Licensees will have until January 1, 2021, to implement a security program that is compliant with RSA 420-P:4. Annual Certification for Domestic Insurers: Beginning March 1, 2021, all insurers domiciled in New Hampshire must submit a written statement to the Commissioner certifying that the insurer is in compliance with the requirements of RSA 420-P:4. This certification can be completed by filling out the "New Hampshire Insurance Data Security Law Information Security Program Certification Form." If the insurer has (1) established and maintains an information security program that is compliant with the Health Insurance Portability and Accountability Act of 1996 (HIP AA) and with Parts 160 and 164 of Title 45 of the Code of Federal Regulations for protected health information and maintains other nonpublic consumer information in the same manner, or (2) established and maintains an information security program that is compliant with N.Y. Comp. Codes R. & Regs. Title 23, section 500, the "New Hampshire Insurance Data Security Law Exception Certification Form" may be submitted in the place of the certification form. Both forms are available online at https://www.nh.gov/insurance/legal/cybersecurity.htm and should be submitted with the insurer's annual filings due March 1 each year. Written Statements Certifying Compliance for all other licensees: Beginning January 1, 2021, all licensees in New Hampshire must have an Information Security Program that meets the requirements of RSA 420-P:4, unless a licensee falls within an exception pursuant to RSA 420-P:9, or a safe harbor provision, pursuant to RSA 420-P:10 or RSA 420:P: 11. Licensees, other than domestic insurers, are not required to submit anything certifying compliance with the requirements of RSA 420-P:4. However, all licensees should have the plan and any corresponding documentation readily available in the event the commissioner requests their production. Any licensee that (1) establishes and maintains an information security program that is compliant with the Health Insurance Portability and Accountability Act of 1996 (HIP AA) and with Parts 160 and 164 of Title 45 of the Code of Federal Regulations for protected health information and maintains other nonpublic consumer information in the same manner, or (2) establishes and maintains an information security program that is compliant with N.Y. Comp. Codes R. & Regs. Title 23, section 500 must submit a written statement to the Department certifying compliance with either RSA 420-P: 10 or RSA 420-P: 11 . This written statement may be submitted by filling out the "New Hampshire Insurance Data Security Law Exception Certification Form" available online at https://www.nh.gov/insurance/legal/cybersecurity.htm. All exception forms for licensees must be filed no later than March 1, 2021. Licensees that are not domestic insurers only need to file the Exception Certification Form with the Department once.