Bulletin 2018-12- Insurance Data Security Act Exemptions

[LOGO] South Carolina Department of Insurance Capitol Center 1201 Main St., Suite 1000 Columbia, South Carolina 29201 Mailing Address: P.O. Box 100105, Columbia, S.C. 29202-3105 Telephone: (803) 737-6160 HENRY McMASTER Governor RAYMOND G. FARMER Director # BULLETIN NUMBER 2018-12 TO: All Licensees of the South Carolina Department of Insurance FROM: Raymond G. Farmer, Director of Insurance Raymond G. Farmer SUBJECT: Information Security Program Exemptions South Carolina Insurance Data Security Act, 2018 S.C. Act No. 171 DATE: November 2, 2018 # I. Purpose This is the third in a series of bulletins addressing the implementation of the South Carolina Insurance Data Security Act (2018 S.C. Act No. 171 ("Act")). The Act is codified as Chapter 99 of Title 38 of the South Carolina Code of Laws. This Bulletin specifically addresses exemptions from the information security program requirements. # II. Information Security Program Requirements The Act defines licensee as a person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered pursuant to the insurance laws of this State but does not include a purchasing group or a risk retention group chartered and licensed in a state other than this State or a licensee that is acting as an assuming insurer that is domiciled in another state or jurisdiction. Absent an exemption, all licensees as defined by the Act are required to develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment. The information security program must contain administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system. The information security program must be commensurate with the size and complexity of the licensee, the nature and scope of the licensee's activities, including its use of third-party service providers, and the sensitivity of the nonpublic information used by the licensee or in the licensee's possession, custody, or control. See S.C. Code Ann. §38-99-20 for additional information regarding the Act's information security program requirements. Bulletin 2018-12 · Page 1 ### III. Exemptions The following licensees are exempt from the requirements of Section 38-99-20, including developing their own information security programs: - A licensee with fewer than ten employees, including any independent contractors; - A licensee who is an employee, agent, representative or designee of a licensee to the extent that the employee, agent, representative or designee is covered by the information security program of another licensee; - A licensee who is subject to the Health Insurance Portability and Accountability Act (HIPAA), that has established and maintains an information security program pursuant to such statutes, rules, regulations, procedures or guidelines established thereunder, provided that the licensee is compliant with and submits a written statement certifying its compliance with the provisions of Section 38-99-20; and - A licensee who is subject to the New York cybersecurity regulation, provided that the licensee is compliant with and submits a written statement certifying its compliance with the provisions of Section 38-99-20. While a licensee may be exempt from developing its own information security program, licensees must still comply with other provisions of the Act, such as the prompt investigation and reporting of cybersecurity events to the Director. See Bulletin Number 2018-09 for more information on the reporting requirement. Additionally, qualifying for an exemption under this Act does not exempt a licensee from the duty to protect data under other state and federal laws including, but not limited to, the Gramm Leach Bliley Act (GLBA), Fair Credit Reporting Act (FCRA), Fair and Accurate Credit Transactions Act (FACTA), Federal Trade Commission Act (FTC Act), and the Health Insurance Portability and Accountability Act (HIPAA). In the event a licensee ceases to qualify for an exemption, such licensee shall have one hundred and eighty (180) days to comply with all requirements of the Act. Licensees do not need to proactively communicate their exemption status to the Department. The Department may conduct random inspections/examinations to determine compliance with this section of the Act. Moreover, the licensee must be able to provide documentation supporting a qualifying exemption upon request of the Department. ### IV. Questions Questions regarding this bulletin should be directed to Melissa Manning, Associate General Counsel, at mmanning@doi.sc.gov. Bulletins are the method by which the Director of Insurance formally communicates with persons and entities regulated by the Department. Bulletins are Departmental interpretations of South Carolina insurance laws and regulations and provide guidance on the Department's enforcement approach. Bulletins do not provide legal advice. Readers should consult applicable statutes and regulations or contact an attorney for legal advice or for additional information on the impact of that legislation on their specific situation. Bulletin 2018-12 Page 2