The Hawaii Insurance Commissioner, David Ige, has signed Act 112 into law, adopting the National Association of Insurance Commissioners' Insurance Data Security Model Law to establish insurance data security standards for Hawaii insurance licensees.
The act applies to all of the State's insurance licensees, including "every licensed insurer, producer, and any other person licensed or required to be licensed, authorized or required to be authorized, or registered or required to be registered, under [Hawaii Revised Statutes (HRS)] chapter 431 or 432, or holding a certificate of authority under chapter 432D." The HRS exempts certain licensees under the Act.
Part II of the Act mandates licensees to develop, implement and maintain a comprehensive written information security program that complies with certain requirements. Part II also requires each insurer domiciled in Hawaii to submit certification of the insurer's compliance with the Act to the commissioner by March 31.
The third part of the Act requires licensees to investigate cybersecurity events promptly and notify the commissioner of a cybersecurity event as promptly as possible but no later than three business days from a determination of a cybersecurity event impacted by 250 or more consumers has occurred.
The Act became effective July 1, 2021 but licensees, other than risk retention groups, will have until July 1, 2022, and July 1, 2023 to implement certain sections of the Act. Risk retention groups will have until July 1, 2023, and July 1, 2024 to implement some sections of the Act. The specifics can be found here.