§ 14-5-1406 — SECURITY OF INFORMATION

(1) If a holder is required to include confidential information in a report to the administrator, the information must be provided by a secure means.
(2) If confidential information in a record is provided to and maintained by the administrator or administrator’s agent as required by this chapter, the administrator or agent shall:
(a) Implement administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of the information as required by the laws of this state and federal privacy and data security law;
(b) Protect against reasonably anticipated threats or hazards to the security, confidentiality, or integrity of the information; and
(c) Protect against unauthorized access to or use of the information that could result in substantial harm or inconvenience to a holder or the holder’s customers, including insureds, annuitants, and policy or contract owners and their beneficiaries.
(3) The administrator shall:
(a) Implement the data and information security plans adopted by the state; and
(b) Ensure that an administrator’s agent adopts and implements an appropriate plan with respect to confidential information in the agent’s possession.
(4) The administrator or the administrator’s agent shall educate and train employees regarding the plan adopted under subsection (3) of this section.
(5) The administrator or the administrator’s agent shall in a secure manner return or destroy all confidential information no longer reasonably needed under this chapter.

Legislative History

[14-5-1406, added 2024, ch. 27, sec. 2, p. 215.]