(a) In the case of a cybersecurity event involving nonpublic information that is in the possession, custody, or control of a licensee that is an insurer or its third-party service provider, and for which a consumer accessed the insurer’s services through an independent insurance producer, the insurer shall notify the producers of record of all affected consumers as soon as practicable as directed by the commissioner.

Terms Used In Hawaii Revised Statutes 431:3B-306

  • Commissioner: means the insurance commissioner of the State. See Hawaii Revised Statutes 431:3B-101
  • Consumer: means an individual, including but not limited to applicants, policyholders, insureds, beneficiaries, claimants, and certificate holders, who is a resident of this State and whose nonpublic information is in a licensee's possession, custody, or control. See Hawaii Revised Statutes 431:3B-101
  • Cybersecurity event: means an event resulting in unauthorized access to, or disruption or misuse of, an information system or nonpublic information stored on that information system. See Hawaii Revised Statutes 431:3B-101
  • Obligation: An order placed, contract awarded, service received, or similar transaction during a given period that will require payments during the same or a future period.
  • Third-party service provider: means a person, not otherwise defined as a licensee, that contracts with a licensee to maintain, process, store, or otherwise is permitted access to nonpublic information through its provision of services to the licensee. See Hawaii Revised Statutes 431:3B-101
(b) The insurer is exempt from this obligation in instances where it does not have the current producer of record information for any individual consumer.

  Previous
Next  
 Part III Contents