In this title the following words have the meanings indicated. “Authorized individual” means an individual: known to and screened by the carrier; and for whom the carrier has determined it to be necessary and appropriate that the individual have access to the nonpublic information held by the carrier and its information systems. “Carrier” means: an authorized insurer; a nonprofit health service plan; a health maintenance organization; a dental organization; a managed general agent; or a third–party administrator. “Carrier” does not include: a purchasing group or a risk retention group chartered and licensed in a state other than this State; or a person that is acting as an assuming insurer that is domiciled in another state or jurisdiction. “Consumer” means an individual, including an applicant, a policyholder, an insured, a beneficiary, a claimant, and a certificate holder, who is a resident of the State and whose nonpublic information is in a carrier’s possession, custody, or control. “Cybersecurity event” means an event resulting in unauthorized access to, or disruption or misuse of, an information system or nonpublic information stored on an information system. “Cybersecurity event” does not include: the unauthorized acquisition of encrypted nonpublic information if the encryption, process, or key is not also acquired, released, or used without authorization; or an event with regard to which the carrier has reasonably determined that the nonpublic information accessed by an unauthorized person has not been and will not be used or released and has been returned or destroyed. “Encrypted” means the transformation of data into a form which results in a low probability of assigning meaning without the use of a protective process or key. “Information security program” means the administrative, technical, and physical safeguards that a carrier uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle nonpublic information. “Information system” means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of electronic information. “Information system” includes industrial or process control systems, telephone switching and private branch exchange systems, environmental control systems, and other specialized systems. “Multifactor authentication” means authentication through verification of at least two of the following types of authentication factors: knowledge factors, such as a password; possession factors, such as a token or text message on a mobile phone; or inherence factors, such as a biometric characteristic. “Nonpublic information” means information that is not publicly available information and is: business–related information of a carrier the tampering with which, or unauthorized disclosure, access, or use of which, would cause a material adverse impact to the business, operations, or security of the carrier; information concerning a consumer that, because of name, number, personal mark, or other identifier, can be used to identify the consumer, in combination with one or more of the following data elements: Social Security number; driver’s license number or nondriver identification card number; account, credit, or debit card number; a security code, an access code, or a password that would allow access to a consumer’s financial account; or biometric records; or information or data, except age or gender, in any form or medium created by or derived from a health care provider or a consumer that can be used to identify a particular consumer and that relates to: the past, present, or future physical, mental, or behavioral health or condition of a consumer or a member of the consumer’s family; the provision of health care to a consumer; or payment for the provision of health care to a consumer. “Publicly available information” means information that a carrier has a reasonable basis to believe is lawfully made available to the general public from: federal, State, or local government records; widely distributed media; or disclosures to the general public that are required to be made by federal, State, or local law; and steps taken by the carrier to determine: that the information is of the type that is available to the general public; and whether a consumer can direct that the information be made unavailable to the general public and, if so, that the consumer has not done so. “Risk assessment” means the risk assessment that a carrier is required to conduct under § 33–103(c) of this title. “Third–party service provider” means a person, other than a carrier, that contracts with a carrier to maintain, process, store, or is otherwise authorized access to nonpublic information through its provision of services to the carrier.

The purpose of this title is to establish standards for: data security; and the investigation of and notification to the Commissioner of a cybersecurity event applicable to carriers. This title may not be construed to: create or imply a private cause of action for violation of its provisions; or curtail a private cause of action which would otherwise exist in the absence of this title. Compliance with this title does not relieve a carrier from a duty to comply with any other requirements of federal law or Title 14 of the Commercial Law Article relating to the protection and privacy of personal information.

Each carrier shall develop, implement, and maintain a comprehensive written information security program based on the carrier’s risk assessment. The information security program shall contain administrative, technical, and physical safeguards for the protection of nonpublic information and the carrier’s information system. A carrier’s information security program shall be commensurate with: the size and complexity of the carrier; the nature and scope of the carrier’s activities, including its use of third–party service providers; and the sensitivity of the nonpublic information used by the carrier or in the carrier’s possession, custody, or control. A carrier’s information security program shall be designed to: protect the security and confidentiality of nonpublic information and the security of the information system; protect against threats or hazards to the security or integrity of nonpublic information and the information system; protect against unauthorized access to or use of nonpublic information and minimize the likelihood of harm to a consumer; and define and periodically reevaluate a schedule for retention of nonpublic information and a mechanism for its destruction when no longer needed. Each carrier shall: designate one or more employees, an affiliate, or an outside vendor designated to act on behalf of the carrier who is responsible for the information security program; identify reasonably foreseeable internal or external threats that could result in unauthorized access, transmission, disclosure, misuse, alteration, or destruction of nonpublic information, including the security of information systems and nonpublic information that are accessible to, or held by, third–party service providers; assess the likelihood and potential damage of the threats described under item (2) of this subsection, taking into consideration the sensitivity of the nonpublic information; assess the sufficiency of policies, procedures, information systems, and other safeguards in place to manage the threats described under item (2) of this subsection, including consideration of threats in each relevant area of the carrier’s operations, such as: employee training and management; information systems, including network and software design, as well as information classification, governance, processing, storage, transmission, and disposal; and detecting, preventing, and responding to attacks, intrusions, or other system failures; implement information safeguards to manage the threats identified in its ongoing assessment; and at least annually, assess the effectiveness of the key controls, systems, and procedures of the safeguards. Based on its risk assessment, a carrier shall: design its information security program to mitigate the identified risks, commensurate with the size and complexity of the carrier’s activities, including its use of third–party service providers, and the sensitivity of the nonpublic information used by the carrier or in the carrier’s possession, custody, or control; and determine which of the following security measures are appropriate and implement the appropriate security measures: placement of access controls on information systems, including controls to authenticate and allow access only to authorized individuals to protect against the unauthorized acquisition of nonpublic information; identification and management of the data, personnel, devices, systems, and facilities that enable the organization to achieve business purposes in accordance with their relative importance to business objectives and the organization’s risk strategy; restriction of access at physical locations containing nonpublic information to authorized individuals only; protection, by encryption or other appropriate means, of all nonpublic information: during transmission over an external network; and stored on a laptop computer or other portable computing or storage device or media; adoption of secure development practices for in–house developed applications used by the carrier and procedures for evaluating, assessing, or testing the security of externally developed applications used by the carrier; modification of the information system in accordance with the carrier’s information security program; use of effective controls, which may include multifactor authentication procedures for an individual accessing nonpublic information; regular testing and monitoring of systems and procedures to detect actual and attempted attacks on, or intrusions into, information systems; inclusion of audit trails within the information security program designed to: detect and respond to cybersecurity events; and reconstruct material financial transactions sufficient to support normal operations and obligations of the carrier; implementation of measures to protect against destruction, loss, or damage of nonpublic information due to environmental hazards, such as fire and water damage or other catastrophes or technological failures; and development, implementation, and maintenance of procedures for the secure disposal of nonpublic information in any format. A carrier’s enterprise risk management process shall include cybersecurity risks. Each carrier shall: stay informed regarding emerging threats or vulnerabilities and use reasonable security measures when sharing information relative to the character of the sharing and the type of information shared; and provide its personnel with cybersecurity awareness training that is updated as necessary to reflect risks identified by the carrier in the risk assessment. If a carrier has a board of directors, the board or an appropriate committee of the board shall, at a minimum: require the carrier’s executive management or its delegates to develop, implement, and maintain the carrier’s information security program; and require the carrier’s executive management or its delegates to report in writing, at least annually, the following information: the overall status of the information security program and the carrier’s compliance with this title; and material matters related to the information security program, addressing issues such as risk assessment, risk management and control decisions, third–party service provider arrangements, results of testing, cybersecurity events or violations and management’s responses thereto, and recommendations for changes in the information security program. If executive management of a carrier delegates any of the responsibilities under this section, the executive management shall: oversee the development, implementation, and maintenance of the carrier’s information security program prepared by the delegates; and receive a report from the delegates that complies with the requirements for the report to the board of directors under paragraph (1) of this subsection. A carrier shall require a third–party service provider to implement appropriate administrative, technical, and physical measures to protect and secure the information systems and nonpublic information that are accessible to or held by the third–party service provider. Each carrier shall establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity, or availability of nonpublic information in its possession, the carrier’s information systems, or the continuing functionality of any aspect of the carrier’s business or operations. The incident response plan shall address the following areas: the internal process for responding to a cybersecurity event; the goals of the incident response plan; the definition of clear roles, responsibilities, and levels of decision–making authority; external and internal communications and information sharing; identification of requirements for the remediation of identified weaknesses in information systems and associated controls; documentation and reporting regarding cybersecurity events and related incident response activities; and the evaluation and revision, as necessary, of the incident response plan following a cybersecurity event. Except as provided in subsection (k) of this section, on or before April 15 each year, each carrier shall submit to the Commissioner a written statement certifying that the carrier is in compliance with the requirements set forth in this section. Each carrier shall maintain for examination by the Commissioner all records, schedules, and data supporting this certificate for a period of 5 years. A carrier that is not domiciled in the State is exempt from the provisions of subsection (j)(1) of this section if the carrier: is domiciled in another United States insuring jurisdiction that has adopted a law or regulation that is substantially similar to this section; is subject to that law or regulation; is required to file a certification of compliance with its domestic regulator under that law or regulation; and actually files the required certification with its domestic regulator; or is a member of an insurance holding company system, as defined in § 7–101 of this article; and has implemented and is subject to an information security program that has been approved and is maintained by another carrier within the same insurance holding company system that meets all of the criteria set forth in item (1) of this subsection.

If a carrier learns that a cybersecurity event has or may have occurred, the carrier or an outside vendor or service provider designated to act on behalf of the carrier shall conduct a prompt investigation. During the investigation, the carrier or an outside vendor or service provider designated to act on behalf of the carrier, shall, at a minimum: determine as much of the following information as possible: whether a cybersecurity event has occurred; the nature and scope of the cybersecurity event; and identification of nonpublic information that may have been involved in the cybersecurity event; and perform or oversee reasonable measures to restore the security of the information systems compromised in the cybersecurity event to prevent further unauthorized acquisition, release, or use of nonpublic information in the carrier’s possession, custody, or control. If a carrier learns that a cybersecurity event has or may have occurred in a system maintained by a third–party service provider, the carrier shall complete the steps listed in subsection (b) of this section or confirm and document that the third–party service provider has completed those steps. A carrier shall: maintain records concerning all cybersecurity events for a period of at least 5 years from the date of the cybersecurity event; and produce the records on demand of the Commissioner.

A carrier shall notify the Commissioner as promptly as possible but in no event later than 3 business days from a determination that a cybersecurity event has occurred when either of the following criteria has been met: the State is the carrier’s state of domicile; and the cybersecurity event has a reasonable likelihood of harming a consumer residing in the State or any material part of the normal operations of the carrier; or the carrier reasonably believes that the nonpublic information involved is of 250 or more consumers residing in the State and either of the following circumstances is present: a cybersecurity event impacting the carrier has occurred for which notice must be provided to a government body, self–regulatory agency, or any other supervisory body under state or federal law; or a cybersecurity event has occurred that has a reasonable likelihood of materially harming: a consumer residing in the State; or a material part of the normal operation of the carrier. The carrier shall provide as much of the following information as reasonably possible: the date of the cybersecurity event; a description of how the information was exposed, lost, stolen, or breached, including the specific roles and responsibilities of third–party service providers, if any; how the cybersecurity event was discovered; whether any lost, stolen, or breached information has been recovered and, if so, how this was done; the identity of the source of the cybersecurity event; whether the carrier has filed a police report or has notified a regulatory, government, or law enforcement agency and, if so, when the notification was provided; a description of the specific types of information acquired without authorization and, more specifically, particular data elements, such as types of medical information, types of financial information, or types of information allowing identification of the consumer; the period during which the information system was compromised by the cybersecurity event; the number of total consumers in the State affected by the cybersecurity event, with the carrier providing: the best estimate of this number in its initial report to the Commissioner; and an updated estimate of this number in each subsequent report to the Commissioner in accordance with this section; the results of any internal review: identifying a lapse in either automated controls or internal procedures; or confirming that all automated controls or internal procedures were followed; a copy of the carrier’s privacy policy and a statement outlining the steps the carrier will take to investigate and notify consumers affected by the cybersecurity event; and the name of a contact person who is both familiar with the cybersecurity event and authorized to act for the carrier. A carrier shall provide the information required under this section in electronic form as directed by the Commissioner. A carrier shall have a continuing obligation to update and supplement initial and subsequent notifications to the Commissioner concerning the cybersecurity event. A carrier shall comply with § 14–3504 of the Commercial Law Article, as applicable, and provide a copy of the notice sent to consumers under that section to the Commissioner. If a managed care organization conducts an investigation as required by the Maryland Department of Health in accordance with the managed care organization’s contract with the Maryland Department of Health and determines that a cybersecurity event has occurred, the managed care organization shall provide to the Commissioner copies of all notices and reports provided to the Maryland Department of Health at the same time and in the same manner that the managed care organization provides the notices and reports to the Maryland Department of Health.

A carrier that is subject to, governed by, and compliant with the privacy, security, and breach notification rules issued by the U.S. Department of Health and Human Services, 45 C.F.R. Parts 160 and 164, established under the Health Insurance Portability and Accountability Act of 1996, and the Health Information Technology for Economic and Clinical Health Act, and that maintains nonpublic information in the same manner as protected health information: shall be deemed to be in compliance with §§ 33–103 and 33–104 of this title; and must comply with § 33–105(a) through (d) of this title. A carrier that is subject to, governed by, and in compliance with § 33–103 of this title shall be deemed to be in compliance with §§ 14–3502 and 14–3503 of the Commercial Law Article.

Documents, materials, and other information in the control or possession of the Commissioner that are furnished by a carrier or an employee or agent thereof acting on behalf of the carrier under § 33–103(j) or § 33–105(b)(2) through (5), (8), (10), and (11) of this title or that are obtained by the Commissioner in an investigation or examination under this section or from a managed care organization in accordance with § 33–105(f) of this title: are confidential by law and privileged; are not subject to the Maryland Public Information Act; are not subject to subpoena; and are not subject to discovery or admissible in evidence in a private civil action. The Commissioner is authorized to use the documents, materials, and other information in the furtherance of a regulatory or legal action brought as a part of the Commissioner’s duties. The Commissioner and any person who received documents, materials, or other information while acting under the authority of the Commissioner may not be allowed or required to testify in a private civil action concerning confidential documents, materials, or other information subject to subsection (a) of this section. The Commissioner may: if the recipient agrees to maintain the confidentiality and privileged status of the documents, materials, or other information, share documents, materials, or other information, including the confidential and privileged documents, materials, or other information subject to subsection (a) of this section, with: other state, federal, and international regulatory agencies; the National Association of Insurance Commissioners, its affiliates, or subsidiaries; and state, federal, and international law enforcement authorities, provided that the recipient agrees to maintain the confidentiality and privileged status of the document, material, or other information; receive documents, materials, or other information, including otherwise confidential and privileged documents, materials, or other information, from: the National Association of Insurance Commissioners, its affiliates, or subsidiaries; and regulatory and law enforcement officials of other foreign or domestic jurisdictions; share documents, materials, or other information subject to subsection (a) of this section with a third–party consultant or vendor, if the consultant agrees in writing to maintain the confidentiality and privileged status of the document, material, or other information; and enter into agreements governing sharing and use of information consistent with this subsection. The Commissioner shall maintain as confidential or privileged any document, material, or other information received under subsection (c)(2) of this section with notice or the understanding that it is confidential or privileged under the laws of the jurisdiction that is the source of the document, material, or other information. A waiver of an applicable privilege or claim of confidentiality in the documents, materials, or other information may not occur as a result of disclosure to the Commissioner under this section or as a result of sharing as authorized in subsection (c) of this section. This section does not prohibit the Commissioner from releasing final, adjudicated actions that are open to public inspection.

In addition to any other sanction to which a carrier may be subject, a carrier that violates a provision of this title is subject to a penalty of not less than $100 but not more than $125,000 for each violation of this title.

The Commissioner may adopt regulations consistent with this title.