R590. Insurance, Administration.R590-216. Standards for Safeguarding Customer Information.
R590-216-1. Authority.
This rule is promulgated by the commissioner pursuant to Sections 31A-2-201 and 31A-23a-417.
R590-216-2. Purpose and Scope.
(1) The purpose of this rule is to establish standards to assist a licensee in developing and implementing administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information under the Gramm-Leach-Bliley Act, 15 U.S.C. 6801, 6805(b), and 6807.
(2) This rule applies to a licensee of the department that obtains any nonpublic information from a customer, including:
(a) nonpublic personal financial information; or
(b) nonpublic personal health information.
R590-216-3. Definitions.
Terms used in this rule are defined in Section 31A-1-301. Additional terms are defined as follows:
(1) "Customer" means a customer of the licensee as defined in Section R590-206-4.
(2) "Customer information" has the same meaning as "nonpublic personal information" as defined in Section R590-206-4 about a customer, whether in paper, electronic, or other form, that is maintained by or on behalf of the licensee.
(3) "Customer information system" means any electronic or physical method used to access, collect, store, use, transmit, protect, or dispose of customer information.
(4)(a) "Licensee" means a licensee as defined in Section R590-206-4.
(b) "Licensee" does not mean:
(i) a purchasing group;
(ii) a manufacturer or seller warranty provider or manufacturer or seller service contract provider exempted by Section R590-206-2; or
(iii) an unauthorized insurer regarding the excess line business conducted pursuant to Section 31A-15-103.
(5) "Service provider" means a person who maintains, processes, or otherwise is permitted access to customer information through the provision of services directly to the licensee.
R590-216-4. Information Security Program.
(1) A licensee shall implement a comprehensive written information security program including administrative, technical, and physical safeguards to protect customer information.
(2) The administrative, technical, and physical safeguards included in the information security program shall be appropriate to the size and complexity of the licensee and the nature and scope of its activities.
R590-216-5. Objectives of Information Security Program.
A licensee's information security program shall:
(1) ensure the security and confidentiality of customer information;
(2) protect against any anticipated threat or hazard to the security or integrity of the information; and
(3) protect against unauthorized access to or use of the information that could result in substantial harm or inconvenience to any customer.
R590-216-6. Methods of Development and Implementation.
(1) For purposes of risk assessment, a licensee may:
(a) identify reasonably foreseeable internal or external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information or customer information systems;
(b) assess the likelihood and potential damage of these threats, taking into consideration the sensitivity of customer information; and
(c) assess the sufficiency of policies, procedures, customer information systems, and other safeguards in place to control risks.
(2) For purposes of risk management and control, a licensee may:
(a) design its information security program to control the identified risks, consistent with the sensitivity of the information, as well as the complexity and scope of the licensee's activities;
(b) train staff to implement the licensee's information security program; and
(c) regularly test or otherwise monitor the key controls, systems, and procedures of the information security program, the frequency and nature of which shall be determined by the licensee's risk assessment.
(3) For purposes of service provider arrangement oversight, a licensee may:
(a) exercise due diligence in selecting its service providers; and
(b) require its service providers to implement appropriate measures designed to meet the objectives of this rule, and, where indicated by the licensee's risk assessment, take appropriate steps to confirm that its service providers have satisfied these obligations.
