SB 1100 Summary

• Adopts the National Association of Insurance Commissioners' Insurance Data Security Model Law to establish exclusive state cybersecurity standards for Hawaii insurance licensees, effective July 1, 2021.

• Requires licensees to develop and maintain comprehensive written information security programs including risk assessments, administrative/technical/physical safeguards, and incident response plans commensurate with business size and complexity.

• Mandates licensees notify the Hawaii Insurance Commissioner within three business days of determining a cybersecurity event impacting 250 or more consumers has occurred, with detailed reporting requirements on breach nature, scope, and remediation efforts.

• Exempts licensees with fewer than 10 employees from security program requirements and provides compliance flexibility for entities already meeting Health Insurance Portability and Accountability Act standards.

• Establishes transition periods of one to three years for licensees to implement security program requirements, with longer timelines for risk retention groups, and allows commissioner to examine licensee compliance through existing regulatory authority.