A BILL TO BE ENTITLED
AN ACT to require insurers to implement safeguards for the protection of personal information, pursuant to the provisions of the gramm‑leach‑bliley act.
The General Assembly of North Carolina enacts:
SECTION 1.  The heading for Article 39 of Chapter 58 of the General Statutes reads as rewritten:
"Article 39.

Consumer Information Privacy."
SECTION 2.  Article 39 of Chapter 58 of the General Statutes is amended by:
(1)	Designating G.S. 58‑39‑1 through G.S. 58‑39‑76 as:
"Part 1. Insurance Information and Privacy Protection."
(2)	Designating G.S. 58‑39‑80 through G.S. 58‑39‑125 as:
"Part 2. Enforcement, Sanctions, Remedies, and Rights." and
(3)	Recodifying G.S. 58‑39‑70 as G.S. 58‑39‑125.
SECTION 3.  G.S. 58‑39‑1 reads as rewritten:
"§ 58‑39‑1.  Short titles.
This Article may be cited as the Consumer Information Privacy Act. Part 1 of this Article may be cited as the Insurance Information and Privacy Protection Act. Part 3 of this Article may be cited as the Personal Information Safeguards Act."
SECTION 4.  G.S. 58‑39‑5 reads as rewritten:
"§ 58‑39‑5.  Purpose.
The purpose of this Article is to establish standards for the collection, use, and disclosure of information gathered in connection with insurance transactions by insurance institutions, agents, or insurance‑support organizations; to maintain a balance between the need for information by those conducting the business of insurance and the public's need for fairness in insurance information practices, including the need to minimize intrusiveness; to establish a regulatory mechanism to enable natural persons to ascertain what information is being or has been collected about them in connection with insurance transactions and to have access to such information for the purpose of verifying or disputing its accuracy; to limit the disclosure of information collected in connection with insurance transactions; and to enable insurance applicants and policyholders to obtain the reasons for any adverse underwriting decision. The purpose of this Article is also to establish standards for developing and implementing administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of an individual’s personal information requiring protection under Parts 1 and 2 of this Article, as required by sections 501, 505, and 507 of the federal Gramm-Leach-Bliley Act (Public Law 106-102), codified as 15 U.S.C. §§6801, 6805(b), and 6807. The purpose of this Article is also to provide privacy protection consistent with federal regulations governing the privacy of medical records when this Article is consistent with those federal regulations. In those instances in which this Article and the federal privacy regulations are inconsistent and this Article provides privacy protection beyond that offered by the federal regulations, the purpose of this Article is to provide that additional privacy protection."
SECTION 5.  Article 39 of Chapter 58 of the General Statutes is amended by adding a new Part to read:
"Part 3. Personal Information Safeguards.
"§ 58-39-130.   Application.
The safeguards established under this Part apply to all personal information of individuals requiring protection under Parts 1 and 2 of this Article.
"§ 58-39-135.  Definitions.
As used in this Part, in addition to the definitions in G.S. 58-39-15:
(1)	'Information systems' means the electronic or physical methods used to access, collect, store, use, transmit, protect, or dispose of personal information.
(2)	'Licensee' means any producer, as defined in G.S. 58-33-10(7), insurer, MEWA, HMO, or service corporation governed by this Chapter. 'Licensee' does not mean:
a.	An insurance-support organization.
b.	A licensee who is a natural person operating within the scope of the licensee’s employment by or affiliation with an insurer or producer. 
c.	A surplus lines insurer or licensee under Article 21 of this Chapter.
(3)	'Service provider' means a person that maintains, processes, or otherwise is permitted access to personal information through its provision of services directly to the licensee and includes an insurance support organization.
"§ 58-39-140.  Information security program.
Each licensee shall implement a comprehensive written information security program that includes administrative, technical, and physical safeguards for the protection of personal information. The administrative, technical, and physical safeguards included in the information security program shall be appropriate to the size and complexity of the licensee and the nature and scope of its activities.
"§ 58-39-145.  Objectives of information security program.
A licensee’s information security program shall be designed to:
(1)	Ensure the security and confidentiality of personal information;
(2)	Protect against any anticipated threats or hazards to the security or integrity of the information; and
(3)	Protect against unauthorized access to or use of the information that could result in substantial harm or inconvenience to any individual or in a violation of Part 1 of this Article.
"§ 58-39-150.  Examples of development and implementation methods.
The actions and procedures described in G.S. 58-39-155 through G.S. 58-39-170 are examples of methods of implementation of the requirements of G.S. 58-39-140 and G.S. 58-39-145. These examples are non-exclusive illustrations of actions and procedures that licensees may follow to implement G.S. 58-39-140 and G.S. 58-39-145.
"§ 58-39-155.  Risk assessment.
The licensee identifies reasonably foreseeable internal or external threats that could result in unauthorized disclosure, misuse, alteration, or destruction of personal information or a licensee’s information systems, and assesses the likelihood and potential damage of these threats, taking into consideration the sensitivity of the personal information involved. The licensee also assesses the sufficiency of policies, procedures, information systems, and other safeguards in place to control risks. 
"§ 58-39-160.  Risk management and control.
The licensee:
(1)	Designs its information security program to control the identified risks, commensurate with the sensitivity of the information, as well as the complexity and scope of the licensee’s activities;
(2)	Trains staff, as appropriate, to implement the licensee’s information security program; and
(3)	Regularly tests or otherwise regularly monitors the key controls, systems, and procedures of the information security program. The frequency and nature of these tests or other monitoring practices are determined by the licensee’s risk assessment. 
"§ 58-39-165.  Service provider arrangement oversight.
The licensee:
(1)	Exercises appropriate due diligence in selecting its service providers.
(2)	Requires its service providers to implement appropriate measures designed to meet the objectives of this Part and, where indicated by the licensee’s risk assessment, takes appropriate steps to confirm that its service providers have satisfied these obligations.
"§ 58-39-170. Program adjustment.
The licensee monitors, evaluates, and adjusts, as appropriate, the information security program in light of any relevant changes in technology, the sensitivity of an individual’s  personal information, internal or external threats to information, and the licensee’s own changing business arrangements, such as mergers and acquisitions, alliances and joint ventures, outsourcing arrangements, and changes to personal information systems.
"§ 58-39-175. Violation.
A violation of G.S. 58-39-140 or G.S. 58-39-145 subjects the violator to Part 2 of this Article.
"§ 58-39-180.  Effective date.
Each licensee shall establish an information security program, including appropriate policies and systems, under this Part by January 1, 2004."
SECTION 6.  This act is effective when it becomes law.