KRS 304.3-750: Definitions for KRS 304.3-750 to 304.3-768.

As used in KRS 304.3-750 to 304.3-768:

(1) "Consumer" means an individual, including but not limited to an applicant,

policyholder, insured, beneficiary, claimant, and certificate holder:

(a) Who is a resident of this Commonwealth; and

(b) Whose nonpublic information is in a licensee's possession, custody, or

control;

(2) "Cybersecurity event":

(a) Means an event resulting in unauthorized access to, disruption of, or misuse of

an information system or nonpublic information stored on an information

system; and

(b) Shall not include:

1. Unauthorized a cquisition of encrypted nonpublic information if the

encryption, process, or key is not also acquired, released, or used

without authorization; or

2. An event with regard to which the licensee has determined that the

nonpublic information accessed by an unauthorized person:

a. Has not been used or released; and

b. Has been returned or destroyed;

(3) "Encrypted" means the transformation of data into a fo rm that results in a low

probability of assigning meaning without the use of a protective process or key;

(4) "Information security program" means the administrative, technical, and physical

safeguards that a licensee uses to access, collect, distribute, p rocess, protect, store,

use, transmit, dispose of, or otherwise handle nonpublic information;

(5) "Information system":

(a) Means a discrete set of electronic nonpublic information resources organized

for the collection, processing, maintenance, use, shari ng, dissemination, or

disposition of electronic information; and

(b) Shall include any specialized system such as industrial or process controls

systems, telephone switching and private branch exchange systems, and

environmental control systems;

(6) "Licensee":

(a) Means any person who is, or is required to be, licensed, authorized to operate,

or registered pursuant to the insurance laws of this state; and

(b) Shall not include:

1. A purchasing group or a risk retention group chartered and licensed in a

state other than this state; or

2. A licensee that is acting as an assuming insurer that is domiciled in

another state or jurisdiction;

(7) "Nonpublic information":

(a) Means electronic information that is not publicly available information; and

(b) Shall include:

1. Business-related information of a licensee that if tampered with, or

disclosed, accessed, or used without authorization, would cause a

material adverse impact to the business, operations, or security of the

licensee;

2. Any confidential personal i dentifying information of a consumer,

including:

a. Social Security number;

b. Operator's license number or personal identification card number;

c. Financial account number;

d. Credit or debit card number;

e. Any security code, access code, or password tha t would permit

access to a consumer's financial account; or

f. Biometric records; and

3. Any information or data, except age or gender, in any form or medium

created by or derived from a health care provider or a consumer that

relates to:

a. The past, pres ent, or future physical, mental, or behavioral health

or condition of any consumer or member of the consumer's family;

b. The provision of health care to any consumer; or

c. Payment for the provision of health care to any consumer;

(8) "Person" means any individual or nongovernmental entity, including but not limited

to any nongovernmental partnership, corporation, branch, agency, or association;

(9) (a) "Publicly available in formation" means any information that a licensee has a

reasonable basis to believe is lawfully made available to the general public

from:

1. Federal, state, or local government records;

2. Widely distributed media; or

3. Disclosures to the general public that are required to be made by federal,

state, or local law.

(b) For purposes of this definition, a licensee has a reasonable basis to believe

that information is lawfully made available to the general public if the

licensee has taken steps to determine:

1. That the information is of the type that is available to the general public;

and

2. Whether the consumer can direct that information not be made available

to the general public, and if so, that the consumer has not done so; and

(10) "Third-party service provider" means a person, other than a licensee, that:

(a) Contracts with a licensee to maintain, process, or store nonpublic information;

or

(b) Is otherwise permitted access to nonpublic information through its provision

of services to a licensee.