{"data":{"id":"us-ky/krs-304.3-750","jurisdiction":"us-ky","citation":"KRS 304.3-750","heading":"Definitions for KRS 304.3-750 to 304.3-768.","body":"As used in KRS 304.3-750 to 304.3-768:\n(1) \"Consumer\" means an individual, including but not limited to an applicant,\npolicyholder, insured, beneficiary, claimant, and certificate holder:\n(a) Who is a resident of this Commonwealth; and\n(b) Whose nonpublic information is in a licensee's possession, custody, or\ncontrol;\n(2) \"Cybersecurity event\":\n(a) Means an event resulting in unauthorized access to, disruption of, or misuse of\nan information system or nonpublic information stored on an information\nsystem; and\n(b) Shall not include:\n1. Unauthorized a cquisition of encrypted nonpublic information if the\nencryption, process, or key is not also acquired, released, or used\nwithout authorization; or\n2. An event with regard to which the licensee has determined that the\nnonpublic information accessed by an unauthorized person:\na. Has not been used or released; and\nb. Has been returned or destroyed;\n(3) \"Encrypted\" means the transformation of data into a fo rm that results in a low\nprobability of assigning meaning without the use of a protective process or key;\n(4) \"Information security program\" means the administrative, technical, and physical\nsafeguards that a licensee uses to access, collect, distribute, p rocess, protect, store,\nuse, transmit, dispose of, or otherwise handle nonpublic information;\n(5) \"Information system\":\n(a) Means a discrete set of electronic nonpublic information resources organized\nfor the collection, processing, maintenance, use, shari ng, dissemination, or\ndisposition of electronic information; and\n(b) Shall include any specialized system such as industrial or process controls\nsystems, telephone switching and private branch exchange systems, and\nenvironmental control systems;\n(6) \"Licensee\":\n(a) Means any person who is, or is required to be, licensed, authorized to operate,\nor registered pursuant to the insurance laws of this state; and\n(b) Shall not include:\n1. A purchasing group or a risk retention group chartered and licensed in a\nstate other than this state; or\n2. A licensee that is acting as an assuming insurer that is domiciled in\nanother state or jurisdiction;\n(7) \"Nonpublic information\":\n(a) Means electronic information that is not publicly available information; and\n(b) Shall include:\n1. Business-related information of a licensee that if tampered with, or\ndisclosed, accessed, or used without authorization, would cause a\nmaterial adverse impact to the business, operations, or security of the\nlicensee;\n2. Any confidential personal i dentifying information of a consumer,\nincluding:\na. Social Security number;\nb. Operator's license number or personal identification card number;\nc. Financial account number;\nd. Credit or debit card number;\ne. Any security code, access code, or password tha t would permit\naccess to a consumer's financial account; or\nf. Biometric records; and\n3. Any information or data, except age or gender, in any form or medium\ncreated by or derived from a health care provider or a consumer that\nrelates to:\na. The past, pres ent, or future physical, mental, or behavioral health\nor condition of any consumer or member of the consumer's family;\nb. The provision of health care to any consumer; or\nc. Payment for the provision of health care to any consumer;\n(8) \"Person\" means any individual or nongovernmental entity, including but not limited\nto any nongovernmental partnership, corporation, branch, agency, or association;\n(9) (a) \"Publicly available in formation\" means any information that a licensee has a\nreasonable basis to believe is lawfully made available to the general public\nfrom:\n1. Federal, state, or local government records;\n2. Widely distributed media; or\n3. Disclosures to the general public that are required to be made by federal,\nstate, or local law.\n(b) For purposes of this definition, a licensee has a reasonable basis to believe\nthat information is lawfully made available to the general public if the\nlicensee has taken steps to determine:\n1. That the information is of the type that is available to the general public;\nand\n2. Whether the consumer can direct that information not be made available\nto the general public, and if so, that the consumer has not done so; and\n(10) \"Third-party service provider\" means a person, other than a licensee, that:\n(a) Contracts with a licensee to maintain, process, or store nonpublic information;\nor\n(b) Is otherwise permitted access to nonpublic information through its provision\nof services to a licensee.","path":[],"source_url":"https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=53291","current_through":"Includes enactments through the 2026 Regular Session","vintage":"09/05/2026","retrieved_at":"2026-09-05T20:57:38Z","sha256":"bd4604045a6389c1ec0d347ab4f68c330cf4158ed7e9f01faa291e3aec379c06","source_id":"us-ky","stale":false,"prev":"us-ky/krs-304.3-735","next":"us-ky/krs-304.3-752"},"notice":"GroundRules: Original legal text. Not legal advice."}