BILL NUMBER: S7940

SPONSOR: SEWARD
 
TITLE OF BILL:

An act to amend the insurance law, in relation to clarifying that
continuing care retirement communities are not subject to department of
financial services cybersecurity regulations

 
PURPOSE:

The legislation clarifies existing Insurance Law to specify that
cybersecurity regulations adopted in 2017 by the Department of Financial
Services (DFS) do not apply to Continuing Care Retirement Communities
(CCRCs), which are authorized to operate by the CCRC Council and the
Department of Health (DOH), not by DFS.

 
SUMMARY OF PROVISIONS:

Section one of the legislation adds a new subsection (d) to Section 1119
of the Insurance Law, existing law which specifies that CCRCs operating
              

under Article 46 of the public health law are not subject to licensure
by DFS and are required to comply with specific rules and regulations of
the Superintendent. Subsection (d) specifically identifies the DFS
cybersecurity regulations as being outside of the requirements on CCRCs.

Section two establishes the effective date. The DFS cybersecurity regu-
lations are already in effect.

 
JUSTIFICATION:

DFS adopted final regulations (23 NYCRR Part 500) requiring most banks,
insurers and other financial institutions within DFS's regulatory juris-
diction to protect their customer information from cyberattacks. The
regulations became effective March 1, 2017, and require all covered
entities to annually certify they are complying with the regulations
beginning Feb. 15, 2018. DFS just stated in writing in Feb. 2018 that
CCRCs are covered by the requirements.

New York's CCRCs are much smaller than most financial institutions and
insurers that are subject to these regulations. The average CCRC has a
total annual operating budget of approximately $20 million. Unlike banks
and most insurers, which transact with thousands of customers, often
through e-commerce, CCRCs typically collect funds from only 200-400
prospective and existing residents in the form of deposits, entrance
fees and monthly fees. As health care providers, CCRCs are already
subject to HIPAA privacy standards and safeguards.

Compliance with these regulations will be very expensive, with one New
York CCRC that has an $11 million total annual operating budget estimat-
ing a $100-125,000 first year cost and $100,000 annual cost.  Among the
initial requirements are retaining a Chief Information Security Officer
and other personnel; implementing a cybersecurity program to include
penetration testing and vulnerability assessments; and implementing
multi-factor authentication. The regulations would pose an undue burden
on CCRCs, and could lead to large increases in resident fees.

 
LEGISLATIVE HISTORY:

New Bill.

 
FISCAL IMPLICATIONS:

None.

 
EFFECTIVE DATE:
This act shall take effect immediately.

                                
 
BILL NUMBER: S7940A

SPONSOR: SEWARD
 
TITLE OF BILL:

An act to amend the insurance law, in relation to clarifying that
continuing care retirement communities are not subject to department of
financial services cybersecurity regulations

 
PURPOSE:

The legislation clarifies existing Insurance Law to specify that
cybersecurity regulations adopted in 2017 by the Department of Financial
Services (DFS) do not apply to Continuing Care Retirement Communities
(CCRCs), which are authorized to operate by the CCRC Council and the
Department of Health (DOH), not by DFS.

 
SUMMARY OF PROVISIONS:

Section one of the legislation adds a new subsection (d) to Section 1119
of the Insurance Law, existing law which specifies that CCRCs operating
              

under Article 46 of the public health law are not subject to licensure
by DFS and are required to comply with specific rules and regulations of
the Superintendent. Subsection (d) specifically identifies the DFS
cybersecurity regulations as being outside of the requirements on CCRCs,
and clarifies that such organizations will instead be subject to the
jurisdiction of the department of health regarding cybersecurity
requirements.

Section two establishes the effective date. The DFS cybersecurity regu-
lations are already in effect.

 
JUSTIFICATION:

DFS adopted final regulations (23 NYCRR Part 500) requiring most banks,
insurers and other financial institutions within DFS's regulatory juris-
diction to protect their customer information from cyberattacks. The
regulations became effective March 1, 2017, and require all covered
entities to annually certify they are complying with the regulations
beginning Feb. 15, 2018. DFS just stated in writing in Feb. 2018 that
CCRCs are covered by the requirements.  New York's CCRCs are much small-
er than most financial institutions and insurers that are subject to
these regulations. The average CCRC has a total annual operating budget
of approximately $20 million. Unlike banks and most insurers, which
transact with thousands of customers, often through e-commerce, CCRCs
typically collect funds from only 200-400 prospective and existing resi-
dents in the form of deposits, entrance fees and monthly fees. As health
care providers, CCRCs are already subject to HIPAA privacy standards and
safeguards.

Compliance with these regulations will be very expensive, with one New
York CCRC that has an $11 million total annual operating budget estimat-
ing a $100-125,000 first year cost and $100,000 annual cost.  Among the
initial requirements are retaining a Chief Information Security Officer
and other personnel; implementing a cybersecurity program to include
penetration testing and vulnerability assessments; and implementing
multi-factor authentication. The regulations would pose an undue burden
on CCRCs, and could lead to large increases in resident fees.

 
LEGISLATIVE HISTORY:

New Bill.

 
FISCAL IMPLICATIONS:

None.

 
EFFECTIVE DATE:
This act shall take effect immediately.