S T A T E O F N E W Y O R K
________________________________________________________________________
749
2021-2022 Regular Sessions
I N A S S E M B L Y
(PREFILED)
January 6, 2021
___________
Introduced by M. of A. CAHILL, LUPARDO -- read once and referred to the
Committee on Insurance
AN ACT to amend the insurance law, in relation to authorizing continuing
care retirement communities to adopt a written cybersecurity policy
THE PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
BLY, DO ENACT AS FOLLOWS:
Section 1. Section 1119 of the insurance law is amended by adding a
new subsection (d) to read as follows:
(D) SUCH ORGANIZATION MAY ADOPT A WRITTEN CYBERSECURITY POLICY THAT IS
DESIGNED TO PROTECT THE CONFIDENTIALITY, INTEGRITY AND SECURITY OF
NONPUBLIC INFORMATION AND IS IN COMPLIANCE WITH: (I) THE HEALTH INFORMA-
TION TECHNOLOGY FOR ECONOMIC AND CLINICAL HEALTH ACT ("HITECH"), THE
HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT ("HIPAA"), THE
GRAMM-LEACH-BLILEY ACT; AND (II) ALL OTHER APPLICABLE CYBERSECURITY AND
PRIVACY PROTECTIONS GOVERNING NURSING HOMES, ADULT CARE FACILITIES AND
ASSISTED LIVING RESIDENCES TO THE EXTENT THE PROTECTIONS GOVERN THOSE
COMPONENTS OF SUCH ORGANIZATION'S OPERATIONS. THE CYBERSECURITY POLICY
SHALL BE SELF-CERTIFIED BY SUCH ORGANIZATION AND SUCH SELF-CERTIFIED
CYBERSECURITY POLICY SHALL BE FILED WITH THE SUPERINTENDENT. THE SELF-
CERTIFICATION SHALL ATTEST THAT THE POLICY PROVIDES SUFFICIENT
PROTECTIONS OF NONPUBLIC INFORMATION IN A MANNER WHICH IS NOT INCONSIST-
ENT WITH THE GOALS OF THE CYBERSECURITY POLICIES ADOPTED BY FINANCIAL
SERVICES COMPANIES PURSUANT TO REGULATIONS PROMULGATED BY THE SUPER-
INTENDENT. SUCH SELF-CERTIFICATION SHALL BE DEEMED COMPLIANT WITH SUCH
REGULATIONS APPLICABLE TO FINANCIAL SERVICES COMPANIES. THE SUPERINTEN-
DENT SHALL REVIEW THE ACCURACY AND REASONABLENESS OF THE ATTESTATION.
UNLESS THE SUPERINTENDENT OBJECTS TO THE ATTESTATION WITHIN SIXTY DAYS
FROM THE DATE IT IS SUBMITTED, SUCH ATTESTATION SHALL BE DEEMED
APPROVED.
§ 2. This act shall take effect immediately.
EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
[ ] is old law to be omitted.
LBD01661-01-1