Data Privacy Interactive Map - Pennsylvania

Highlights

Covered Entities: A state agency, political subdivision of Pennsylvania, or an individual or business doing business in Pennsylvania.

Consumer Notification: Notification must be provided to any Pennsylvania resident whose “unencrypted and unredacted personal information was or is reasonably believed to have been accessed and acquired” without authorization.

Regulatory Notification: Notification must be provided to the Pennsylvania Attorney General if a breach involves personal information for more than 500 Pennsylvania residents.

Notification Timeline: Notification must be provided without unreasonable delay, subject to measures necessary to determine the scope of the breach and restore the reasonable integrity of the system.

Data Format: Electronic.

Citations: 73 P.S. §§ 2301–23

More Details

Definitions:

• Breach: Unauthorized access and acquisition of computerized data that materially compromises the security or confidentiality of personal information, and that causes or the entity reasonably believes has caused or will cause loss or injury to a Pennsylvania resident.
• Personal information (PI): An individual’s first name / first initial and last name in combination with one or more of the following data elements:
  • Social Security number;
  • Driver’s license or state identification number;
  • Financial account number, credit or debit card number, , in combination with any required security code, access code, or password that would permit access to an individual’s financial account;
  • Medical information in the possession of a state agency or state agency contractor;
  • Health insurance information; or
  • Username or e-mail address, in combination with a password or security question and answer that would permit access to an online account.
• Medical Information: Any individually identifiable information contained in the individual’s current or historical record of medical history or medical treatment or diagnosis, in the possession of a state agency or state agency contractor.
• Health Insurance Information: An individual’s health insurance policy number or subscriber identification number in combination with access code or other medical information that permits misuse of an individual’s health insurance benefits.

Safe Harbors:

• Encryption: Notification is not required where the potentially impacted PI is encrypted, so long as the PI is not accessed and acquired in unencrypted form or the “breach” is linked to a breach of the security of the encryption or access to the encryption key.
• Good Faith: Notification is not required where the potentially impacted PI is acquired in good faith by an employee or agent for the purposes of the entity if the PI is not used other than for a lawful purpose of the entity and is not subject to further disclosure.
• Risk of Harm: Notification may not be required if the unauthorized access and acquisition does not cause, and the entity does not reasonably believe will cause, loss or injury to any Pennsylvania resident.
• Law Enforcement Delay: Notification may be delayed if a law agency determines and advises the entity, in writing and with specific reference to 73 P.S. § 2304, that the notification will impede a criminal or civil investigation.

Direct Notice:

• Timing: Notification must be provided “without unreasonable delay,” subject to measures necessary to determine the scope of the “breach” and restore the reasonable integrity of the system.
• Format: N/A
• Content:
  • Telephone notice must be given in a clear and conspicuous manner, and include (1) a general incident description, (2) the types of PI impacted, and (3) a webpage or phone number that the individual can contact for more information.:
  • Electronic notice, if the notice directs the individual to promptly change their password and security question/answer, or provides other steps appropriate to protect the online account.
• Method: Notification may be provided by any of the following: (1) written notice to the last known home address; (2) telephone, subject to the requirements above; (3) e-mail notice if a prior relationship exists; (4) electronic notice, subject to the requirements above or (4) substitute notice.

Substitute Notice:

An entity may provide substitute notice if (1) the cost of direct notice would exceed $100,000; (2) the notification population exceeds 175,000; or (3) the entity does not have sufficient contact information. It must include (1) e-mail notice, where an e-mail address is available; (2) conspicuous posting on the entity’s website; and (3) notice to major statewide media.

Remediation Services:

The entity must offer 12 months of remediation services, including access to one credit report and access to credit monitoring services, if a breach impacts Social Security numbers, bank account numbers, driver’s license numbers, or state identification card numbers.

Regulatory Notice:

The entity must concurrently notify the Attorney General when notice of the breach of security must be given to more than 500 Pennsylvania residents. The notification must include:

• The organization name and location.
• The date of the breach of the security of the system.
• A summary of the breach incident of the security of the system.
• An estimated total number of individuals affected by the breach of the security of the system.
• An estimated total number of individuals in this Commonwealth affected by the breach of the security of the system.

An entity subject to the requirements of 40 Pa.C.S. Ch. 45 (relating to insurance data security) may be exempt from the requirement to notify the Attorney General.

Credit Reporting Agencies Notice:

Notification must be provided to all nationwide consumer reporting agencies if the notification population exceeds 1,000 Pennsylvania residents.

Third-Party Notice:

A vendor that maintains, stores or manages computerized data on behalf of another entity must notify the entity of a “breach” following discovery.

HIPAA:

Any covered entity or business associate subject to and in compliance with the privacy and security standards for the protection of electronic personal health information established under the Health Insurance Portability and Accountability Act and the Health Information Technology for Economic and Clinical Health Act will be deemed to be in compliance with the act.

Private Action:

N/A

Associated Regulations:

N/A

Highlights

Covered Entities:

Any entity that is or is required to be licensed, authorized to operate or registered under the insurance laws of Pennsylvania. This includes insurers, third-party administrators, producers (agents and brokers) and rating organizations.

Security Standard:

Each licensee must develop, implement, and maintain a comprehensive written information security program based on the licensee’s risk assessment that contains administrative, technical and physical safeguards for the protection of nonpublic information and the licensee’s information systems. The written information plan should be appropriate to the size and complexity of the licensee, the nature and scope of the licensee’s activities, including the licensee's use of third-party service providers, and the sensitivity of the nonpublic information used by the licensee or in the licensee's possession, custody or control. The plan should be designed to protect the security and confidentiality of nonpublic information and the security of the information systems, against any threats or hazards to the security or integrity of nonpublic information and the information systems, and against unauthorized access to or use of nonpublic information and that minimizes the likelihood of harm to a consumer.  Additionally, each licensee must establish and maintain a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information in its possession, the licensee’s information systems or the continuing functionality of any aspect of the licensee’s business or operations. The incident response plan must address the following areas: (1) the internal process for responding to a cybersecurity event; (2) the goals of the incident response plan; (3) the definition of clear roles, responsibilities and levels of decision-making authority; (4) external and internal communications and information sharing; (5) identification of requirements for the remediation of any identified weaknesses in information systems and associated controls; (6) documentation and reporting regarding cybersecurity events and related incident response activities; (7) the evaluation and revision of the incident response plan following a cybersecurity event, as necessary.

Certification:

No later than April 15, 2026, each insurer domiciled in the Commonwealth must annually submit to the Commissioner a written statement certifying that the insurer is in compliance with the requirements outlined in the Act related to the information security program, corporate oversight, and oversight of third-party service provider agreements.

Cybersecurity event:

An event resulting in unauthorized access to, disruption of or misuse of an information system or nonpublic information stored on the information system.  This Act requires, among other things, that a licensee investigate a cybersecurity event and notify the Commissioner as promptly as possible, but in no event later than five (5) business days after determining that a cybersecurity event has occurred when certain criteria are met.

Regulatory Notification:

A licensee must notify the commissioner when either of the following criteria have been met: the cybersecurity event has a reasonable likelihood of materially harming a consumer residing in this Commonwealth or any material part of the normal operations of the licensee or the licensee reasonably believes that the nonpublic information involves 250 or more consumers residing in this Commonwealth and the cybersecurity event impacts the licensee of which notice is required to be provided to a governmental body, self-regulatory agency or another supervisory body under any Federal or State law; or has a reasonable likelihood of materially harming a consumer residing in this Commonwealth or any material part of the normal operations of the licensee. The licensee then has a continuing obligation to update and supplement initial and subsequent notifications to the commissioner regarding material changes to previously provided information relating to a cybersecurity event. (Cybersecurity Event Notification Report | Insurance Department | Commonwealth of Pennsylvania)

Notification Timeline:

A licensee must notify the commissioner as promptly as possible, but in no event later than five (5) business days from a determination, that a cybersecurity event involving nonpublic information that is in the possession of the licensee has occurred when either of the following criteria has been met.

Consumer Notification:

The assuming insurer must notify its affected ceding insurers and the commissioner of its state of domicile within three (3) business days of making the determination that a cybersecurity event has occurred. The ceding insurers that have a direct contractual relationship with the affected consumers must fulfill the consumer notification requirements imposed under section 3 of the Breach of Personal Information Notification Act and any other notification requirements relating to a cybersecurity event.

Citations:

Pennsylvania, 40 Pa.C.S.A. §§ 4501 to 4536, Dec. 11, 2023

More Details

Definitions:

Consumer: An individual, including an applicant, policyholder, insured, beneficiary, claimant, or certificate holder, who is a resident of this Commonwealth and whose nonpublic information is in a licensee’s possession, custody, or control.

Authorized individual: An individual known to and screened by a licensee and determined to be necessary and appropriate to have access to the nonpublic information held by the licensee and its information systems.

Licensee: A person that is or is required to be licensed, authorized to operate, or registered under the insurance laws of this Commonwealth.

Risk assessment: The assessment that each licensee is required to conduct under section 4512.

Nonpublic Personal Information: Information that is stored or maintained in an electronic system, is not publicly available information and is any of the following:

• Business-related information of a licensee that would cause a materially adverse impact to the business, operations or security of the licensee if the information is tampered with, accessed, used or subject to unauthorized disclosure.
• Information concerning a consumer that because of a name, number, personal mark or other identifier, can be used to identify the consumer, in combination with any one or more of the following data elements:
  • Social Security number.
  • Driver's license number or nondriver identification card number.
  • Financial account number, credit card number or debit card number.
  • A security code, access code or password that would permit access to a consumer's financial account.
  • Biometric records.
• Information or data, except age or gender, in any form or medium created by or derived from a health care provider or a consumer that can be used to identify a particular consumer and that relates to any of the following:
  • The past, present or future physical, mental or behavioral health or condition of a consumer or a member of the consumer's family.
  • The provision of health care to any consumer.
  • Payment for the provision of health care to any consumer.

Third-Party Notice Requirements: In the case of a cybersecurity event involving nonpublic information that is in the possession, custody or control of a third-party service provider of a licensee that is an assuming insurer, the assuming insurer must notify its affected ceding insurers and the commissioner of its state of domicile within three (3) business days of receiving notice from its third-party service provider that a cybersecurity event has occurred. The ceding insurers that have a direct contractual relationship with the affected consumers must fulfill the consumer notification requirements imposed under section 3 of the Breach of Personal Information Notification Act and any other notification requirements relating to a cybersecurity event imposed under this section.

Penalties: The Commissioner may suspend or revoke the licensee’s license, refuse to issue or reissue a license, or provide a cease-and-desist order. The Commissioner can also impose a penalty of not more than $5,000 for each violation that a licensee knew or reasonably should have known was a violation, not to exceed an aggregate penalty of $100,000 in a calendar year. For each violation that a licensee did not know nor reasonably should have known was a violation, a penalty of not more than $1,000, not to exceed an aggregate penalty of $20,000 in a calendar year.