Bill > H0117

This bill establishes the Insurance Data Security Act in Idaho, creating comprehensive regulations for how insurance companies (licensees) must protect sensitive consumer information from cybersecurity threats. The bill requires licensees to develop and maintain a written information security program tailored to their size, complexity, and the sensitivity of the data they handle, including implementing administrative, technical, and physical safeguards. Key provisions include mandating that licensees conduct prompt investigations of potential cybersecurity events, notify the state director within 10 business days of confirming a significant cybersecurity incident, and provide consumer notifications when events are likely to cause material harm. The law applies to most insurance-related businesses, with exemptions for smaller companies (fewer than 50 employees, less than $5 million in revenue) and those already complying with similar federal regulations like HIPAA. Importantly, the bill does not create a private right of action, meaning consumers cannot sue directly for violations, but the state can impose civil penalties. The act will take effect on July 1, 2025, with companies having until July 1, 2026, to fully implement the required information security programs. The primary goal is to enhance data protection and ensure rapid response to potential cybersecurity breaches in the insurance industry.

Business and Industry

Business Committee (H)

https://legislature.idaho.gov/sessioninfo/2025/legislation/H0117/