Sec. 12. As used in this chapter, "nonpublic information" means electronic information that is not publicly available information and is described in either of the following subdivisions:
(1) Any information concerning a consumer, which because of name, number, personal mark, or other identifier can be used, in combination with any one (1) or more of the following data elements, to identify the consumer:
(A) Social Security number.
(B) Driver's license number or nondriver identification card number.
(C) Financial account number, credit card number, or debit card number.
(D) Any security code, access code, or password that would permit access to a consumer's financial account.
(E) Biometric records.
(2) Any information or data, except age or gender, in any form or medium created by or derived from a health care provider or a consumer that can be used to identify a consumer and relates to:
(A) the past, present, or future physical, mental, or behavioral health or condition of the consumer or a member of the consumer's family;
(B) the provision of health care to the consumer; or
(C) payment for the provision of health care provided to the consumer.
As added by P.L.130-2020, SEC.10.
Structure Indiana Code
Article 2. Powers and Duties of Insurers
Chapter 27. Insurance Data Security
27-2-27-1. Applicability of Chapter
27-2-27-2. "Authorized Individual"
27-2-27-5. "Cybersecurity Event"
27-2-27-8. "Information Security Program"
27-2-27-9. "Information System"
27-2-27-11. "Multi-Factor Authentication"
27-2-27-12. "Nonpublic Information"
27-2-27-13. "Publicly Available Information"
27-2-27-15. "Third Party Service Provider"
27-2-27-16. Information Security Program; Requirements
27-2-27-17. Risk Assessment; Requirements
27-2-27-18. Actions Required Based on Risk Assessment Results
27-2-27-19. Board of Directors; Executive Management
27-2-27-20. Incident Response Plan
27-2-27-21. Investigation of Cybersecurity Event
27-2-27-22. Notice to Ceding Insurers and Commissioner of Cybersecurity Event
27-2-27-23. Notice to Producers of Cybersecurity Event
27-2-27-24. Powers of Commissioner
27-2-27-26. Exemptions From Chapter
27-2-27-27. Suspension; Revocation
27-2-27-29. Private Right of Action