BILL NUMBER: S7940

SPONSOR: SEWARD
 
TITLE OF BILL:

An act to amend the insurance law, in relation to clarifying that
continuing care retirement communities are not subject to department of
financial services cybersecurity regulations

 
PURPOSE:

The legislation clarifies existing Insurance Law to specify that
cybersecurity regulations adopted in 2017 by the Department of Financial
Services (DFS) do not apply to Continuing Care Retirement Communities
(CCRCs), which are authorized to operate by the CCRC Council and the
Department of Health (DOH), not by DFS.

 
SUMMARY OF PROVISIONS:

Section one of the legislation adds a new subsection (d) to Section 1119
of the Insurance Law, existing law which specifies that CCRCs operating
              

under Article 46 of the public health law are not subject to licensure
by DFS and are required to comply with specific rules and regulations of
the Superintendent. Subsection (d) specifically identifies the DFS
cybersecurity regulations as being outside of the requirements on CCRCs.

Section two establishes the effective date. The DFS cybersecurity regu-
lations are already in effect.

 
JUSTIFICATION:

DFS adopted final regulations (23 NYCRR Part 500) requiring most banks,
insurers and other financial institutions within DFS's regulatory juris-
diction to protect their customer information from cyberattacks. The
regulations became effective March 1, 2017, and require all covered
entities to annually certify they are complying with the regulations
beginning Feb. 15, 2018. DFS just stated in writing in Feb. 2018 that
CCRCs are covered by the requirements.

New York's CCRCs are much smaller than most financial institutions and
insurers that are subject to these regulations. The average CCRC has a
total annual operating budget of approximately $20 million. Unlike banks
and most insurers, which transact with thousands of customers, often
through e-commerce, CCRCs typically collect funds from only 200-400
prospective and existing residents in the form of deposits, entrance
fees and monthly fees. As health care providers, CCRCs are already
subject to HIPAA privacy standards and safeguards.

Compliance with these regulations will be very expensive, with one New
York CCRC that has an $11 million total annual operating budget estimat-
ing a $100-125,000 first year cost and $100,000 annual cost.  Among the
initial requirements are retaining a Chief Information Security Officer
and other personnel; implementing a cybersecurity program to include
penetration testing and vulnerability assessments; and implementing
multi-factor authentication. The regulations would pose an undue burden
on CCRCs, and could lead to large increases in resident fees.

 
LEGISLATIVE HISTORY:

New Bill.

 
FISCAL IMPLICATIONS:

None.

 
EFFECTIVE DATE:
This act shall take effect immediately.

                                
 
BILL NUMBER: S7940B

SPONSOR: SEWARD
 
TITLE OF BILL:  An act to amend the insurance law, in relation to
clarifying that continuing care retirement communities are not subject
to department of financial services cybersecurity regulations

 
PURPOSE:

To permit a continuing care retirement community (CCRCs) to attest to
the department of financial services (DFS) that the CCRC's cybersecurity
policies are not inconsistent with cybersecurity regulations promulgated
by the superintendent

 
SUMMARY OF PROVISIONS:

Section one of the legislation adds a new subsection (d) to Section 1119
of the Insurance Law, to provide that CCRCs may adopt a written cyberse-
curity policy that is designed to protect the confidentiality of nonpub-
lic information and is in compliance with all applicable cybersecurity
and privacy laws and protections governing nursing homes, adult care
              

facilities and assisted living residences. This section would also
require CCRCs to self-certify their cybersecurity policies and file such
self-certification with the DFS. Finally, this section would require the
DFS to review the accuracy and reasonableness of the self-certification.

Section two establishes the effective date.

 
JUSTIFICATION:

DFS adopted final regulations (23 NYCRR Part 500) requiring most banks,
insurers and other financial institutions within DFS's regulatory juris-
diction to protect their customer information from cyberattacks. The
regulations became effective March 1, 2017, and require all covered
entities to annually certify they are complying with the regulations
beginning Feb. 15, 2018. DFS just stated in writing in Feb. 2018 that
CCRCs are covered by the requirements.

New York's CCRCs are much smaller than most financial institutions and
insurers that are subject to these regulations. The average CCRC has a
total annual operating budget of approximately $20 million. Unlike banks
and most insurers, which transact with thousands of customers, often
through e-commerce, CCRCs typically collect funds from only 200-400
prospective and existing residents in the form of deposits, entrance
fees and monthly fees. As health care providers, CCRCs are already
subject to HIPAA privacy standards and safeguards.

This bill would permit CCRCs to adopt a written cybersecurity policy and
to self-certify to the DFS that such policies are in compliance with all
applicable cybersecurity and privacy laws and protections, and that such
policies are not inconsistent with the cybersecurity regulations adopted
by the DFS.

 
LEGISLATIVE HISTORY:

New bill.

 
FISCAL IMPLICATIONS:

None.

 
EFFECTIVE DATE:
This act shall take effect immediately.