An Act To Protect Maine Consumers from Medical Identity Theft

Emergency preamble. Whereas,  acts and resolves of the Legislature do not become effective until 90 days after adjournment unless enacted as emergencies; and

Whereas,  protection of personally identifying data has become important since the advent of digital record keeping and the Internet, with theft and misuse of the data occurring at an ever-increasing rate; and

Whereas,  theft and misuse of personally identifying data can lead to invasion of privacy and financial loss and, in the case of medical identity theft, to possible erroneous and dangerous medical care; and

Whereas,  residents of the State are presently vulnerable to medical identity theft, as evinced by the recent data breach at Anthem Blue Cross and Blue Shield, in which potentially up to 500,000 residents of the State were affected; and

Whereas,  in the judgment of the Legislature, these facts create an emergency within the meaning of the Constitution of Maine and require the following legislation as immediately necessary for the preservation of the public peace, health and safety; now, therefore,

Sec. 1. 24-A MRSA §4320-J  is enacted to read:

§ 4320-J.  Data protection

Sec. 2. Department of Professional and Financial Regulation, Bureau of Insurance to adopt rules. The Department of Professional and Financial Regulation, Bureau of Insurance shall adopt rules to implement the Maine Revised Statutes, Title 24-A, section 4320-J, subsection 1, paragraph B to require medical identity theft protection with recompense to include, at no cost to the enrollee, at a minimum:

1. Identity repair assistance. If an enrollee experiences fraud, providing an investigator to work to recover the enrollee's financial losses, restore the enrollee's credit and ensure information concerning the enrollee's identity is returned to its proper condition;

2. Credit monitoring. Providing credit monitoring to alert an enrollee when a bank or creditor opens a new credit account in the enrollee's name;

3. Child identity protection. Providing child-specific identity protection services for an enrollee whose child is insured under the enrollee's health plan;

4. Identity theft insurance. Providing for an enrollee at least $1,000,000 in identity theft insurance;

5. Identity theft monitoring and fraud detection. Scanning an enrollee's data, such as credit card numbers, social security numbers and e-mail, against aggregated data sources maintained by top security researchers that contain stolen and compromised individual data to look for any indication that the enrollee's data has been compromised; and

6. Phone or e-mail alerts. Alerting an enrollee by telephone or e-mail upon receipt of a notification from a credit bureau or when it appears from identity theft monitoring activities that the enrollee's data or identity may have been compromised.

Emergency clause. In view of the emergency cited in the preamble, this legislation takes effect when approved.

SUMMARY

This bill directs an insurance carrier that provides insurance in the State to take certain measures to protect the data and identity of a person insured by the carrier on or after January 1, 2004, including encrypting all medical and personal data of the insured, providing medical identify theft protection and a guarantee of recompense for 10 years following the breach, aligning all policies with a national medical fraud alliance approved by the Department of Professional and Financial Regulation, Bureau of Insurance and requiring all carriers to develop and implement a policy approved by the bureau that ensures strict adherence to the compliance rules under the federal Health Insurance Portability and Accountability Act of 1996.