Chapter 601

601.83(2)(e) (e) Take into account any federal funding available for the plan.

601.83(2)(f) (f) Take into account the total amount available to fund the plan.

601.83(3) (3) Operation.

601.83(3)(a) (a) The commissioner shall set the payment parameters as described under sub. (2) by no later than March 30 of the calendar year before the applicable benefit year or, if the commissioner specifies a different date by rule, the date specified by the commissioner by rule.

601.83(3)(b) (b) If the amount available for expenditure for the healthcare stability plan is not anticipated to be adequate to fully fund the payment parameters set under par. (a) as of July 1 of the calendar year before the applicable benefit year, the commissioner shall adjust the payment parameters in accordance within the moneys available to expend for the healthcare stability plan. The commissioner shall allow an eligible health carrier to revise its rate filing based on the final payment parameters for the applicable benefit year.

601.83(3)(c) (c) If funding is not available to make all reinsurance payments to eligible health carriers in a benefit year, the commissioner shall make reinsurance payments in proportion to the eligible health carrier’s share of aggregate individual health plan claims costs eligible for reinsurance payments during the given benefit year, as determined by the commissioner. The commissioner shall notify eligible health carriers if there are insufficient funds available to make reinsurance payments in full and the estimated amount of payment as soon as practicable after the commissioner becomes aware of the insufficiency.

601.83(4) (4) Reinsurance payment calculation.

601.83(4)(a) (a) The commissioner shall calculate a reinsurance payment with respect to each eligible health carrier’s incurred claims costs for an enrolled individual’s covered benefits in the applicable benefit year. If the claims costs for an enrolled individual do not exceed the attachment point set under sub. (2), the commissioner may not make a reinsurance payment with respect to that enrollee. If the claims costs for an enrolled individual exceed the attachment point, subject to par. (b), the commissioner shall make a reinsurance payment that is calculated as the product of the coinsurance rate and whichever of the following is less:

601.83(4)(a)1. 1. The claims costs minus the attachment point.

601.83(4)(a)2. 2. The reinsurance cap minus the attachment point.

601.83(4)(b) (b) The commissioner shall ensure that any reinsurance payment made to an eligible health carrier does not exceed the total amount paid by the eligible health carrier for any claim. For purposes of this paragraph, the total amount paid of a claim is the amount paid by the eligible health carrier based upon the allowed amount less any deductible, coinsurance, or copayment paid by another person as of the time the data are submitted or made accessible under sub. (5) (c).

601.83(5) (5) Reinsurance payment requests.

601.83(5)(a) (a) An eligible health carrier may request reinsurance payments from the commissioner when the eligible health carrier meets the requirements of this subsection and sub. (4).

601.83(5)(b) (b) An eligible health carrier shall make any requests for a reinsurance payment in accordance with any requirements established by the commissioner.

601.83(5)(c) (c) Each eligible health carrier shall provide the commissioner with access to the data within the dedicated data environment established by the eligible health carrier under the federal risk adjustment program under 42 USC 18063. Each eligible health carrier shall submit to the commissioner attesting to compliance with the dedicated data environments, data requirements, establishment and usage of masked enrollee identification numbers, and data submission deadlines.

601.83(5)(d) (d) Each eligible health carrier shall provide the access under par. (c) for each applicable benefit year by April 30 of the calendar year following the end of the applicable benefit year.

601.83(5)(e) (e) Each eligible health carrier shall maintain for at least 6 years documents and records, by paper, electronic, or other media, sufficient to substantiate a request for a reinsurance payment made under this section. An eligible health carrier shall make the documents and records available to the commissioner, upon request, for purposes of verification, investigation, audit, or other review of a reinsurance payment request.

601.83(5)(f) (f) The commissioner may have an eligible health carrier audited to assess the health carrier’s compliance with the requirements of this section. The eligible health carrier shall ensure that its contractors, subcontractors, or agents cooperate with any audit under this paragraph. Within 30 days of receiving notice that an audit results in a proposed finding of material weakness or significant deficiency with respect to compliance with any requirement of this section, the eligible health carrier may provide a response to the proposed finding. Within 60 days of the issuance of a final audit report that includes a finding of material weakness or significant deficiency, the eligible health carrier shall do all of the following:

601.83(5)(f)1. 1. Provide a written corrective action plan to the commissioner for approval.

601.83(5)(f)2. 2. Implement the corrective action plan under subd. 1. as approved by the commissioner.

601.83(5)(f)3. 3. Provide the commissioner with written documentation of the corrective action after implementation.

601.83(5)(g) (g) The commissioner may recover from an eligible health carrier any overpayment of reinsurance payments as determined under the audit under par. (f).

601.83(5)(h) (h) A health carrier is not eligible to receive a reinsurance payment unless the health carrier agrees not to bring a lawsuit against the commissioner or a state agency or employee over any delay in reinsurance payments or any reduction in reinsurance payments in accordance with sub. (3) (c).

601.83(6) (6) Access to information. Information submitted by an eligible health carrier or obtained by the commissioner for purposes of the healthcare stability plan shall be used only for purposes of this subchapter and is proprietary and confidential under s. 601.465.

601.83 History History: 2017 a. 138, 370; 2021 a. 58.

601.85 601.85 Accounting, reports, and audits.

601.85(1) (1) Accounting. The commissioner shall keep an accounting for each benefit year of all of the following:

601.85(1)(a) (a) Funds appropriated for reinsurance payments and administrative and operational expenses.

601.85(1)(b) (b) Requests for reinsurance payments received from eligible health carriers.

601.85(1)(c) (c) Reinsurance payments made to eligible health carriers.

601.85(1)(d) (d) Administrative and operational expenses incurred for the healthcare stability plan.

601.85(2) (2) Reports. By November 1 of the calendar year following the applicable benefit year or by 60 days following the final disbursement of reinsurance payments for the applicable benefit year, whichever is later, the commissioner shall make available to the public a report summarizing the healthcare stability plan’s operations for each benefit year by posting the summary on the office’s Internet site.

601.85(3) (3) Legislative auditor. The healthcare stability plan is subject to audit by the legislative audit bureau. The commissioner shall ensure that its contractors, subcontractors, or agents cooperate with any audit of the healthcare stability plan performed by the legislative audit bureau.

601.85 History History: 2017 a. 138, 370.

subch. VIII of ch. 601 SUBCHAPTER VIII

FIRE DEPARTMENT DUES

601.93 601.93 Payment of dues.

601.93(1g) (1g) In this section, “fire insurance” includes insurance against loss of or damage to:

601.93(1g)(a) (a) Notes, acceptances or any other valuable papers or documents, resulting from any cause, except while in the mail or in the custody or possession of and being transported by any carrier for hire; and

601.93(1g)(b) (b) Personal property of individuals when written under an all-risk type of policy commonly known as the “personal property floater”, whenever these risks are written in conjunction with insurance against burglary or theft.

601.93(1m) (1m) Any insurer doing a fire insurance business in this state shall pay fire department dues equal to 2 percent of the amount of all premiums which, during the preceding calendar year, have been received by, or have been agreed to be paid to, the company for insurance against loss by fire, including insurance on property exempt from taxation.

601.93(2) (2) Every insurer doing a fire insurance business in this state shall, before March 1 in each year, file with the commissioner a statement, showing the amount of premiums upon fire insurance due for the preceding calendar year. Return premiums may be deducted in determining the premium on which the fire department dues are computed. Payments of quarterly installments of the total estimated payment for the then current calendar year under this subsection are due on or before April 15, June 15, September 15 and December 15. On March 1 the insurer shall pay any additional amounts due for the preceding calendar year. Overpayments will be credited on the amount due April 15. The commissioner shall, prior to May 1 each year, report to the department of safety and professional services the amount of dues paid under this subsection and to be paid under s. 101.573 (1).

601.93 History History: 1971 c. 154; 1975 c. 372 ss. 5, 38; 1975 c. 421; Stats. 1975 s. 601.93; 1977 c. 29; 1979 c. 34, 102, 177, 221; 1981 c. 20; 1987 a. 166; 1995 a. 27 ss. 7019, 9130 (4); 2001 a. 103; 2011 a. 32.

601.935 601.935 Penalties.

601.935(1) (1) Late payment. An insurer that fails to make quarterly payments under s. 601.93 (2) of at least 25 percent of either the total fire dues paid for the previous calendar year or 80 percent of the actual fire dues for the current calendar year is liable, in addition to the amount due, for interest of 1.5 percent of the amount due and unpaid for each month or part of a month that the amount due, together with any interest, remains unpaid.

601.935(2) (2) Negligence. An insurer that fails to pay an amount due, or file a statement required, under s. 601.93 (2), unless the insurer shows that the failure is due to reasonable cause and not due to willful neglect, is liable for the greater of the following amounts:

601.935(2)(a) (a) Five hundred dollars.

601.935(2)(b) (b) Five percent of the amount due for each month or fraction of a month during which the failure continues, but not more than 25 percent of the amount due.

601.935 History History: 1987 a. 166.

subch. IX of ch. 601 SUBCHAPTER IX

INSURANCE DATA SECURITY

601.95 601.95 Definitions. In this subchapter:

601.95(1) (1) “Authorized individual” means an individual who is known to and screened by a licensee and whose access to the licensee’s information system or nonpublic information is determined by the licensee to be necessary and appropriate.

601.95(2) (2) “Consumer” means an individual who is a resident of this state and whose nonpublic information is in the possession, custody, or control of a licensee.

601.95(3) (3) “Cybersecurity event” means an event resulting in the unauthorized access to, or disruption or misuse of, an information system or the nonpublic information stored on an information system, except that a “cybersecurity event” does not include any of the following:

601.95(3)(a) (a) The unauthorized acquisition of encrypted nonpublic information if the encryption process or key is not also acquired, released, or used without authorization.

601.95(3)(b) (b) The unauthorized acquisition of nonpublic information if the licensee determines that the nonpublic information has not been used or released and has been returned to the licensee or destroyed.

601.95(4) (4) “Encrypted” means the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key.

601.95(5) (5) “Information security program” means the administrative, technical, and physical safeguards that a licensee uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle nonpublic information.

601.95(6) (6) “Information system” means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of nonpublic information, as well as any specialized system, including an industrial or process controls system, telephone switching and private branch exchange system, and environmental control system.

601.95(7) (7) “Licensee” means a person licensed, authorized, or registered, or a person required to be licensed, authorized, or registered, under chs. 600 to 655, other than a purchasing or risk retention group that is chartered and licensed in another state or a person acting as an assuming insurer that is domiciled in another state or jurisdiction.

601.95(8) (8) “Multifactor authentication” means authentication through verification of at least 2 of the following types of authentication factors:

601.95(8)(a) (a) Knowledge factor, including a password.

601.95(8)(b) (b) Possession factor, including a token or text message on a mobile phone.

601.95(8)(c) (c) Inherence factor, including a biometric characteristic.

601.95(9) (9) “Nonpublic information” means electronic information in the possession, custody, or control of a licensee that is not publicly available information and is any of the following:

601.95(9)(a) (a) Information concerning a consumer that can be used to identify the consumer, in combination with at least one of the following data elements:

601.95(9)(a)1. 1. Social security number.

601.95(9)(a)2. 2. Driver’s license number or nondriver identification card number.

601.95(9)(a)3. 3. Financial account number or credit or debit card number.

601.95(9)(a)4. 4. Security code, access code, or password that permits access to a financial account.

601.95(9)(a)5. 5. Biometric records.

601.95(9)(b) (b) Information or data, other than information or data regarding age or gender, in any form or medium created by or derived from a health care provider or a consumer that can be used to identify the consumer and that relates to any of the following:

601.95(9)(b)1. 1. The physical, mental, or behavioral health or condition of the consumer or a member of the consumer’s family.

601.95(9)(b)2. 2. The provision of health care to the consumer.

601.95(9)(b)3. 3. Payment for the provision of health care to the consumer.

601.95(10) (10) “Publicly available information” means information that a licensee has a reasonable basis to believe is lawfully made available to the general public from federal, state, or local government records, widely distributed media, or disclosures required by federal, state, or local law.

601.95(11) (11) “Third-party service provider” means a person other than a licensee who contracts with a licensee to maintain, process, or store nonpublic information or is otherwise permitted access to nonpublic information through its provision of services to the licensee.

601.95 History History: 2021 a. 73.

601.951 601.951 General provisions.

601.951(1) (1) Exclusive state standards. This subchapter establishes the exclusive state standards applicable to licensees for data security, the investigation of a cybersecurity event, and notification of a cybersecurity event or unauthorized access to nonpublic information to the state government and consumers.

601.951(2) (2) Exceptions to applicability.

601.951(2)(a) (a) This subchapter does not apply to a person who is an employee, agent, representative, or designee of a licensee and who is also a licensee to the extent that the person is covered by the information security program of the other licensee and the other licensee has complied with this subchapter on behalf of the person.

601.951(2)(b) (b) A licensee affiliated with a depository institution that maintains an information security program in compliance with the interagency guidelines establishing information security standards as set forth pursuant to 15 USC 6801 and 6805 shall be considered to meet the requirements of this subchapter, provided that the licensee produces, upon request of the commissioner, documentation satisfactory to the commissioner that independently validates the adoption by the affiliated depository institution of an information security program that satisfies the interagency guidelines.

601.951(2)(bm) (bm) A licensee affiliated with a broker, as defined in 15 USC 78c (a) (4), or dealer, as defined in 15 USC 78c (a) (5), that maintains an information security program in compliance with the requirements of the financial industry regulatory authority that address information security standards shall be considered to meet the requirements of this subchapter, provided that the licensee produces, upon request of the commissioner, documentation satisfactory to the commissioner that independently validates the adoption by the affiliated broker or dealer of an information security program that satisfies the financial industry regulatory authority’s requirements.

601.951(2)(c) (c) A licensee affiliated with a legal entity established pursuant to the federal farm credit act of 1971, 12 USC 2001, et seq., that maintains an information security program in compliance with the farm credit administration’s guidance and regulations establishing policies and procedures to address data security and integrity shall be considered to meet the requirements of this subchapter, provided that the licensee produces, upon request of the commissioner, documentation satisfactory to the commissioner that independently validates the adoption by the affiliated legal entity of an information security program that satisfies the farm credit administration’s guidance and regulations.

601.951(2)(d) (d) This subchapter, except for s. 601.954 (1), does not apply to a licensee who is subject to and governed by 45 CFR Parts 160 and 164 and who maintains nonpublic information in the same manner as protected health information under 45 CFR Parts 160 and 164.

601.951(2)(e) (e) If a licensee ceases to qualify for an exception under par. (a) to (d), the licensee shall have 180 days to comply with this subchapter.

601.951(3) (3) Agreements between parties. Nothing in this subchapter shall prevent or abrogate an agreement between a licensee and another licensee, a 3rd-party service provider, or another party to fulfill any of the requirements under s. 601.953 or 601.954.