SB784,5,3 (c) Inherence factor, including a biometric characteristic.

SB784,5,6 (9) “Nonpublic information” means electronic information in the possession, custody, or control of a licensee that is not publicly available information and is any of the following:

SB784,5,8 (a) Information concerning a consumer that can be used to identify the consumer, in combination with at least one of the following data elements:

SB784,5,9 1. Social security number.

SB784,5,10 2. Driver's license number or nondriver identification card number.

SB784,5,11 3. Financial account number or credit or debit card number.

SB784,5,13 4. Security code, access code, or password that permits access to a financial account.

SB784,5,14 5. Biometric records.

SB784,5,18 (b) Information or data, other than information or data regarding age or gender, in any form or medium created by or derived from a health care provider or a consumer that can be used to identify the consumer and that relates to any of the following:

SB784,5,20 1. The physical, mental, or behavioral health or condition of the consumer or a member of the consumer's family.

SB784,5,21 2. The provision of health care to the consumer.

SB784,5,22 3. Payment for the provision of health care to the consumer.

SB784,6,2 (10) “Publicly available information” means information that a licensee has a reasonable basis to believe is lawfully made available to the general public from federal, state, or local government records, widely distributed media, or disclosures required by federal, state, or local law.

SB784,6,6 (11) “Third-party service provider” means a person other than a licensee who contracts with a licensee to maintain, process, or store nonpublic information or is otherwise permitted access to nonpublic information through its provision of services to the licensee.

SB784,4 Section 4. 601.951 of the statutes is created to read:

SB784,6,11 601.951 General provisions. (1) Exclusive state standards. This subchapter establishes the exclusive state standards applicable to licensees for data security, the investigation of a cybersecurity event, and notification of a cybersecurity event to the commissioner.

SB784,6,16 (2) Exceptions to applicability. (a) This subchapter does not apply to a person who is an employee, agent, representative, or designee of a licensee and who is also a licensee to the extent that the person is covered by the information security program of the other licensee and the other licensee has complied with this subchapter on behalf of the person.

SB784,6,20 (b) This subchapter, except for s. 601.954 (1), does not apply to a licensee who is subject to and governed by 45 CFR Parts 160 and 165 and who maintains nonpublic information in the same manner as protected health information under 45 CFR Parts 160 and 165.

SB784,6,22 (c) If a licensee ceases to qualify for an exception under par. (a) or (b), the licensee shall have 180 days to comply with this subchapter.

SB784,7,2 (3) Agreements between parties. Nothing in this subchapter shall prevent or abrogate an agreement between a licensee and another licensee, a 3rd-party service provider, or another party to fulfill any of the requirements under s. 601.953 or 601.954.

SB784,7,5 (4) Private cause of action. This subchapter may not be construed to create or imply a private cause of action for violation of its provisions or to curtail a private cause of action that otherwise exists in the absence of this subchapter.

SB784,7,7 (5) Rules. The commissioner may promulgate rules that are necessary to carry out the provisions of this subchapter.

SB784,5 Section 5. 601.952 of the statutes is created to read:

SB784,7,16 601.952 Information security program. (1) Implementation of program. No later than one year after the effective date of this subsection .... [LRB inserts date], a licensee shall develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment under sub. (2) and consistent with the conditions of sub. (3) (a). The program shall contain administrative, technical, and physical safeguards for the protection of the licensee's information systems and nonpublic information. The licensee shall design the program to do all of the following:

SB784,7,18 (a) Protect against threats and hazards to the security and integrity of the information systems and nonpublic information.

SB784,7,21 (b) Protect against unauthorized access to and use of nonpublic information and minimize the likelihood of harm to a consumer from the unauthorized access or use.

SB784,7,24 (c) Establish and periodically reevaluate a schedule for retention and disposal of nonpublic information and establish a mechanism for the destruction of nonpublic information that is no longer needed.

SB784,8,2 (2) Risk assessment. The licensee shall conduct a risk assessment under which the licensee shall do all of the following:

SB784,8,6 (a) Identify reasonably foreseeable internal and external threats that could result in unauthorized access to or transmission, disclosure, misuse, alteration, or destruction of nonpublic information, including nonpublic information that is accessible to or held by 3rd-party service providers of the licensee.