Hawaii Revised Statutes Division 2. Business § 431:3B-104

(1) A licensee with fewer than ten employees, including any independent contractors, shall be exempt from part II;

(2) A licensee subject to the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, that has established and maintains an information security program pursuant to the statutes, rules, regulations, procedures, or guidelines established thereunder shall be considered to have met the requirements of part II of this article; provided that the licensee is compliant with and submits a written statement certifying its compliance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191; and

(3) An employee, agent, representative, or designee of a licensee, who is also a licensee, shall be exempt from part II of this article and shall not be required to develop its own information security program; provided that the employee, agent, representative, or designee is covered by the information security program of the other licensee.