Kentucky Revised Statutes Title XXXIV. Descent, Wills, and Administration of Decedents' Estates § 393A.820.Security of information

(a) Implement administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of the information as required by KRS 365.720 to 365.730 and federal privacy and data security law, whether or not the administrator or the administrator's agent is subject to the law;

(b) Protect against reasonably anticipated threats or hazards to the security, confidentiality, or integrity of the information; and

(c) Protect against unauthorized access to or use of the information which could result in substantial harm or inconvenience to a holder or the holder's customers, including insureds, annuitants, and policy or contract owners and their beneficiaries.

(a) After notice and comment, shall adopt and implement a security plan that identifies and assesses reasonably foreseeable internal and external risks to confidential information in the administrator's possession and seeks to mitigate the risks; and

(b) Shall ensure that an administrator's agent adopts and implements a similar plan with respect to confidential information in the agent's possession.