Minnesota Statutes Insurance (Ch. 59A-79a) § 60A.9856. Exceptions

(1) a licensee with fewer than 25 employees is exempt fromsections 60A.9851and60A.9852;

(2) a licensee subject to and in compliance with the Health Insurance Portability and Accountability Act,Public Law 104-191, 110 Stat. 1936(HIPAA), is considered to comply withsections 60A.9851,60A.9852, and60A.9853, subdivisions 3to5, provided the licensee submits a written statement certifying its compliance with HIPAA;

(3) a licensee affiliated with a depository institution that maintains an information security program in compliance with the interagency guidelines establishing standards for safeguarding customer information as set forth pursuant toUnited States Code, title 15, sections 6801and6805, shall be considered to meet the requirements ofsection 60A.9851provided that the licensee produce, upon request, documentation satisfactory to the commission that independently validates the affiliated depository institution's adoption of an information security program that satisfies the interagency guidelines;

(4) an employee, agent, representative, or designee of a licensee, who is also a licensee, is exempt fromsections 60A.9851and60A.9852and need not develop its own information security program to the extent that the employee, agent, representative, or designee is covered by the information security program of the other licensee; and

(5) an employee, agent, representative, or designee of a producer licensee, as defined undersection 60K.31, subdivision 6, who is also a licensee, is exempt fromsections 60A.985to60A.9857.