Shown verbatim: the complete text as captured from the official PDF posted by the Missouri General Assembly, fetched 2026-09-25. Page and line markers are part of the official record; nothing is edited or removed. The official bill page.
FIRST REGULAR SESSION
[TRULY AGREED TO AND FINALLY PASSED]
SENATE SUBSTITUTE FOR
HOUSE COMMITTEE SUBSTITUTE FOR
HOUSE BILL NOS. 974, 57, 1032 &
1141
103RD GENERAL ASSEMBLY
2332S.05T 2025
AN ACT
To amend chapters 375 and 379, RSMo, by adding thereto twenty-seven new sections relating
to insurance modernization through standards governing digital systems, with a
delayed effective date for certain sections.
Be it enacted by the General Assembly of the state of Missouri, as follows:
Section A. Chapters 375 and 379, RSMo, are amended by adding thereto twenty-
2 seven new sections, to be known as sections 375.1400, 375.1402, 375.1405, 375.1407,
3 375.1410, 375.1412, 375.1415, 375.1417, 375.1420, 375.1422, 375.1425, 375.1427,
4 379.1900, 379.1905, 379.1910, 379.1915, 379.1920, 379.1925, 379.1930, 379.1935,
5 379.1940, 379.1945, 379.1950, 379.1955, 379.1960, 379.1965, and 379.1970, to read as
6 follows:
375.1400. 1. Sections 375.1400 to 375.1427 shall be known and may be cited as
2 the "Insurance Data Security Act".
3 2. Notwithstanding any other provision of law, sections 375.1400 to 375.1427
4 establish the exclusive state standards applicable to licensees for data security, the
5 investigation of a cybersecurity event as defined in section 375.1402, and notification to
6 the director.
7 3. Sections 375.1400 to 375.1427 shall not be construed to create or imply a
8 private cause of action for violation of their provisions, nor shall such sections be
EXPLANATION — Matter enclosed in bold-faced brackets [thus] in the above bill is not enacted and is
intended to be omitted from the law. Matter in bold-face type in the above bill is proposed language.
SS HCS HBs 974, 57, 1032 & 1141 2
9 construed to curtail a private cause of action that would otherwise exist in the absence of
10 sections 375.1400 to 375.1427.
375.1402. 1. As used in sections 375.1400 to 375.1427, the following terms mean:
2 (1) "Authorized person", an individual known to and authorized by the licensee
3 and determined to be necessary and appropriate to have access to the nonpublic
4 information held by the licensee and its information systems;
5 (2) "Consumer", an individual, including, but not limited to, applicants,
6 policyholders, insureds, beneficiaries, claimants, and certificate holders, who is a
7 resident of this state and whose nonpublic information is in a licensee's possession,
8 custody, or control;
9 (3) "Cybersecurity event", an event resulting in unauthorized access to,
10 malicious disruption of, or misuse of an information system or nonpublic information in
11 the possession, custody, or control of a licensee or an authorized person; however:
12 (a) The term "cybersecurity event" does not include the unauthorized
13 acquisition of encrypted, nonpublic information if the encryption, process, or key is
14 not also acquired, released, or used without authorization; and
15 (b) The term "cybersecurity event" does not include an event with regard to
16 which the licensee has determined that the nonpublic information accessed by an
17 unauthorized person has not been used or released and has been returned or destroyed;
18 (4) "Department", the department of commerce and insurance;
19 (5) "Director", the director of the department of commerce and insurance;
20 (6) "Encrypted", the transformation of data into a form that results in a low
21 probability of assigning meaning without the use of a protective process or key;
22 (7) "HIPAA", the federal Health Insurance Portability and Accountability Act
23 (42 U.S.C. Section 1320d et seq.);
24 (8) "Information security program", the administrative, technical, and physical
25 safeguards that a licensee uses to access, collect, distribute, process, protect, store, use,
26 transmit, dispose of, or otherwise handle nonpublic information;
27 (9) "Information system", a discrete set of electronic information resources
28 organized for the collection, processing, maintenance, use, sharing, dissemination, or
29 disposition of electronic nonpublic information, as well as any specialized system such as
30 industrial and process controls systems, telephone switching and private branch
31 exchange systems, and environmental control systems;
32 (10) "Licensee", any person licensed, authorized to operate, or registered, or
33 required to be licensed, authorized, or registered under the insurance laws of this state,
34 but shall not include a purchasing group or a risk retention group chartered and
SS HCS HBs 974, 57, 1032 & 1141 3
35 licensed in a state other than this state or a licensee that is acting as an assuming insurer
36 that is domiciled in another state or jurisdiction;
37 (11) "Multi-factor authentication", authentication through verification of at
38 least two of the following types of authentication factors:
39 (a) Knowledge factors, such as a password;
40 (b) Possession factors, such as a token or text message on a mobile phone; or
41 (c) Inherence factors, such as a biometric characteristic;
42 (12) "Nonpublic information", information that is not publicly available
43 information and is:
44 (a) Business-related information of a licensee, the tampering with which, or
45 unauthorized disclosure, access, or use of which, would cause a material adverse impact
46 to the business, operations, or security of the licensee;
47 (b) Any information concerning a consumer that, because of name, number,
48 personal mark, or other identifier, can be used to identify such consumer, in
49 combination with any one or more of the following data elements:
50 a. Social Security number;
51 b. Driver's license number or nondriver identification card number;
52 c. Financial account number or credit or debit card number;
53 d. Any security code, access code, or password that would permit access to a
54 consumer's financial account;
55 e. Biometric records; or
56 f. Military identification number;
57 (c) Any information or data, except age or gender, in any form or medium
58 created by or derived from a health care provider or a consumer and that relates to:
59 a. The past, present, or future physical, mental, or behavioral health or
60 condition of any consumer or a member of the consumer's family;
61 b. The provision of health care to any consumer; or
62 c. Payment for the provision of health care to any consumer;
63 (13) "Person", any individual or any nongovernmental entity including, but not
64 limited to, any nongovernmental partnership, corporation, branch, agency, or
65 association;
66 (14) "Publicly available information", any information that a licensee has a
67 reasonable basis to believe is lawfully made available to the general public from federal,
68 state, or local government records; widely distributed media; or disclosures to the
69 general public that are required to be made by federal, state, or local law. For the
70 purposes of this definition, a licensee has a reasonable basis to believe that information
SS HCS HBs 974, 57, 1032 & 1141 4
71 is lawfully made available to the general public if the licensee has taken steps to
72 determine:
73 (a) That the information is of the type that is available to the general public; and
74 (b) Whether a consumer can direct that the information not be made available to
75 the general public and, if so, that such consumer has not done so;
76 (15) "Risk assessment", the risk assessment that each licensee is required to
77 conduct under subsection 3 of section 375.1405;
78 (16) "State", the state of Missouri;
79 (17) "Third-party service provider", a person, not otherwise defined as a
80 licensee, that contracts with a licensee to maintain, process, store, or otherwise is
81 permitted access to nonpublic information through its provision of services to the
82 licensee.
375.1405. 1. Commensurate with the size and complexity of the licensee; the
2 nature and scope of the licensee's activities, including its use of third-party service
3 providers; and the sensitivity of the nonpublic information used by the licensee or in the
4 licensee's possession, custody, or control, each licensee shall develop, implement, and
5 maintain a comprehensive written information security program that is based on the
6 licensee's risk assessment and that contains administrative, technical, and physical
7 safeguards for the protection of nonpublic information and the licensee's information
8 system.
9 2. A licensee's information security program shall be designed to:
10 (1) Protect the security and confidentiality of nonpublic information and the
11 security of the information system;
12 (2) Protect against any threats or hazards to the security or integrity of
13 nonpublic information and the information system;
14 (3) Protect against unauthorized access to or use of nonpublic information and
15 minimize the likelihood of harm to any consumer; and
16 (4) Define and periodically reevaluate a schedule for retention of nonpublic
17 information and a mechanism for its destruction when no longer needed.
18 3. The licensee shall:
19 (1) Designate one or more employees, an affiliate, or an outside vendor
20 designated to act on behalf of the licensee who is responsible for the information security
21 program;
22 (2) Identify reasonably foreseeable internal or external threats that could result
23 in unauthorized access, transmission, disclosure, misuse, alteration, or destruction of
24 nonpublic information, including the security of information systems and nonpublic
25 information that are accessible to, or held by, third-party service providers;
SS HCS HBs 974, 57, 1032 & 1141 5
26 (3) Assess the likelihood and potential damage of these threats, taking into
27 consideration the sensitivity of the nonpublic information;
28 (4) Assess the sufficiency of policies, procedures, information systems, and other
29 safeguards in place to manage these threats, including consideration of threats in each
30 relevant area of the licensee's operations, including:
31 (a) Employee training and management;
32 (b) Information systems, including network and software design, as well as
33 information classification, governance, processing, storage, transmission, and disposal;
34 and
35 (c) Detecting, preventing, and responding to attacks, intrusions, or other systems
36 failures; and
37 (5) Implement information safeguards to manage the threats identified in its
38 ongoing assessment, and no less than annually, assess the effectiveness of the safeguards'
39 key controls, systems, and procedures.
40 4. Based on its risk assessment, the licensee shall:
41 (1) Design its information security program to mitigate the identified risks,
42 commensurate with the size and complexity of the licensee's activities, including its use
43 of third-party service providers, and the sensitivity of the nonpublic information used
44 by the licensee or in the licensee's possession, custody, or control;
45 (2) Determine which of the following security measures are appropriate and
46 implement such security measures:
47 (a) Place access controls on information systems, including controls to
48 authenticate and permit access only to authorized persons to protect against the
49 unauthorized acquisition of nonpublic information;
50 (b) Identify and manage the data, personnel, devices, systems, and facilities that
51 enable the organization to achieve business purposes in accordance with their relative
52 importance to business objectives and the organization's risk strategy;
53 (c) Restrict access at physical locations containing nonpublic information only to
54 authorized persons;
55 (d) Protect by encryption or other appropriate means all nonpublic information
56 while being transmitted over an external network and all nonpublic information stored
57 on a laptop computer or other portable computing or storage device or media;
58 (e) Adopt secure development practices for in-house developed applications
59 utilized by the licensee and procedures for evaluating, assessing, or testing the security
60 of externally developed applications utilized by the licensee;
61 (f) Modify the information system in accordance with the licensee's information
62 security program;
SS HCS HBs 974, 57, 1032 & 1141 6
63 (g) Utilize effective controls, which may include multi-factor authentication
64 procedures for any individual accessing nonpublic information;
65 (h) Regularly test and monitor systems and procedures to detect actual and
66 attempted attacks on, or intrusions into, information systems;
67 (i) Include audit trails within the information security program designed to
68 detect and respond to cybersecurity events and designed to reconstruct material
69 financial transactions sufficient to support normal operations and obligations of the
70 licensee;
71 (j) Implement measures to protect against destruction, loss, or damage of
72 nonpublic information due to environmental hazards, such as fire and water damage or
73 other catastrophes or technological failures; and
74 (k) Develop, implement, and maintain procedures for the secure disposal of
75 nonpublic information in any format;
76 (3) Include cybersecurity risks in the licensee's enterprise risk management
77 process;
78 (4) Stay informed regarding emerging threats or vulnerabilities and utilize
79 reasonable security measures when sharing information relative to the character of the
80 sharing and the type of information shared; and
81 (5) Provide its personnel with cybersecurity awareness training that is updated
82 as necessary to reflect risks identified by the licensee in the risk assessment.
83 5. If the licensee has a board of directors, the board or an appropriate committee
84 of the board shall, at a minimum:
85 (1) Require the licensee's executive management or its delegates to develop,
86 implement, and maintain the licensee's information security program;
87 (2) Require the licensee's executive management or its delegates to report in
88 writing, at least annually, the following information:
89 (a) The overall status of the information security program and the licensee's
90 compliance with sections 375.1400 to 375.1427; and
91 (b) Material matters related to the information security program, addressing
92 issues such as risk assessment, risk management and control decisions, third-party
93 service provider arrangements, results of testing, cybersecurity events or violations and
94 management's responses thereto, and recommendations for changes in the information
95 security program;
96 (3) If executive management delegates any of its responsibilities under section
97 375.1405, it shall oversee the development, implementation, and maintenance of the
98 licensee's information security program prepared by the delegates and shall receive a
SS HCS HBs 974, 57, 1032 & 1141 7
99 report from the delegates complying with the requirements of the report to the board of
100 directors above.
101 6. (1) A licensee shall exercise due diligence in selecting its third-party service
102 provider.
103 (2) A licensee shall require a third-party service provider to implement
104 appropriate administrative, technical, and physical measures to protect and secure the
105 information systems and nonpublic information that are accessible to, or held by, the
106 third-party service provider.
107 7. The licensee shall monitor, evaluate, and adjust, as appropriate, the
108 information security program consistent with any relevant changes in technology, the
109 sensitivity of its nonpublic information, internal or external threats to information, and
110 the licensee's own changing business arrangements, such as mergers and acquisitions,
111 alliances and joint ventures, outsourcing arrangements, and changes to information
112 systems.
113 8. As part of its information security program, each licensee shall establish a
114 written incident response plan designed to promptly respond to, and recover from, any
115 cybersecurity event that compromises the confidentiality, integrity, or availability of
116 nonpublic information in its possession, the licensee's information systems, or the
117 continuing functionality of any aspect of the licensee's business or operations. Such
118 incident response plan shall address the following areas:
119 (1) The internal process for responding to a cybersecurity event;
120 (2) The goals of the incident response plan;
121 (3) The definition of clear roles, responsibilities, and levels of decision-making
122 authority;
123 (4) External and internal communications and information sharing;
124 (5) Identification of requirements for the remediation of any identified
125 weaknesses in information systems and associated controls;
126 (6) Documentation and reporting regarding cybersecurity events and related
127 incident response activities; and
128 (7) The evaluation and revision as necessary of the incident response plan
129 following a cybersecurity event.
130 9. Annually by April fifteenth, each insurer domiciled in this state shall submit
131 to the director a written statement certifying that the insurer is in compliance with the
132 requirements set forth in this section. Each insurer shall maintain for examination by
133 the department all records, schedules, and data supporting this certificate for a period
134 of five years. To the extent an insurer has identified areas, systems, or processes that
135 require material improvement, updating, or redesign, the insurer shall document the
SS HCS HBs 974, 57, 1032 & 1141 8
136 identification and the remedial efforts planned and underway to address such areas,
137 systems, or processes. Such documentation shall be available for inspection by the
138 director.
375.1407. 1. If the licensee learns that a cybersecurity event has or may have
2 occurred, the licensee, or an outside vendor or service provider designated to act on
3 behalf of the licensee, shall conduct a prompt investigation.
4 2. During the investigation, the licensee, or an outside vendor or service provider
5 designated to act on behalf of the licensee, shall, at a minimum, determine as much of
6 the following information as practicable:
7 (1) Determine whether a cybersecurity event has occurred;
8 (2) Assess the nature and scope of the cybersecurity event;
9 (3) Identify any nonpublic information that may have been involved in the
10 cybersecurity event; and
11 (4) Perform or oversee reasonable measures to restore the security of the
12 information systems compromised in the cybersecurity event in order to prevent further
13 unauthorized acquisition, release, or use of nonpublic information in the licensee's
14 possession, custody, or control.
15 3. If the licensee learns that a cybersecurity event has or may have occurred in a
16 system maintained by a third-party service provider, the licensee shall complete the
17 steps listed in subsection 2 of this section or confirm and document that the third-party
18 service provider has completed those steps.
19 4. The licensee shall maintain records concerning all cybersecurity events for a
20 period of at least three years from the date of the cybersecurity event and shall produce
21 those records upon demand of the director.
375.1410. 1. Each licensee shall notify the director as promptly as practicable,
2 but in no event later than four business days, from a determination that a cybersecurity
3 event involving nonpublic information that is in the possession of a licensee has occurred
4 when either of the following criteria has been met:
5 (1) This state is the licensee's state of domicile, in the case of an insurer, or this
6 state is the licensee's home state, in the case of a producer, as those terms are defined in
7 section 375.012, and the cybersecurity event has a reasonable likelihood of materially
8 harming a consumer residing in this state or a reasonable likelihood of materially
9 harming any material part of the normal operations of the licensee; or
10 (2) The licensee reasonably believes that the nonpublic information involved is of
11 two hundred fifty or more consumers residing in this state and is either of the following:
SS HCS HBs 974, 57, 1032 & 1141 9
12 (a) A cybersecurity event impacting the licensee of which notice is required to be
13 provided to any government body, self-regulatory agency, or any other supervisory body
14 under any state or federal law; or
15 (b) A cybersecurity event that has a reasonable likelihood of materially
16 harming:
17 a. Any consumer residing in this state; or
18 b. Any material part of the normal operations of the licensee.
19 2. The licensee shall provide as much of the following information as practicable
20 except that the licensee shall not release to the state or any other entity nonpublic
21 information of the consumer unless given written authority by the consumer or
22 otherwise required by law. The licensee shall provide the information in electronic form
23 as directed by the director. The licensee shall have a continuing obligation to update
24 and supplement initial and subsequent notifications to the director regarding material
25 changes to previously provided information relating to the cybersecurity event:
26 (1) The date of the cybersecurity event;
27 (2) A description of how the information was exposed, lost, stolen, or breached,
28 including the specific roles and responsibilities of third-party service providers, if any;
29 (3) How the cybersecurity event was discovered;
30 (4) Whether any exposed, lost, stolen, or breached information has been
31 recovered and if so, how this was done;
32 (5) The identity of the source of the cybersecurity event;
33 (6) Whether the licensee has filed a police report or has notified any regulatory,
34 government, or law enforcement agencies and, if so, when such notification was
35 provided;
36 (7) A description of the specific types of information acquired without
37 authorization. "Specific types of information" means particular data elements
38 including, for example, types of medical information, types of financial information,
39 or types of information allowing identification of the consumer;
40 (8) The period during which the information system was compromised by the
41 cybersecurity event;
42 (9) The number of total consumers in this state affected by the cybersecurity
43 event. The licensee shall provide the best estimate in the initial report to the director
44 and update this estimate with each subsequent report to the director under this section;
45 (10) The results of any internal review identifying a lapse in either automated
46 controls or internal procedures, or confirming that all automated controls or internal
47 procedures were followed;
SS HCS HBs 974, 57, 1032 & 1141 10
48 (11) A description of the efforts being undertaken to remediate the situation that
49 permitted the cybersecurity event to occur;
50 (12) A copy of the licensee's privacy policy and a statement outlining the steps
51 the licensee will take to investigate and notify consumers affected by the cybersecurity
52 event; and
53 (13) The name of a contact person who is both familiar with the cybersecurity
54 event and authorized to act for the licensee.
55 3. The licensee shall comply with section 407.1500, as applicable, and provide a
56 copy of the notice sent to consumers under that section to the director when a licensee is
57 required to notify the director under subsection 1 of section 375.1410.
58 4. (1) In the case of a cybersecurity event in a system maintained by a third-
59 party service provider of which the licensee has become aware, the licensee shall treat
60 such event as it would under subsection 1 of section 375.1410.
61 (2) The computation of a licensee's deadlines shall begin on the day after the
62 third-party service provider notifies the licensee of the cybersecurity event or the
63 licensee otherwise has actual knowledge of the cybersecurity event, whichever is sooner.
64 (3) Nothing in sections 375.1400 to 375.1427 shall prevent or abrogate an
65 agreement between a licensee and another licensee, a third-party service provider, or
66 any other party to fulfill any of the investigation requirements imposed under section
67 375.1407 or notice requirements imposed under this section.
68 5. (1) (a) In the event of a cybersecurity event involving nonpublic information
69 that is used by the licensee that is acting as an assuming insurer or in the possession,
70 custody, or control of a licensee that is acting as an assuming insurer and that does not
71 have a direct contractual relationship with the affected consumers, the assuming insurer
72 shall notify its affected ceding insurers and the commissioner or director of insurance
73 for its state of domicile within three business days of making the determination that a
74 cybersecurity event has occurred.
75 (b) The ceding insurers that have a direct contractual relationship with affected
76 consumers shall fulfill the consumer notification requirements imposed under section
77 407.1500 and any other notification requirements relating to a cybersecurity event
78 imposed under this section.
79 (c) Any licensee acting as assuming insurer shall have no other notice obligations
80 relating to a cybersecurity event or other data breach under this section or any other
81 law of the state.
82 (2) (a) In the event of a cybersecurity event involving nonpublic information
83 that is in the possession, custody, or control of a third-party service provider of a
84 licensee that is an assuming insurer, the assuming insurer shall notify its affected ceding
SS HCS HBs 974, 57, 1032 & 1141 11
85 insurers and the commissioner or director of insurance for its state of domicile within
86 three business days of receiving notice from its third-party service provider that a
87 cybersecurity event has occurred.
88 (b) The ceding insurers that have a direct contractual relationship with affected
89 consumers shall fulfill the consumer notification requirements imposed under section
90 407.1500 and any other notification requirements relating to a cybersecurity event
91 imposed under this section.
92 6. In the case of a cybersecurity event involving nonpublic information that is in
93 the possession, custody, or control of a licensee that is an insurer or its third-party
94 service provider for which a consumer accessed the insurer's services through an
95 independent insurance producer, and for which consumer notice is required by law,
96 including section 407.1500, the insurer shall notify the producers of record of all affected
97 consumers of the cybersecurity event no later than the time at which notice is provided
98 to the affected consumers. The insurer is excused from this obligation for those
99 instances in which it does not have the current producer of record information for any
100 individual consumer.
375.1412. 1. The director shall have power to examine and investigate the affairs
2 of any licensee to determine whether the licensee has been or is engaged in any conduct
3 in violation of sections 375.1400 to 375.1427. This power is in addition to the powers the
4 director has under the law. Any such investigation or examination shall be conducted
5 under section 374.190 or 374.205.
6 2. Whenever the director has reason to believe that a licensee has been or is
7 engaged in conduct in this state that violates sections 375.1400 to 375.1427, the director
8 may take action that is necessary or appropriate to enforce the provisions of sections
9 375.1400 to 375.1427.
375.1415. 1. Any documents, materials, or other information in the control or
2 possession of the department that are furnished by a licensee or an employee or agent
3 thereof acting on behalf of a licensee under subsection 9 of section 375.1405 or
4 subsection 2 of section 375.1410 or that is obtained by the director in an investigation or
5 examination under section 375.1412 shall be confidential by law and privileged, shall not
6 be subject to disclosure under chapter 610, shall not be subject to subpoena, and shall
7 not be subject to discovery or admissible in evidence in any private civil action.
8 However, the director is authorized to use the documents, materials, or other
9 information in the furtherance of any regulatory or legal action brought as a part of
10 the director's duties.
11 2. Neither the director nor any person or entity who received documents,
12 materials, or other information while acting under the authority of the director shall be
SS HCS HBs 974, 57, 1032 & 1141 12
13 permitted or required to testify in any private civil action concerning any confidential
14 documents, materials, or information subject to subsection 1 of this section.
15 3. Consistent with the insurance data security act's goal of safeguarding
16 consumer nonpublic information, the director or any person or entity who receives
17 documents, materials, or other information while acting under the authority of the
18 director under sections 375.1400 to 375.1427 may share such documents, materials, or
19 other information with another state or federal governmental agency or officer or the
20 National Association of Insurance Commissioners; provided that the recipient agrees in
21 writing to maintain the confidentiality of such documents, materials, or other
22 information, and has verified in writing the legal authority to maintain such
23 confidentiality. Except as permitted in this subsection, neither the director nor any
24 person or entity who receives documents, materials, or other information under sections
25 375.1400 to 375.1427 shall be permitted to:
26 (1) Share or otherwise release the documents, materials, or other information to
27 a third party;
28 (2) Share or otherwise release the documents, materials, or other information for
29 commercial use; or
30 (3) Sell cyber event or nonpublic information of any person or entity.
31 4. In order to assist in the performance of the director's duties under sections
32 375.1400 to 375.1427, the director:
33 (1) May receive documents, materials, or information, including otherwise
34 confidential and privileged documents, materials, or information, from the National
35 Association of Insurance Commissioners, its affiliates, or subsidiaries and from
36 regulatory and law enforcement officials of other foreign or domestic jurisdictions
37 and shall maintain as confidential or privileged any document, material, or information
38 received with notice or the understanding that it is confidential or privileged under the
39 laws of the jurisdiction that is the source of the document, material, or information; and
40 (2) May enter into agreements governing sharing and use of information
41 consistent with this subsection.
42 5. No waiver of any applicable privilege or claim of confidentiality in the
43 documents, materials, or information shall occur as a result of disclosure to the director
44 under this section or as a result of sharing as authorized in subsection 3 of this section.
45 6. Nothing in sections 375.1400 to 375.1427 shall prohibit the director from
46 releasing final adjudicated actions that are open to public inspection under chapter 610
47 to a database or other clearinghouse service maintained by the National Association of
48 Insurance Commissioners, its affiliates, or subsidiaries.
SS HCS HBs 974, 57, 1032 & 1141 13
375.1417. 1. The following exceptions shall apply to sections 375.1400 to
2 375.1427:
3 (1) A licensee with fewer than ten employees, including any independent
4 contractors, is exempt from the provisions of section 375.1405;
5 (2) A licensee subject to and governed by the privacy, security, and breach
6 notification rules issued by the United States Department of Health and Human
7 Services, 45 CFR 160 and 164, established under the Health Insurance Portability and
8 Accountability Act of 1996, Pub. L. 104-191, and the Health Information Technology for
9 Economic and Clinical Health Act (HITECH), Pub. L. 111-5, and that maintains
10 nonpublic information in the same manner as protected health information shall be
11 deemed to comply with the requirements of sections 375.1400 to 375.1427, except for the
12 director notification requirements in subsections 1 and 2 of section 375.1410;
13 (3) An employee, agent, representative, or designee of a licensee, who is also a
14 licensee, is exempt from section 375.1405 and need not develop its own information
15 security program to the extent that the employee, agent, representative, or designee is
16 covered by the information security program of the other licensee;
17 (4) Producers that have fewer than fifty employees; less than five million dollars
18 in gross annual revenue; or less than ten million dollars in year-end total assets; and
19 (5) A licensee affiliated with a depository institution that maintains an
20 information security program in compliance with the Interagency Guidelines
21 Establishing Standards for Safeguarding Customer Information (Interagency
22 Guidelines) as set forth under Sections 501 and 505 of the federal Gramm-Leach-
23 Bliley Act, Pub. L. 106-102, shall be considered to meet the requirements of section
24 375.1405 and any rules, regulations, or procedures established thereunder, provided
25 that the licensee produces, upon request, documentation satisfactory to the director that
26 independently validates the affiliated depository institution's adoption of an information
27 security program that satisfies the interagency guidelines.
28 2. In the event that a licensee ceases to qualify for an exception, such licensee
29 shall have one hundred eighty calendar days to comply with sections 375.1400 to
30 375.1427.
375.1420. In the case of a violation of sections 375.1400 to 375.1427, a licensee
2 may be subject to penalties as provided by law, including sections 374.046, 374.048, and
3 374.049.
375.1422. The director of the department of commerce and insurance may
2 promulgate rules as necessary for the implementation of sections 375.1400 to 375.1427.
3 Any rule or portion of a rule, as that term is defined in section 536.010, that is created
4 under the authority delegated in this section shall become effective only if it complies
SS HCS HBs 974, 57, 1032 & 1141 14
5 with and is subject to all of the provisions of chapter 536 and, if applicable, section
6 536.028. This section and chapter 536 are nonseverable and if any of the powers vested
7 with the general assembly under chapter 536 to review, to delay the effective date, or to
8 disapprove and annul a rule are subsequently held unconstitutional, then the grant of
9 rulemaking authority and any rule proposed or adopted after August 28, 2025, shall be
10 invalid and void.
375.1425. If any provision of sections 375.1400 to 375.1427 or the application
2 thereof to any person or circumstance is for any reason held to be invalid, the remainder
3 of sections 375.1400 to 375.1427 and the application of such provision to other persons
4 or circumstances shall not be affected thereby.
375.1427. Sections 375.1400 to 375.1427 shall take effect on January 1, 2026.
2 Licensees shall have until January 1, 2027, to implement section 375.1405 and until
3 January 1, 2028, to implement subsection 6 of section 375.1405.
379.1900. Sections 379.1900 to 379.1970 shall be known and may be cited as the
2 "Peer-to-Peer Car-Sharing Program Act".
379.1905. Nothing in sections 379.1900 to 379.1970 shall be construed to extend
2 beyond insurance or have any implications for sections other than sections 379.1900 to
3 379.1970 including, but not limited to, sections related to motor vehicle regulation,
4 airport regulation, or taxation. The provisions of sections 379.1900 to 379.1970 shall not
5 be construed to affect any other provision of law, and nothing in sections 379.1900 to
6 379.1970 shall be construed to distinguish or equate peer-to-peer car-sharing programs
7 and rental car companies except as otherwise provided in sections 379.1900 to 379.1970.
379.1910. For purposes of sections 379.1900 to 379.1970, except where otherwise
2 provided, the following terms mean:
3 (1) "Car-sharing delivery period", the period of time during which a shared
4 vehicle is being delivered to the location of the car-sharing start time, if applicable, as
5 documented by the governing car-sharing program agreement;
6 (2) "Car-sharing period", the period of time that commences with the car-
7 sharing delivery period or, if there is no car-sharing delivery period, that commences
8 with the car-sharing start time and in either case ends at the car-sharing termination
9 time;
10 (3) "Car-sharing program agreement", the terms and conditions applicable to a
11 shared vehicle owner and a shared vehicle driver that govern the use of a shared vehicle
12 through a peer-to-peer car-sharing program. The term "car-sharing program
13 agreement" shall not include a master rental agreement or a rental agreement, as
14 such terms are defined in section 407.730;
SS HCS HBs 974, 57, 1032 & 1141 15
15 (4) "Car-sharing start time", the time when the shared vehicle becomes subject
16 to the control of the shared vehicle driver at or after the time the reservation of a shared
17 vehicle is scheduled to begin as documented in the records of a peer–to–peer car-sharing
18 program;
19 (5) "Car-sharing termination time", the earliest of the following events:
20 (a) The expiration of the agreed-upon period of time established for the use of a
21 shared vehicle according to the terms of the car-sharing program agreement if the
22 shared vehicle is delivered to the location agreed upon in the car-sharing program
23 agreement;
24 (b) When the shared vehicle is returned to a location as alternatively agreed
25 upon by the shared vehicle owner and the shared vehicle driver as communicated
26 through a peer-to-peer car-sharing program, which alternatively agreed-upon location
27 shall be incorporated into the car-sharing program agreement; or
28 (c) When the shared vehicle owner or the shared vehicle owner's authorized
29 designee takes possession and control of the shared vehicle;
30 (6) "Peer-to-peer car sharing", the authorized use of a vehicle by an individual
31 other than the vehicle's owner through a peer-to-peer car-sharing program. The term
32 "peer-to-peer car sharing" shall not include a rental car or rental activity, as described
33 in section 407.732;
34 (7) "Peer-to-peer car-sharing program", a business platform that connects
35 vehicle owners with drivers to enable the sharing of vehicles for financial consideration.
36 The term "peer-to-peer car-sharing program" shall not include a car rental company, as
37 defined in section 407.730;
38 (8) "Shared vehicle", a vehicle that is available for sharing through a peer-to-
39 peer car-sharing program. The term "shared vehicle" shall not include a rental car, as
40 described in section 407.732;
41 (9) "Shared vehicle driver", an individual who has been authorized to drive the
42 shared vehicle by the shared vehicle owner under a car-sharing program agreement.
43 The term "shared vehicle driver" shall not include an authorized driver, as defined in
44 section 407.730;
45 (10) "Shared vehicle owner", the registered owner, or a person or entity
46 designated by the registered owner, of a vehicle made available for sharing to shared
47 vehicle drivers through a peer-to-peer car-sharing program. The term "shared vehicle
48 owner" shall not include a car rental company, as defined in section 407.730.
379.1915. 1. Except as provided in subsection 2 of this section, a peer-to-peer
2 car-sharing program shall assume liability of a shared vehicle owner for:
3 (1) Bodily injury or property damage to third parties;
SS HCS HBs 974, 57, 1032 & 1141 16
4 (2) Uninsured and underinsured motorist losses; or
5 (3) To the extent personal injury protection coverage is required by law,
6 personal injury protection losses;
7
8 during the car-sharing period in an amount stated in the peer-to-peer car-sharing
9 program agreement, which amount shall not be less than the amount required under
10 chapter 303.
11 2. Notwithstanding the definition of "car-sharing termination time" in section
12 379.1910, the assumption of liability under subsection 1 of this section shall not apply to
13 any shared vehicle owner when:
14 (1) A shared vehicle owner makes an intentional or fraudulent material
15 misrepresentation or omission to the peer-to-peer car-sharing program before the car-
16 sharing period in which the loss occurred; or
17 (2) Acting in concert with a shared vehicle driver who fails to return the shared
18 vehicle in accordance with the terms of the car-sharing program agreement.
19 3. Notwithstanding the definition of "car-sharing termination time" in section
20 379.1910, the assumption of liability under subsection 1 of this section shall apply to
21 bodily injury losses, property damage losses, uninsured and underinsured motorist
22 losses, or to the extent personal injury protection coverage is required by law, personal
23 injury protection losses, by damaged third parties as required by chapter 303.
24 4. A peer-to-peer car-sharing program shall ensure that, during each car-sharing
25 period, the shared vehicle owner and the shared vehicle driver are insured under a
26 motor vehicle liability insurance policy that provides insurance coverage in amounts no
27 less than the minimum amounts set forth in chapter 303, and that:
28 (1) Recognizes that the shared vehicle insured under the policy is made available
29 and used through a peer-to-peer car-sharing program; or
30 (2) Does not exclude use of a shared vehicle by a shared vehicle driver.
31 5. The insurance described under subsection 4 of this section may be satisfied by
32 motor vehicle liability insurance maintained by:
33 (1) A shared vehicle owner;
34 (2) A shared vehicle driver;
35 (3) A peer-to-peer car-sharing program; or
36 (4) A shared vehicle owner, a shared vehicle driver, and a peer-to-peer car-
37 sharing program.
38 6. The insurance described in subsection 5 of this section that is satisfying the
39 insurance requirement of subsection 4 of this section shall be primary during each car-
40 sharing period. If a claim occurs in another state with minimum financial responsibility
SS HCS HBs 974, 57, 1032 & 1141 17
41 limits higher than the minimum financial responsibility requirements in chapter 303
42 during the car-sharing period, the coverage maintained under subsection 5 of this
43 section shall satisfy the difference in minimum coverage amounts up to the applicable
44 policy limits.
45 7. The insurer, insurers, or peer-to-peer car-sharing program providing
46 coverage under subsection 4 or 5 of this section shall assume primary liability for a
47 claim when:
48 (1) A dispute exists as to who was in control of the shared vehicle at the time of
49 the loss and the peer-to-peer car-sharing program does not have available, did not
50 retain, or fails to provide the information required by section 379.1930; or
51 (2) A dispute exists as to whether the shared vehicle was returned to the
52 alternatively agreed-upon location as required under paragraph (b) of subdivision (5) of
53 section 379.1910.
54 8. If insurance maintained by a shared vehicle owner or shared vehicle driver in
55 accordance with subsection 5 of this section has lapsed or does not provide the required
56 coverage, insurance maintained by a peer-to-peer car-sharing program shall provide the
57 coverage required by subsection 4 of this section, beginning with the first dollar of a
58 claim, and have the duty to defend such claim except under circumstances as set forth in
59 subsection 2 of this section.
60 9. Coverage under an automobile insurance policy maintained by the peer-to-
61 peer car-sharing program shall not be dependent on another automobile insurer first
62 denying a claim nor shall another automobile insurance policy be required to first deny
63 a claim.
64 10. Nothing in this section:
65 (1) Limits the liability of the peer-to-peer car-sharing program for any act or
66 omission of the peer-to-peer car-sharing program itself that results in injury to any
67 person as a result of the use of a shared vehicle through a peer-to-peer car-sharing
68 program; or
69 (2) Limits the ability of the peer-to-peer car-sharing program to, by contract,
70 seek indemnification from the shared vehicle owner or the shared vehicle driver for
71 economic loss sustained by the peer-to-peer car-sharing program resulting from a
72 breach of the terms and conditions of the car-sharing program agreement.
379.1920. At the time when a vehicle owner registers as a shared vehicle owner
2 on a peer-to-peer car-sharing program and prior to the time when the shared vehicle
3 owner makes a shared vehicle available for car sharing on the peer-to-peer car-sharing
4 program, the peer-to-peer car-sharing program shall notify the shared vehicle owner
5 that, if the shared vehicle has a lien against it, the use of the shared vehicle through a
SS HCS HBs 974, 57, 1032 & 1141 18
6 peer-to-peer car-sharing program, including use without physical damage coverage,
7 may violate the terms of the contract with the lienholder.
379.1925. 1. An authorized insurer that writes motor vehicle liability insurance
2 in this state may exclude any and all coverage and the duty to defend or indemnify for
3 any claim afforded under a shared vehicle owner's motor vehicle liability insurance
4 policy including, but not limited to:
5 (1) Liability coverage for bodily injury and property damage;
6 (2) Personal injury protection coverage;
7 (3) Uninsured and underinsured motorist coverage;
8 (4) Medical payments coverage;
9 (5) Comprehensive physical damage coverage; and
10 (6) Collision physical damage coverage.
11 2. Nothing in sections 379.1900 to 379.1970 invalidates or limits an exclusion
12 contained in a motor vehicle liability insurance policy, including any insurance policy in
13 use or approved for use that excludes coverage for motor vehicles made available for
14 rent, sharing, or hire or for any business use.
15 3. Nothing in sections 379.1900 to 379.1970 invalidates, limits, or restricts an
16 insurer's ability under existing law to underwrite any insurance policy. Nothing in
17 sections 379.1900 to 379.1970 invalidates, limits, or restricts an insurer's ability under
18 existing law to cancel and nonrenew policies.
379.1930. A peer-to-peer car-sharing program shall collect and verify records
2 pertaining to the use of a vehicle including, but not limited to, times used, car-sharing
3 period pick-up and drop-off locations, fees paid by the shared vehicle driver, and
4 revenues received by the shared vehicle owner. The peer-to-peer car-sharing program
5 shall provide such information upon request to the shared vehicle owner, the shared
6 vehicle owner's insurer, or the shared vehicle driver's insurer to facilitate a claim
7 coverage investigation, settlement, negotiation, or litigation. The peer-to-peer car-
8 sharing program shall retain the records for a time period not less than the applicable
9 personal injury statute of limitations.
379.1935. A peer-to-peer car-sharing program and a shared vehicle owner shall
2 be exempt from vicarious liability, consistent with 49 U.S.C. Section 30106, under any
3 state or local law that imposes liability solely based on vehicle ownership.
379.1940. A motor vehicle insurer that defends or indemnifies a claim against a
2 shared vehicle that is excluded under the terms of its policy shall have the right to seek
3 recovery against the motor vehicle insurer of the peer-to-peer car-sharing program if
4 the claim is:
SS HCS HBs 974, 57, 1032 & 1141 19
5 (1) Made against the shared vehicle owner or the shared vehicle driver for loss
6 or injury that occurs during the car-sharing period; and
7 (2) Excluded under the terms of its policy.
379.1945. 1. Notwithstanding any other law, statute, rule, or regulation to the
2 contrary, a peer-to-peer car-sharing program shall have an insurable interest in a
3 shared vehicle during the car-sharing period.
4 2. Nothing in this section creates liability on a peer-to-peer car-sharing program
5 to maintain the coverage mandated by section 379.1915.
6 3. A peer–to–peer car-sharing program may own and maintain as the named
7 insured one or more policies of motor vehicle liability insurance that provides coverage
8 for:
9 (1) Liabilities assumed by the peer–to–peer car-sharing program under a peer–
10 to–peer car-sharing program agreement;
11 (2) Any liability of the shared vehicle owner;
12 (3) Damage or loss to the shared vehicle; or
13 (4) Any liability of the shared vehicle driver.
379.1950. Each car-sharing program agreement made in this state shall disclose
2 to the shared vehicle owner and the shared vehicle driver:
3 (1) Any right of the peer-to-peer car-sharing program to seek indemnification
4 from the shared vehicle owner or the shared vehicle driver for economic loss sustained
5 by the peer-to-peer car-sharing program resulting from a breach of the terms and
6 conditions of the car-sharing program agreement;
7 (2) That a motor vehicle liability insurance policy issued to the shared vehicle
8 owner for the shared vehicle or to the shared vehicle driver does not provide a defense
9 or indemnification for any claim asserted by the peer-to-peer car-sharing program;
10 (3) That the peer-to-peer car-sharing program's insurance coverage on the
11 shared vehicle owner and the shared vehicle driver is in effect only during each car-
12 sharing period and that, for any use of the shared vehicle by the shared vehicle driver
13 after the car-sharing termination time, the shared vehicle driver and the shared vehicle
14 owner may not have insurance coverage;
15 (4) The daily rate, fees, and if applicable, any insurance or protection package
16 costs that are charged to the shared vehicle owner or the shared vehicle driver;
17 (5) That the shared vehicle owner's motor vehicle liability insurance may not
18 provide coverage for a shared vehicle;
19 (6) An emergency telephone number to personnel capable of fielding roadside
20 assistance and other customer service inquiries; and
SS HCS HBs 974, 57, 1032 & 1141 20
21 (7) Whether there are conditions under which a shared vehicle driver is required
22 to maintain a personal automobile insurance policy with certain applicable coverage
23 limits on a primary basis in order to book a shared motor vehicle.
379.1955. 1. A peer-to-peer car-sharing program shall not enter into a peer-to-
2 peer car-sharing program agreement with a driver unless the driver who will operate
3 the shared vehicle:
4 (1) Holds a driver's license issued by this state that authorizes the driver to
5 operate vehicles of the class of the shared vehicle;
6 (2) Is a nonresident who:
7 (a) Has a driver's license issued by the state or country of the driver's residence
8 that authorizes the driver in that state or country to drive vehicles of the class of the
9 shared vehicle; and
10 (b) Is at least the same age as the age required of a resident to drive in this state;
11 or
12 (3) Otherwise is specifically authorized by this state to drive vehicles of the class
13 of the shared vehicle.
14 2. A peer-to-peer car-sharing program shall keep a record of:
15 (1) The name and address of the shared vehicle driver;
16 (2) The number of the driver's license of the shared vehicle driver and of each
17 other person, if any, who will operate the shared vehicle; and
18 (3) The place of issuance of the driver's license.
379.1960. A peer-to-peer car-sharing program shall have sole responsibility for
2 any equipment, such as a GPS system or other special equipment, that is put in or on the
3 vehicle to monitor or facilitate the car-sharing transaction and shall agree to indemnify
4 and hold harmless the shared vehicle owner for any damage to or theft of such
5 equipment during the car-sharing period not caused by the shared vehicle owner. The
6 peer-to-peer car-sharing program has the right to seek indemnity from the shared
7 vehicle driver for any loss or damage to such equipment that occurs during the car-
8 sharing period.
379.1965. 1. At the time when a vehicle owner registers as a shared vehicle
2 owner on a peer-to-peer car-sharing program and prior to the time when the shared
3 vehicle owner makes a shared vehicle available for car sharing on the peer-to-peer car-
4 sharing program, the peer-to-peer car-sharing program shall:
5 (1) Verify that the shared vehicle does not have any safety recalls on the vehicle
6 for which the repairs have not been made; and
7 (2) Notify the shared vehicle owner of the requirements under subsection 2 of
8 this section.
SS HCS HBs 974, 57, 1032 & 1141 21
9 2. (1) If the shared vehicle owner has received an actual notice of a safety recall
10 on the vehicle, the shared vehicle owner shall not make the vehicle available as a shared
11 vehicle on a peer-to-peer car-sharing program until the safety recall repair has been
12 made.
13 (2) If a shared vehicle owner receives an actual notice of a safety recall on a
14 shared vehicle while the shared vehicle is made available on the peer-to-peer car-sharing
15 program, the shared vehicle owner shall remove the shared vehicle as available on the
16 peer-to-peer car-sharing program as soon as practicable after receiving the notice of the
17 safety recall and until the safety recall repair has been made.
18 (3) If a shared vehicle owner receives an actual notice of a safety recall while the
19 shared vehicle is being used in the possession of a shared vehicle driver, as soon as
20 practicable after receiving the notice of the safety recall, the shared vehicle owner shall
21 notify the peer-to-peer car-sharing program about the safety recall so that the shared
22 vehicle owner may address the safety recall repair.
379.1970. The department of commerce and insurance may promulgate all
2 necessary rules and regulations for the administration of sections 379.1900 to 379.1970.
3 Any rule or portion of a rule, as that term is defined in section 536.010, that is created
4 under the authority delegated in this section shall become effective only if it complies
5 with and is subject to all of the provisions of chapter 536 and, if applicable, section
6 536.028. This section and chapter 536 are nonseverable and if any of the powers vested
7 with the general assembly pursuant to chapter 536 to review, to delay the effective date,
8 or to disapprove and annul a rule are subsequently held unconstitutional, then the grant
9 of rulemaking authority and any rule proposed or adopted after the effective date of this
10 section shall be invalid and void.
Section B. The enactment of sections 379.1900, 379.1905, 379.1910, 379.1915,
2 379.1920, 379.1925, 379.1930, 379.1935, 379.1940, 379.1945, 379.1950, 379.1955,
3 379.1960, 379.1965, and 379.1970 of this act shall become effective on January 1, 2026.
✔Every fact on this page links to its source, starting with the official bill record.