§431:3B-104 Exceptions. (a) The following exceptions shall apply to this article: (1) A licensee with fewer than ten employees, including any independent contractors, shall be exempt from part II; (2) A licensee subject to the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, that has established and maintains an information security program pursuant to the statutes, rules, regulations, procedures, or guidelines established thereunder shall be considered to have met the requirements of part II of this article; provided that the licensee is compliant with and submits a written statement certifying its compliance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191; and (3) An employee, agent, representative, or designee of a licensee, who is also a licensee, shall be exempt from part II of this article and shall not be required to develop its own information security program; provided that the employee, agent, representative, or designee is covered by the information security program of the other licensee. (b) In the event that a licensee ceases to qualify for an exception pursuant to this section, the licensee sentative, or designee is covered by the information security program of the other licensee. (b) In the event that a licensee ceases to qualify for an exception pursuant to this section, the licensee shall have one hundred eighty days to comply with this article. [L 2021, c 112, pt of §2]
Hawaii Legal Code