INSURANCE DATA SECURITY ACT – Adds to existing law to establish the Insurance Data Security Act in the event of cybersecurity attacks.

Idaho's H 117, the Insurance Data Security Act, requires all insurance companies licensed to operate in Idaho (licensees) to establish and maintain written security programs to protect customer data. The bill mandates that insurers create incident response plans for cybersecurity events (like data breaches), provide timely notice to affected customers and regulators, and implement safeguards for sensitive information such as Social Security numbers, health records, and financial data. It explicitly prohibits private lawsuits for violations and sets state-level standards that override local or federal rules. The law applies directly to Idaho-based insurers and their third-party service providers handling customer data.