House Engrossed

 

cybersecurity risk; insurance

 

 

 

 

State of Arizona

House of Representatives

Fifty-fifth Legislature

Second Regular Session

2022

 

 

 

HOUSE BILL 2690

 

 

 

An Act

 

amending sections 41-621 and 41-622, Arizona Revised Statutes; relating to insurance.

 

 

(TEXT OF BILL BEGINS ON NEXT PAGE)

 


Be it enacted by the Legislature of the State of Arizona:

Section 1. Section 41-621, Arizona Revised Statutes, is amended to read:

START_STATUTE41-621. Purchase of insurance; coverage; limitations; exclusions; definitions

A. The department of administration shall obtain insurance against loss, to the extent it is determined necessary and in the best interests of this state as provided in subsection F of this section, on the following:

1. All state-owned buildings, including those of the universities, excluding buildings of community colleges, whether financed in whole or in part by state monies or buildings in which the state has an insurable interest as determined by the department of administration.

2. Contents in any buildings owned, leased or rented, in whole or in part, by or to this state, excluding buildings of community colleges, and reported to the department of administration.

3. This state and its departments, agencies, boards and commissions and all officers, agents and employees thereof and such others as may be necessary to accomplish the functions or business of the state and its departments, agencies, boards and commissions against liability for acts or omissions of any nature while acting in authorized governmental or proprietary capacities and in the course and scope of employment or authorization except as prescribed by this chapter.

4. All personal property reported to the department of administration, including vehicles and aircraft owned by the state and its departments, agencies, boards and commissions and all nonowned personal property that is under the clear responsibility of this state because of written leases or other written agreements.

5. This state and its departments, agencies, boards and commissions against casualty, use and occupancy and liability losses of every nature except as prescribed by this chapter.

6. Workers' compensation and employers' liability insurance.

7. Design and construction of buildings, roads, environmental remediations and other construction projects.

8. Other exposures to loss where insurance may be required to protect this state and its departments, agencies, boards and commissions and all officers, agents and employees acting in the course and scope of employment or authorization except as prescribed by this chapter.

9. actual or suspected data breaches, security system breaches or security incidents for select agencies, boards and commissions.

B. To the extent it is determined necessary and in the best interests of this state, the department of administration shall obtain insurance or provide for state self-insurance against property damage caused by clients and liability coverage resulting from the direct or incidental care of clients participating in programs of this state and its departments, agencies, boards or commissions relating to custodial care.  The insurable programs shall include foster care, programs for persons with developmental disabilities, an independent living program pursuant to section 8-521 and respite-sitter service programs. The department shall obtain insurance or provide for state self-insurance pursuant to this subsection to protect the clients participating in these programs and individual providers of these program services on behalf of this state and its departments, agencies, boards or commissions. The insurance provided under this subsection does not include medical or workers' compensation coverage for providers. The department may include in its annual budget request pursuant to section 41-622, subsection D a charge for the insurance or self-insurance provided in this subsection.  To assist in carrying out this subsection, the department shall establish a seven-member advisory board in accordance with the following provisions:

1. The board shall consist of three members appointed by the director of the department of administration, at least one of whom shall be a foster parent, one member appointed by the director of the department of economic security, one member appointed by the director of the department of child safety, one member appointed by the director of the state department of corrections, and one member appointed by the administrative director of the courts.

2. The board shall elect a chairman from among its members.

3. The board shall hold at least two meetings a year or shall meet at the call of the chairman.

4. Board members shall serve for three-year terms.

5. Board members are not eligible to receive compensation but are eligible for reimbursement of expenses pursuant to title 38, chapter 4, article 2.

6. The board shall provide advice to the department regarding coverage and administration of this subsection and shall assist the department in coordinating its activities pursuant to this subsection with state departments, agencies, boards and commissions.

C. The department of administration may obtain insurance against loss, to the extent it is determined necessary and in the best interests of this state as provided in subsection F of this section for the professional liability of individual physicians and psychiatrists who provide services under a contract with the state department of corrections.  Coverage is limited to acts and omissions committed inside a state department of corrections facility while in the performance of the contract and to individual physicians and psychiatrists who demonstrate to the satisfaction of the state department of corrections that they cannot otherwise obtain professional liability coverage for the services required by the contract. The director of the department of administration may impose on the state department of corrections a deductible for each loss that arises out of a professional liability claim pursuant to this subsection.  Any changes in deductible amounts established by the director shall be subject to review by the joint legislative budget committee.

D. The department of administration may obtain property, liability, disability or workers' compensation insurance, self-insure or develop risk retention pools to provide for payment of property loss or casualty claims or disability insurance claims against contractors of this state with the approval of the joint legislative budget committee. With respect to insurance, self-insurance or risk retention pools for contractors licensed and contracted to do work for this state, the coverage afforded applies with respect to the conduct of the business entity of that contractor.  The pool is available to all contractors regardless of the amount that the state-contracted work bears in relation to the amount of nonstate contracted work.  The contractor shall be terminated from the pool if the contractor ceases to be a state contractor.

E. The department of administration may determine, in the best interests of this state, that state self-insurance is necessary or desirable and, if that decision is made, shall provide for state self-insurance for losses arising out of state property, liability or workers' compensation claims or for losses arising out of actual or suspected data breaches, security system breaches or security incidents prescribed by subsection A of this section. If the department of administration provides state self-insurance, such coverage shall be excess over any other valid and collectible insurance. The director of the department of administration may impose on state departments, agencies, boards and commissions a deductible for each loss that arises out of a property, liability or workers' compensation loss claim, actual or suspected data breach, security system breach or security incident pursuant to this subsection. Any changes in deductible amounts established by the director shall be subject to review by the joint legislative budget committee.

F. In carrying out this chapter, the department of administration shall establish and provide the state with some or all of the necessary risk management services, or shall contract for risk management services pursuant to chapter 23 of this title, as the director of the department of administration deems necessary in the best interest of the state, and in addition to other specifications of such coverage as deemed necessary, may determine self-insurance to be established.  Chapter 23 of this title does not apply to the department of administration's procurement of insurance to cover losses arising out of state property or liability claims prescribed in subsections A and D of this section or excess loss insurance for the state's workers' compensation liability for individual or aggregate claims, or both, in such amounts and at such primary retention levels as the department of administration deems in the best interest of this state.  In purchasing insurance to cover losses arising out of state property or liability claims prescribed by subsection A of this section, the department of administration is not subject to title 20, chapter 2, article 5.

G. A successful bidder for risk management services pursuant to this section is not entitled to receive directly or indirectly any sales commission, contingent commission, excess profit commission, or other commissions, or anything of value, as payment for the risk management services except those amounts received directly from this state as payment for the risk management services.

H. The department of administration shall pay for purchased risk management services, premiums for insurance on state property and state liability and workers' compensation pursuant to this chapter.

I. A state officer, agent or employee acting in good faith, without wanton disregard of statutory duties and under the authority of an enactment that is subsequently declared to be unconstitutional, invalid or inapplicable, is not personally liable for an injury or damage caused thereby except to the extent that the officer, agent or employee would have been personally liable had the enactment been constitutional, valid and applicable.

J. A state officer, agent or employee, except as otherwise provided by statute, is not personally liable for an injury or damage resulting from an act or omission in a public official capacity where the act or omission was the result of the exercise of the discretion vested in the officer, agent or employee and if the exercise of the discretion was done in good faith without wanton disregard of statutory duties.

K. This state and its departments, agencies, boards and commissions are immune from liability for losses arising out of a judgment for wilful and wanton conduct resulting in punitive or exemplary damages.

L. The following exclusions shall apply to subsections A, B and E of this section:

1. Losses against this state and its departments, agencies, boards and commissions that arise out of and are directly attributable to an act or omission determined by a court to be a felony by a person who is provided coverage pursuant to this article unless the state knew of the person's propensity for that action, except those acts arising out of the operation or use of a motor vehicle.

2. Losses arising out of contractual breaches.

M. If self-insurance coverage is determined to exist, the attorney general, with funds provided by the department of administration, shall provide for the defense, either through the attorney general's office or by appointment of outside legal counsel, of this state and its departments, agencies, boards and commissions and all officers, agents and employees thereof and such others as are insured by the department of administration for or on account of their acts or omissions covered pursuant to this chapter. All state departments, agencies, boards and commissions, all officers, agents and employees thereof and such others as are insured by the department of administration shall cooperate fully with the attorney general and department of administration in the defense of claims arising pursuant to this chapter.

N. A claim for liability damages made pursuant to this chapter may be settled and payment made up to the amount of $25,000 or such higher limit as may be established by the joint legislative budget committee with the approval of the director of the department of administration.  A claim over the amount of $25,000 up to $50,000 or such higher limit as may be established by the joint legislative budget committee may be settled and payment made with the approval of the director of the department of administration and the attorney general. Any claim over the amount of $50,000 or such higher limit as may be established by the joint legislative budget committee may be settled and payment made with the approval of the director of the department of administration, the attorney general and the joint legislative budget committee. If it is in the best interest of this state, the joint legislative budget committee may establish higher settlement limits. Any settlements involving amounts in excess of $50,000 or such higher limit as may be established by the joint legislative budget committee shall be approved by the department of administration, the attorney general and the joint legislative budget committee pursuant to the authority granted.  The settlement of liability claims shall be solely the authority of the department of administration, the attorney general and the joint legislative budget committee.  No state department, agency, board or commission or any officer, agent or employee of this state may voluntarily make any payment, assume any obligation, incur any expense or maintain the individual right of consent for liability claims made pursuant to this chapter except as provided by this section.

O. Neither the authority provided by this section to insure, nor the exercise of such authority, shall:

1. Impose any liability on this state or the departments, agencies, boards and commissions or any officers, agents and employees of this state unless such liability otherwise exists.

2. Impair any defense this state or the departments, agencies, boards and commissions or any officers, agents and employees of this state otherwise may have.

P. The department of administration shall pay, on behalf of any state officer, agent or employee, any damages, excluding punitive damages, for which the officer, agent or employee becomes legally responsible if the acts or omissions resulting in liability were within the officer's, agent's or employee's course and scope of employment. The department of administration may pay for all damages however designated that the officer, agent or employee becomes legally responsible for if the acts or omissions resulting in liability are determined by the director of the department of administration to be within the person's course and scope of employment.

Q. The department of administration shall adopt such rules as are deemed necessary to carry out, implement and limit this chapter.

R. For the purposes of determining whether a state officer, agent or employee is entitled to coverage under this chapter, "within the course and scope of employment or authorization" means:

1. The acts or omissions that the state officer, agent or employee is employed or authorized to perform.

2. The acts or omissions of the state officer, agent or employee occur substantially within the authorized time and space limit.

3. The acts or omissions are activated at least in part by a purpose to serve this state or its departments, agencies, boards or commissions.

S. To the extent it is determined necessary and in the best interest of this state, the department of administration may obtain design and construction insurance or provide for self-insurance against property damage caused by this state, its departments, agencies, boards and commissions and all officers and employees of this state in connection with the construction of public works projects. Workers' compensation liability insurance may be purchased to cover both general contractors and subcontractors doing work on a specific contracted worksite. The department may include in its annual budget request, pursuant to section 41-622, subsection D, the cost of the insurance purchased or provided.  In connection with the construction of public works projects, the department of administration may also use an owner-controlled or wrap-up insurance program if all of the following conditions are met:

1. The total cost of the project is over $50,000,000.

2. The program maintains completed operations coverage for a term during which coverage is reasonably commercially available as determined by the director of the department of insurance and financial institutions, but in no event for less than three years.

3. Bid specifications clearly specify for all bidders the insurance coverage provided under the program and the minimum safety requirements that shall be met.

4. The program does not prohibit a contractor or subcontractor from purchasing any additional insurance coverage that a contractor believes is necessary for protection from any liability arising out of the contract.  The cost of the additional insurance shall not be passed through to this state on a contract bid.

5. The program does not include surety insurance.

T. The state may purchase an owner-controlled or wrap-up policy that has a deductible or self-insured retention as long as the deductible or self-insured retention does not exceed $1,000,000.

V. U. Notwithstanding any other statute the department of administration may:

1. Limit the liability of a person who contracts to provide goods, software or other services to this state.

2. Allow the person to disclaim incidental or consequential damages.

3. Indemnify or hold harmless any party to the contract.

U. V. For the purposes of subsections S and T of this section:

1. "Owner-controlled or wrap-up insurance" means a series of insurance policies issued to cover this state and all of the contractors, subcontractors, architects and engineers on a specified contracted worksite for purposes of general liability, property damage and workers' compensation.

2. "Specific contracted worksite" means construction being performed at one site or a series of contiguous sites separated only by a street, roadway, waterway or railroad right-of-way, or along a continuous system for the provision of water and power.

W. For the purposes of this section, "Breach", "Security system breach" and "security incident" have the same meanings prescribed in section 18-551. END_STATUTE

Sec. 2. Section 41-622, Arizona Revised Statutes, is amended to read:

START_STATUTE41-622. Risk management revolving fund; construction insurance fund; cyber risk insurance fund; self-insured losses and administrative costs; budget requests

A. The risk management revolving fund, and a the construction insurance fund and the cyber risk insurance fund are established in the department of administration for the purchase of insurance, risk management services including loss prevention services, payment of self-insured losses pursuant to section 41-621, subsections A, B, C, D and E and administrative costs necessary to carry out risk management services prescribed by section 41-621. The department of administration shall pay for claims processing costs, including adjusting costs, legal defense costs and attorney fees, for any portion of claims falling within state self-insurance coverage pursuant to the provisions of this chapter.

B. The risk management revolving fund in the department of administration shall exclude any property loss arising from damage due to mechanical or electrical breakdown, ordinary wear and tear or obsolescence, nonserviceability, mysterious disappearance or inventory shortage.  Mysterious disappearance shall does not be construed to include a loss if there is a reasonable presumption of theft.  The department of administration, subject to chapter 23 of this title, may advance or disburse monies to contractors who rebuild state property as a result of self-insured losses or to persons who supply goods or services in replacing self-insured losses. The department of administration shall pay for claims processing costs, including adjusting costs, legal defense costs and attorney fees, for any portion of claims falling within state self-insurance coverage pursuant to the provisions of this chapter.

C. To qualify for payment for loss by theft or burglary of state-owned personal property, an agency, department, board or commission must show evidence of forcible entry or that threat of violence was used in the taking of the property or there must be a reasonable presumption of theft.

D. The department of administration shall present to the legislature not later than September 1 of each year, in accordance with the provisions of section 35-113, a budget request based on the actuarial needs for liability losses, workers' compensation liability losses, property losses, replenishment of the cyber risk insurance fund and risk management administrative costs. The budget request shall be broken down to reflect the amount of monies to be charged to each of the state departments, agencies, boards and commissions and any others insured under this chapter. Any state department, agency, board or commission that has an amount for insurance included in its appropriation, whether specifically stated or not, and any state department, agency, board or commission or others insured under this chapter that receive funds other than those appropriated shall be billed for the proportionate share of the charges for insurance or self-insurance by the department of administration. In collecting the agency billings for risk management charges, the director of the department of administration may transfer the entire amount of the billing for appropriated insurance from the agency account into the fund designated in subsection A of this section at the start of the fiscal year or in periodic payments during the fiscal year if necessitated by cash flow restrictions. Those entities or persons insured under the provisions of this chapter that are not state agencies, departments, boards, commissions or employees or that do not receive funding from state sources shall pay annually the amount required by risk management to the risk management revolving fund or construction insurance fund before the coverage continues for existing claims or begins for new claims made. The construction insurance fund shall receive monies necessary to pay the cost of purchasing insurance, providing self-insurance or administering the fund as authorized by section 41-621, subsection S from each capital construction project budget at rates established by the department of administration and reviewed by the joint committee on capital review. These amounts shall be included in the budget request. All monies received from all billings shall be deposited in the funds as identified in subsection A of this section.

E. All monies recovered by the state pursuant to litigation, recovery, salvage value of damaged property, proportionate share monies from any other existing state funds, or otherwise, for damages relating to either a liability, property or workers' compensation loss for which monies from the risk management revolving fund or construction insurance fund have been or will be paid shall be deposited in the respective fund.

F. If a revolving fund is projected to be exhausted while the legislature is in session, a special appropriation may be requested by the department of administration for monies to meet the needs of the funds.  If the funds are exhausted at a time when the legislature is not in session, any final judgment shall accrue interest and shall be payable upon on appropriation in the next succeeding regular session of the legislature. Interest on any judgment against this state paid for out of the risk management revolving fund or the cyber risk insurance fund, regardless of whether the funds are self-insured or funded by excess insurance, shall accrue at the average yield offered by United States treasury bills during the course of the appeal and shall be paid in accordance with this section. If the appeal is lost by this state, the judgment amount plus interest at the rate prescribed in this subsection shall be paid.

G. All monies deposited in the risk management revolving fund are subject to annual legislative appropriation to the department of administration for use pursuant to this section. Monies in the construction insurance fund and the cyber risk insurance fund are continuously appropriated for the fund purposes. The funds established by subsection A of this section are exempt from the provisions of section 35-190 relating to lapsing of appropriations.

H. A ten thousand dollar $10,000 death benefit shall be paid from the risk management revolving fund to the estate of a deceased volunteer, who is registered as a volunteer by the agency, board or commission, or to an employee who is not subject to the provisions of section 38-651.02, upon on proof of death while in the course and scope of duties as prescribed in section 41-621, subsection P for any state agency, board or commission. END_STATUTE