All 50 states now have their own data privacy and breach notification requirements, as laws in Alabama and South Dakota—the only two states that had been without such statutes—took effect in recent months. These new laws add to notification procedures for health care entities that suffer a data breach, and—in some cases—to compliance tasks such as security plans and risk assessments.
In addition, at least three other states—including Colorado, Louisiana and Vermont—tightened their data breach notification laws this spring, broadening the definition of personally identifiable information and shortening notification time frames.
These beefed-up laws are filling gaps left by federal lawmakers on data breach notification and data privacy, says Calvin Cohen, an associate in the Government Contracts and Data Privacy and Cyber Security practice groups at Covington & Burling LLP in Washington, D.C.
“Although certain sector-specific federal laws, such as the [Gramm-Leach-Bliley Act] and HIPAA, do impose breach notification requirements on specific categories of entities, no overarching federal data breach notification law exists,” Cohen tells RPP. Generally, Gramm-Leach-Bliley applies to banks, securities firms and insurance companies.
“In the absence of such a law, state lawmakers have gradually taken steps over the last 10 to 15 years to implement generally applicable state data breach notification laws. More recently, a number of states have updated their laws to broaden the scope of personally identifiable information [PII] covered under these laws and implement [stricter] notification requirements,” he says.
This spring, six states enacted new data breach notification laws or made changes to existing laws that in most cases significantly tighten the requirements:
◆ South Dakota lawmakers in March approved legislation that creates a 60-day notification requirement for any person or business owning or retaining personal information of state residents. The new law requires notification after “personal or protected information was, or is reasonably believed to have been, acquired by an unauthorized person,” and mandates notification to the state attorney general if the breach involves more than 250 people. It allows for civil penalties of up to $10,000 per day, per violation.
◆ Alabama’s new law, also approved in March, requires written notification to affected individuals within 45 calendar days. The state attorney general and consumer reporting agencies must be notified if more than 1,000 Alabama residents are involved in the breach. The Alabama law includes a provision that requires proper disposal of personally identifying information when records are no longer needed to be retained.
