Data Security Breach Notification Laws
Released: 2012-04-10T00:00:00

Data Breaches

A data breach occurs when there is a loss or theft of, or other unauthorized access to, data containing sensitive personal information that results in the potential compromise of the confidentiality or integrity of data.

The first state data security breach notification law was enacted in California in 2002. In response to state security breach notification laws enacted thereafter in numerous jurisdictions, over 2,676 data breaches and computer intrusions have been disclosed by the nation's largest data brokers, businesses, retailers, educational institutions, government and military agencies, healthcare providers, financial institutions, nonprofit organizations, utility companies, and Internet businesses.

A brief chronology of significant data breaches follows. In February 2005, the data broker ChoicePoint disclosed a security breach, as required by the California Security Breach Act, involving the personal information of 163,000 persons. In 2006, the personal data of 26.5 million veterans was breached when a VA employee's hard drive was stolen from his home. In 2007, the retailer TJX Companies revealed that 46.2 million credit and debit cards may have been compromised during the breach of its computer network by unauthorized individuals. In 2008, the Hannaford supermarket chain revealed that approximately 4 million debit and credit card numbers were compromised when Hannaford's computer systems were illegally accessed while the cards were being authorized for purchase. In 2009, 130 million records from credit card processor Heartland Payment Systems Inc. of Princeton, N.J., were breached. Also, in 2009, personal information from Health Net on almost half a million Connecticut residents and 1.5 million patients nationally was breached. In 2011, another breach of patient data occurred when data for 20,000 emergency room patients from Stanford Hospital in California was posted on a commercial website for nearly a year. In January 2012, New York State Electric & Gas and Rochester Gas and Electric, subsidiaries of Iberdrola USA, sent notices to customers advising them of unauthorized access to customer data on the companies' customer information systems, which contained Social Security numbers, dates of birth, and financial institution account numbers.

Data breaches are caused by computer hacking, malware, payment card fraud, employee insider breach, physical loss of non-electronic records and portable devices, and inadvertent exposure of confidential data on websites or in e-mail. Data breaches are expensive, time consuming, and can damage a company's reputation. U.S. companies are reportedly reticent about buying cyber liability insurance even though data breaches have cost companies millions of dollars. Data breaches involving sensitive personal information may also result in identity theft and financial crimes (e.g., credit card fraud, phone or utilities fraud, bank fraud, mortgage fraud, employment-related fraud, government documents or benefits fraud, loan fraud, and health-care fraud). Identity theft involves the misuse of any individually identifying information to commit a violation of federal or state law. With continued media reports of data security breaches, concerns about identity theft are widespread.

Cloud computing also poses particular data security challenges as illustrated by the 2011 Epsilon, Sony, and Amazon data breaches. E-mail marketing company Epsilon announced in April 2011 that its databases had been hacked, compromising customer names and e-mail addresses for companies that outsource their marketing communications to Epsilon. E-mails concerning the breach from companies including Citibank, Chase, Capital One, Walgreens, Target, Best Buy, TiVo, TD Ameritrade, Verizon, and Ritz Carlton were sent after Epsilon announced the data breach. About 2% of Epsilon's estimated 2,500 clients were affected by the attack, which amounted to millions of exposed records.

Sony announced that in April 2011 certain PlayStation Network and Qriocity service user account information was compromised in connection with an illegal and unauthorized intrusion into its network.

The Amazon Web Services cloud computing platform, Amazon Elastic Compute Cloud (Amazon EC2), suffered a partial failure when one of Amazon's giant server farms (the northern Virginia data center—"US-East"), whose storage and processing facilities it rents to other companies, suffered a lengthy outage. Customers whose information technology was hosted by Amazon EC2 were down. These included applications like Foursquare, Formspring, HootSuite, and Reddit, among others. In addition, the failure propagated across multiple "availability zones." It was also reported that Amazon permanently lost some customer data.

Litigation and enforcement actions arising from security breaches of personal information are becoming common. Lawsuits seeking class action status are proceeding against retailers, credit card issuers, payment processors, and banks. The Federal Trade Commission (FTC) has brought enforcement actions, along with states' attorneys general, for violations of consumer protection laws amounting to unfair practices. Consumers have sued complaining that merchants, banks, and payment processors were negligent in their failure to protect their personal information.

State Security Breach Notification Laws

The imposition of data security and security breach notification obligations on entities that own, possess, or license personal information is a recent phenomenon. California was the first jurisdiction to enact a data breach notification law in 2002, requiring notification when unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. There followed the emergence of numerous federal and state bills modeled after the California law imposing notification requirements on entities that own, license, or process personal information. Many states, however, included an element of harm as a trigger for notification rather than simply unauthorized acquisition. For example, under Alaska law "disclosure is not required if, after an appropriate investigation and after written notification to the attorney general of this state, the covered person determines that there is not a reasonable likelihood that harm to the consumers whose personal information has been acquired has resulted or will result from the breach."

The majority of states have enacted laws requiring notice of security breaches of personal data. As of January 2012, 46 states, the District of Columbia, Puerto Rico, and the Virgin Islands have enacted laws requiring notification of security breaches involving personal information. According to the National Conference of State Legislatures, in 2011 at least 14 states introduced legislation expanding the scope of laws, setting additional requirements related to notification, or changing penalties for those responsible for breaches. Several states have reportedly considered legislation to hold retailers liable for third-party companies' costs arising from data breaches.

The Massachusetts security breach and data destruction law and security regulations are considered to "constitute one of the most comprehensive sets of general security regulations yet seen at the state level.... [And] are clearly modeled after aspects of developing data security law at the federal level." Alabama, Kentucky, New Mexico, and South Dakota do not have security breach notification laws. In September 2012, when the amended Texas breach notification law goes into effect, breach notification obligations will exist in all states because Texas will then require entities doing business within the state to provide notification of data breaches to residents of states that have not enacted their own breach notification law. Thus, breach notification obligations will exist in all states because Texas's consumer notification obligations will apply not only to residents of Texas, but also to residents of states that don't have security breach notice requirements.

Variations in state security breach notification law have been described as "so numerous that it is virtually impossible to convert these state laws into the more manageable format of fifty-state surveys." Because states have different requirements, businesses engaged in interstate commerce are confronted with compliance challenges and cite the lack of uniformity as justification for a national security breach notification standard. State security breach notification laws have been criticized for creating "a fragmented, incoherent liability scheme."

The nature of any causal connection between security breaches and concrete harms suffered by consumers such as identity theft remains unclear. Because American consumers are not protected by a general right of information privacy, mere notice that a security breach has occurred is not associated with any right to compensation. Attempts to establish a right to damages following receipt of a security breach notice through class action lawsuits have generally only succeeded in clarifying the degree to which no such right exists, although many businesses suffering breaches have chosen on a voluntary basis to provide their customers with credit monitoring services to reduce the risk of harm from identity theft.

Proponents of state security breach notification laws believe that state laboratories can provide stronger protection for sensitive personal information.

Elements of Security Breach Notification Laws

State security breach notification laws generally follow a similar framework and can be categorized into several standard elements: (1) delineating who must comply with the law; (2) defining the terms "personal information" and "breach of security"; (3) establishing the elements of harm that must occur, if any, for notice to be triggered; (4) adopting requirements for notice; (5) creating exemptions and safe harbors; (6) clarifying preemption and relationships to other federal laws; and (7) creating penalties, enforcement authorities, and remedies.

State security breach notification laws vary regarding who is subject to the law—covered entities include businesses, state agencies, for profits, non-profits, information brokers, or persons conducting business within the state that own, license, or maintain the personal information of state residents. Twenty-nine states impose similar duties for the public and private sectors, 14 states do not, and Oklahoma's law applies only to the public sector. State security breach notification laws generally apply to electronic or computerized data.

Security breach notification laws typically include definitions for "personal information" or "personally identifiable information." In information privacy law, there is no uniform definition of "personally identifiable information." A common definition includes an individual's first name or initial and last name combined with SSN; driver's license or state ID number; account number, credit or debit card number, combined with any required information that allows access to account or any other financial information. A few states include medical information and/or health insurance information. Many states exclude from the definition of personal information any publicly available information that is lawfully made available to the general public from federal, state, or local government records. The term "sensitive personally identifiable information" is a subset of personally identifiable information (PII), the meaning of which also varies, but typically includes any information about an individual (including education, financial transactions, medical history, and criminal or employment history) along with information that can be used to distinguish or trace the individual's identity (including name, address, or telephone number; date and place of birth; mother's maiden name; Social Security number or other government-issued unique identification number; biometric data; or unique account identifiers).

The standard definition for "breach of security" is unauthorized acquisition of personal information that compromises the security, confidentiality, or integrity of personal information maintained by a covered entity.

In some states, the standard trigger for notice is the unauthorized access and acquisition of personal information. Some states require a risk of harm assessment to determine the level of harm or the risk of misuse involved. The results of the risk assessment determine whether notice is required.

State security breach notification laws describe who must provide notice (some require third-party service providers to notify the owner or licensor of the data when a breach occurs); recipients of notification (individuals, consumer reporting agencies for large scale breaches, state attorneys general); timing (following discovery or following unauthorized access, promptly, without unreasonable delay); methods (written, mail, email, substitute, mass media); content of notice; and delayed notification for law enforcement or national security purposes.

Many states provide a safe harbor for entities that are regulated under the Gramm-Leach-Bliley Act (GLBA) or the Health Insurance Portability and Accountability Act (HIPAA) and accompanying regulations and guidance. The safe harbor is generally available to entities that are in compliance with those laws, rules, regulations, or guidelines.

Forty-six states, the District of Columbia, Puerto Rico, and the Virgin Islands exempt encrypted information from notification requirements.

Thirteen states, the District of Columbia, and Puerto Rico permit an individual to bring a private right of action to recover damages and/or obtain equitable relief from businesses for injuries from the breach, for failure to notify customers of a security breach in a timely manner, or under state consumer protection statutes (e.g., unfair or deceptive practices). In some cases, prevailing plaintiffs are permitted to recover reasonable attorneys fees and court costs. Some permit the state attorney general to bring an action; other states only allow attorney general enforcement.

Penalties may be included for failure to promptly notify customers of a security breach. Penalties vary from imposition of a civil penalty of up to $500, but not to exceed $50,000 for each state resident who was not notified; a civil penalty not to exceed $10,000 per breach; assessment of appropriate penalties and damages; $1,000 per day per breach, then up to $50,000 for each 30-day period up to 180 days not to exceed $500,000; $2,500 per violation and for any actual damages; state attorney general actions under state consumer protection laws which permit the imposition of significant fines, injunctive relief, and attorneys' fees; and identity theft penalties.

Federal Information Security and Security Breach Notification Laws

The legal and regulatory framework for the protection of personally identifiable information is complex because businesses, governments, and individuals who process data must comply with the requirements of many differing privacy, information security, and breach notification laws. No single federal law or regulation governs the security of all types of sensitive personal information. Determining which federal law, regulation, and self-regulatory guidance is applicable depends in part on the entity or sector that collected the information, and the type of information collected and regulated. Under federal law, certain sectors are legally obligated to protect certain types of sensitive personal information. These obligations were created, in large part, when federal privacy and security legislation was enacted in the credit, financial services, health care, government, securities, and Internet sectors. Federal regulations were issued to implement information security programs and provide standards for security breach notice to affected persons.

For example, there are federal information security requirements applicable to all federal government agencies via the Federal Information Security Management Act (FISMA) and a federal information security and security breach notification law applicable to a sole federal department (Veterans Affairs). Federal departments and agencies are obligated by memorandum to provide breach notification, while the Department of Veterans Affairs is statutorily obligated to do so.

Other federal laws and regulations, such as the Health Insurance Portability and Accountability Act (HIPAA) and the Gramm-Leach-Bliley Act (GLBA), require private sector entities to maintain security safeguards to ensure the confidentiality, integrity, and availability of personal information, and require notification of security breaches. In the private sector, different laws apply to private sector entities engaged in different businesses (such as HIPAA, the Health Information Portability and Accountability Act, and GLBA, Gramm-Leach-Bliley Act, discussed hereinafter). This is what is commonly referred to as a sectoral approach to the protection of personal information. The Federal Trade Commission Act (the FTC Act) prohibits unfair and deceptive practices in and affecting commerce. The Payment Card Industry Data Security Standards (PCI-DSS) include information security requirements for organizations that handle bank cards.

Some critics say that current laws focus too closely on industry-specific uses of information rather than on protecting the privacy of individuals. Others believe the sectoral approach to the protection of personal information reflects not only variations in the types of information collected (e.g., government, private sector, health, financial, etc.), but also differences in the regulatory framework for particular sectors. Others advocate a national standard for entities that maintain personal information in order to harmonize legal obligations. Others distinguish between private data held by the government and private data held by others, and advocate a higher duty of care for governments with respect to sensitive personal information in the U.S. public sector and to data breaches.

This section describes information security and data breach notification requirements included in the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act, and the Health Information Technology for Economic and Clinical Health Act. Also discussed are implementing regulations, to the extent that they include data security and breach notification requirements, such as the FTC Safeguards Rule and the Information Security Interagency Guidance issued by the federal banking regulators. Because some of the federal security breach notification bills would also apply to federal agencies, we are including an overview of the Office of Management and Budget's "Breach Notification Policy" for federal agencies.

Office of Management and Budget "Breach Notification Policy" For Federal Agencies

In response to recommendations from the President's Identity Theft Task Force, the Office of Management and Budget issued guidance in May 2007 for federal agencies on "Safeguarding Against and Responding to the Breach of Personally Identifiable Information." The OMB Memorandum M-07-16 requires all federal agencies to implement a breach notification policy to safeguard "personally identifiable information" by August 22, 2007, to apply to both electronic systems and paper documents. To formulate their policy, agencies are directed to review existing privacy and security requirements, and include requirements for incident reporting and handling and external breach notification. In addition, agencies are required to develop policies concerning the responsibilities of individuals authorized to access personally identifiable information.

Attachment 1 of the OMB memorandum, Safeguarding Against the Breach of Personally Identifiable Information , reemphasizes agencies' responsibilities under existing law (e.g., the Privacy Act and FISMA), executive orders, regulations, and policy to safeguard personally identifiable information and train employees. New privacy and security requirements are established. Agencies are required to review holdings of all personally identifiable information to ensure that they are accurate, relevant, timely, and complete, and reduced to the minimum necessary amount. Agencies must also establish a plan to eliminate the unnecessary collection and use of Social Security numbers. Agencies must implement the following security requirements (applicable to all federal information): encrypt all data on mobile computers/devices carrying agency data; employ two-factor authentication for remote access; use a "time-out" function for remote access and mobile devices; log and verify all computer-readable data extracts from databases holding sensitive information; and ensure that individuals and supervisors with authorized access to personally identifiable information annually sign a document describing their responsibilities.

Attachment 2 of the OMB Memorandum, Incident Reporting and Handling Requirements , applies to the breach of personally identifiable information in electronic or paper format. Agencies are required to report all incidents involving personally identifiable information within one hour of discovery/detection, and publish a "routine use" under the Privacy Act applying to the disclosure of information to appropriate persons in the event of a data breach.

Attachment 3, External Breach Notification , identifies the factors agencies should consider in determining when notification outside the agency should be given and the nature of the notification. Notification may not be necessary for encrypted information. Each agency is directed to establish an agency response team. Agencies must assess the likely risk of harm caused by the breach and the level of risk. Agencies should provide notification without unreasonable delay following the detection of a breach, but are permitted to delay notification for law enforcement, national security purposes, or agency needs. Attachment 3 also includes specifics as to the content of the notice, criteria for determining the method of notification, and the types of notice that may be used.

Attachment 4, Rules and Consequences Policy , directs each agency to develop and implement a policy outlining rules of behavior and identifying consequences and corrective actions available for failure to follow these rules. Supervisors may be subject to disciplinary action for failure to take appropriate action upon discovering the breach or failure to take required steps to prevent a breach from occurring. Rules of behavior and corrective actions should address the failure to implement and maintain security controls for personally identifiable information; exceeding authorized access to, or disclosure to unauthorized persons of, personally identifiable information; failure to report any known or suspected loss of control or unauthorized disclosure of personally identifiable information; and for managers, failure to adequately instruct, train, or supervise employees in their responsibilities. Consequences may include reprimand, suspension, removal, or other actions in accordance with applicable law and agency policy.

Health Insurance Portability and Accountability Act

Part C of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) requires "the development of a health information system through the establishment of standards and requirements for the electronic transmission of health information." These "Administrative Simplification" provisions require the Secretary of Health and Human Services to adopt national standards to facilitate the electronic exchange of information; establish code sets for data elements; protect the privacy of individually identifiable health information; maintain administrative, technical, and physical safeguards for the security of health information; provide unique health identifiers; and to adopt procedures for the use of electronic signatures.

HIPAA covered entities—health plans, health care clearinghouses, and health care providers who transmit financial and administrative transactions electronically—are required to comply with the national standards and regulations. Under HIPAA, the Secretary is required to impose a civil monetary penalty on any person failing to comply with the national standards and regulations. The minimum civil money penalty (i.e., the fine) for a violation is $100 per violation and up to $25,000 for all violations of an identical requirement or prohibition during a calendar year. The maximum civil money penalty (i.e., the fine) for a violation is $50,000 per violation and up to $1,500,000 for all violations of an identical requirement or prohibition during a calendar year. HIPAA also establishes criminal penalties for any person who knowingly and in violation of the Administrative Simplification provisions of HIPAA uses a unique health identifier, or obtains or discloses individually identifiable health information. Enhanced criminal penalties may be imposed if the offense is committed under false pretenses, with intent to sell the information or reap other personal gain. The penalties include a fine of not more than $50,000 and/or imprisonment of not more than one year; if the offense is under false pretenses, a fine of not more than $100,000 and/or imprisonment of not more than five years; and if the offense is with intent to sell, transfer, or use individually identifiable health information for commercial advantage, personal gain, or malicious harm, a fine of not more than $250,000 and/or imprisonment of not more than 10 years. These penalties do not affect other penalties imposed by other federal programs.

HIPAA Privacy Rule

HIPAA required adoption of a national privacy standard for the protection of individually identifiable health information. HHS issued final Standards for Privacy of Individually Identifiable Health Information, known as the Privacy Rule, on April 14, 2003. The HIPAA Privacy Rule is applicable to health plans, health care clearinghouses, and health care providers who transmit financial and administrative transactions electronically. The rule regulates "protected health information" that is "individually identifiable health information" transmitted by or maintained in electronic, paper, or any other medium. The Privacy Rule requires covered entities to enter into agreements with business associates who create, receive, maintain, or transmit protected health information (PHI) on their behalf. The Office of Civil Rights (OCR) in HHS enforces the Privacy Rule.

The HIPAA Privacy Rule limits the circumstances under which an individual's protected health information may be used or disclosed by covered entities. A covered entity is permitted to use or disclose protected health information without patient authorization for treatment, payment, or health care operations. For other purposes, a covered entity may only use or disclose PHI with patient authorization subject to certain exceptions. Exceptions permit the use or disclosure of PHI without patient authorization or prior agreement for public health, judicial, law enforcement, and other specialized purposes. In certain situations that would otherwise require authorization, a covered entity may use or disclose PHI without authorization provided that the individual is given the prior opportunity to object or agree. The HIPAA Privacy Rule also requires a covered entity to maintain reasonable and appropriate administrative, technical, and physical safeguards to protect the privacy of protected health information.

HIPAA Security Rule

HIPAA also required adoption of a national security standard for the protection of individually identifiable health information. HHS issued the HIPAA Security Rule in 2003. The Security Rule applies only to protected health information in electronic form (EPHI), and requires a covered entity to ensure the confidentiality, integrity, and availability of all EPHI the covered entity creates, receives, maintains, or transmits. Covered entities must protect against any reasonably anticipated threats or hazards to the security or integrity of such information and any reasonably anticipated uses or disclosures of such information that are not permitted or required under the Privacy Rule and ensure compliance by their workforces. The Security Rule requires covered entities to enter into agreements with business associates who create, receive, maintain, or transmit EPHI on their behalf. A covered entity is not liable for violations by the business associate unless the covered entity knew that the business associate was engaged in a practice or pattern of activity that violated HIPAA, and the covered entity failed to take corrective action. The Centers for Medicare and Medicaid Services (CMS) has been delegated authority to enforce the HIPAA Security Rule.

The Security Rule allows covered entities to consider such factors as the cost of a particular security measure, the size of the covered entity involved, the complexity of the approach, the technical infrastructure and other security capabilities in place, and the nature and scope of potential security risks. The Security Rule establishes "standards" that covered entities must meet, accompanied by implementation specifications for each standard. The Security Rule identifies three categories of standards: administrative, physical, and technical.

Health Information Technology for Economic and Clinical Health Act (HITECH Act)

The Health Information Technology for Economic and Clinical Health Act (HITECH Act) was enacted as part of the American Recovery and Reinvestment Act of 2009 (ARRA). As part of this new law, sweeping changes to the health information privacy regime were enacted. Most of the privacy provisions are additional requirements supplementing the HIPAA Privacy and Security Rules, but a few provisions deal specifically with electronic health records (EHRs). The HITECH Act extended application of some provisions of the HIPAA Privacy and Security Rules to the business associates of HIPAA-covered entities, making those business associates subject to civil and criminal liability; established new limits on the use of protected health information for marketing and fundraising purposes; provided new enforcement authority for state attorneys general to bring suit in federal district court to enforce HIPAA violations; increased civil and criminal penalties for HIPAA violations; required covered entities and business associates to notify the public and HHS of data breaches; changed certain use and disclosure rules for protected health information; and created additional individual rights.

Business Associates' Civil and Criminal Liability

The HITECH Act provides that covered entities' business associates that obtain or create PHI pursuant to a business associate agreement may only use or disclose that PHI in compliance with its terms. The HITECH Act also requires existing business associate agreements to incorporate the new privacy provisions.

Prior to the HITECH Act, covered entities have been liable for violations of the Privacy Rule that were committed by their business associates, but only if the covered entity had knowledge of "a pattern of activity or practice" of the business associate that violates the Privacy Rule. Under the HITECH Act, business associates are also made liable for violations of the Privacy Rule committed by the covered entities with which they contract, if the business associates are aware of a pattern and practice of unlawful conduct by the covered entity. While business associates are still not defined as covered entities under HIPAA, they are subject to the same civil and criminal penalties for improper uses or disclosures of PHI.

The HITECH Act also extended application of the HIPAA Security Rule's provisions on security safeguards and documentation to business associates of covered entities, making those business associates subject to civil and criminal liability for violations of the HIPAA Security Rule. Under the HIPAA Security Rule, only covered entities can be held civilly or criminally liable for violations. While business associates are still not considered covered entities under HIPAA, they are subject to the same civil and criminal penalties as a covered entity for Security Rule violations. The HITECH Act also requires existing business associate agreements to incorporate the new security requirements.

Unsecured Protected Health Information

The HITECH Act required the HHS Secretary to issue guidance specifying the technologies and methodologies to render protected health information unusable, unreadable, or indecipherable to unauthorized individuals. The HITECH Act also provides a definition.

Guidance on the meaning of "unsecured protected health information" was issued by HHS that became effective upon issuance. It identified two methods for rendering PHI unusable, unreadable, or indecipherable: encryption and destruction (paper and electronic form). Pursuant to this guidance, "if PHI is rendered unusable, unreadable, or indecipherable to unauthorized individuals by one or more of the methods identified in this guidance, then such information is not 'unsecured' PHI." Because the HITECH Act's breach notification requirements apply only to breaches of unsecured PHI, this guidance provides the means by which covered entities and their business associates can determine whether a breach has occurred and whether notification obligations apply.

Breach Notification

The Health Information Technology for Economic and Clinical Health Act (HITECH Act) imposed breach notification requirements on covered entities, their business associates, and vendors of personal health records (PHRs). The HITECH Act requires covered entities, business associates, and vendors of PHRs to notify affected individuals in the event of a "breach" of "unsecured protected health information." A "breach" is defined as the "unauthorized acquisition, access, use, or disclosure of protected health information which compromises the security or privacy of such information, except where an unauthorized person to whom such information is disclosed would not reasonably have been able to retain such information." A vendor of PHR is defined as "an entity, other than a covered entity ... that offers or maintains a personal health record." The term "unsecured protected health information" means "protected health information that is not secured through the use of a technology or methodology specified by the Secretary in guidance."

In August 2009, the Department of Health and Human Services (HHS) issued an interim final breach notification regulation. The Breach Notification Interim Final Regulation addresses notification to individuals, the media, and the Secretary, by a business associate; law enforcement delay; and administrative requirements and burdens of proof.

The HITECH Act also directed the Federal Trade Commission (FTC) to issue breach notification regulations for web-based businesses to notify consumers when the security of their electronic health information is breached. The FTC rule applies to both vendors of personal health records—which provide online repositories that people can use to keep track of their health information—and entities that offer third-party applications for personal health records. It applies to breaches by vendors of PHRs, PHR-related entities, and third-party service providers that maintain information on U.S. citizens or residents. The rule contains provisions discussing timeliness, methods of notification, content, and enforcement of the breach notification requirements.

Notice of Unauthorized Disclosure of Protected Health Information

The HITECH Act requires a covered entity to notify affected individuals when it discovers that their unsecured PHI has been, or is reasonably believed to have been, breached. This requirement applies to covered entities that access, maintain, retain, modify, record, store, destroy, or otherwise hold, use, or disclose unsecured protected health information. The scope of notification is dependant upon the number of individuals whose unsecured PHI was compromised. Generally, only written notice need be provided if less than 500 individuals are involved. For larger breaches, notice through prominent media outlets may be required. In all cases, the Secretary of HHS must be notified, although breaches involving less than 500 people may be reported on an annual basis. The Secretary of HHS is directed to display on the department's website a list of covered entities with breaches involving more than 500 individuals.

Generally, notice must be given without unreasonable delay, but no later than 60 days after the breach is discovered. If a delay is not reasonable, a covered entity may still have violated this provision even if notice was given within 60 days. In an enforcement action of this provision, the covered entity has the burden of proving that any delay was reasonable. Delayed notification is permitted for law enforcement purposes if a law enforcement official determines that notice would impede a criminal investigation or cause damage to national security.

To the extent possible, notification of a breach must include a description of what occurred; the types of information involved in the breach; steps individuals should take in response to the breach; what the covered entity is doing to investigate, mitigate, and protect against further harm; and contact information to obtain additional information.

Annually, the Secretary is required to submit a report to Congress containing information on the number and nature of breaches for which notice was provided and actions taken in response to such breaches.

Notice of Unauthorized Disclosure of Personal Health Records

The HITECH Act includes a breach notification requirement for PHR vendors (such as Google Health or Microsoft Vault), service providers to PHR vendors, and PHR servicers that are not covered entities or business associates that sunsets "if Congress enacts new legislation." Under this breach notification requirement, these entities are required to notify citizens and residents of the United States whose unsecured "PHR identifiable health information" has been, or is believed to have been, breached. PHR vendors, service providers to PHR vendors, and PHR servicers are also required to notify the Federal Trade Commission (FTC).

The HITECH Act defines several terms specific to the PHR breach notification requirement. A "breach of security" is defined as the unauthorized acquisition of an individual's PHR identifiable health information. PHR identifiable health information is defined as individually identifiable health information, and includes information provided by or on behalf of the individual, and information that can reasonably be used to identify the individual.

The requirements regarding the scope, timing, and content of these notifications are identical to the requirements applicable to breaches of unsecured PHI. Violations of these requirements shall be considered unfair and deceptive trade practices in violation of the Federal Trade Commission Act.

Gramm-Leach-Bliley Act (GLBA)

Title V of the Gramm-Leach-Bliley Act of 1999 (GLBA) requires financial institutions to provide customers with notice of their privacy policies and requires financial institutions to safeguard the security and confidentiality of customer information, to protect against any anticipated threats or hazards to the security or integrity of such records, and to protect against unauthorized access to or use of such records or information which could result in substantial harm or inconvenience to any customer. Financial institutions are defined as businesses that are engaged in certain "financial activities" described in Section 4(k) of the Bank Holding Company Act of 1956 and accompanying regulations. Such activities include traditional banking, lending, and insurance functions, along with other financial activities. Financial institutions are prohibited from disclosing "nonpublic personal information" to non-affiliated third parties without providing customers with a notice of privacy practices and an opportunity to opt out of the disclosure. A number of statutory exceptions are provided to this disclosure rule, including that financial institutions are permitted to disclose nonpublic personal information to a non-affiliated third party to perform services for or functions on behalf of the financial institution.

GLBA Privacy Rule

Regulations implementing GLBA's privacy requirements published by the federal banking regulators govern the treatment of nonpublic personal information about consumers by financial institutions; require a financial institution in specified circumstances to provide notice to customers about its privacy policies and practices; describe the conditions under which a financial institution may disclose nonpublic personal information about consumers to nonaffiliated third parties; and provide a method for consumers to prevent a financial institution from disclosing that information to most nonaffiliated third parties by "opting out" of that disclosure, subject to exceptions.

FTC Safeguards Rule

This rule implements GLBA's requirements for entities under FTC jurisdiction. The Safeguards Rule applies to all businesses, regardless of size, that are "significantly engaged" in providing financial products or services. These include, for example, check-cashing businesses, payday lenders, mortgage brokers, nonbank lenders, real estate appraisers, and professional tax preparers. The Safeguards Rule also applies to companies like credit reporting agencies and ATM operators that receive information about the customers of other financial institutions. The rule requires financial institutions to have an information security plan that "contains administrative, technical, and physical safeguards" to "insure the security and confidentiality of customer information: protect against any anticipated threats or hazards to the security or integrity of such information; and protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer." Using its authority under the Safeguards Rule, the commission has brought a number of enforcement actions to address the failure to provide reasonable and appropriate security to protect consumer information.

GLBA Information Security Guidelines

Section 501(b) of GLBA requires the banking agencies to establish standards for financial institutions relating to administrative, technical, and physical safeguards to ensure the security, confidentiality, and integrity of customer information; protect against any anticipated threats or hazards to the security or integrity of such information; and protect against unauthorized access to or use of such information that could result in substantial harm or inconvenience to any customer.

Interagency Guidance issued by the federal banking regulators applies to customer information, which is defined as "any record containing nonpublic personal information ... about a customer, whether in paper, electronic, or other form, that is maintained by or on behalf of" a financial institution. The security guidelines direct each financial institution to assess the risks of reasonably foreseeable threats that could result in unauthorized disclosure, misuse, alteration, or destruction of customer information and customer information systems; the likelihood and potential damage of threats; and the sufficiency of policies, procedures, customer information systems, and other controls. Following the assessment of risks, the security guidelines require a financial institution to manage and control the risk through the design of a program to address the identified risks; train staff to implement the program; regularly test the key controls, systems, and procedures of the information security program; and develop and maintain appropriate measures to dispose of customer information. The security guidelines also direct every financial institution to require its service providers by contract to implement appropriate measures designed to protect against unauthorized access to or use of customer information that could result in substantial harm or inconvenience to any customer. Each financial institution is required to monitor, evaluate, and adjust its information security program as necessary. Finally, each financial institution is required to report to its board at least annually on its information security program, compliance with the security guidelines, and issues such as risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations and management's responses, and recommendations for changes in the information security program.

Response Programs for Unauthorized Access to Customer Information and Customer Notice

The security guidelines recommend implementation of a risk-based response program, including customer notification procedures, to address unauthorized access to or use of customer information maintained by a financial institution or its service provider that could result in substantial harm or inconvenience to any customer, and require disclosure of a data security breach if the covered entity concludes that "misuse of its information about a customer has occurred or is reasonably possible." Pursuant to the guidance, substantial harm or inconvenience is most likely to result from improper access to "sensitive customer information."

At a minimum, an institution's response program should contain procedures for assessing the nature and scope of an incident and identifying what customer information systems and types of customer information have been accessed or misused; notifying its primary federal regulator when the institution becomes aware of an incident involving unauthorized access to or use of sensitive customer information; consistent with the Agency's Suspicious Activity Report ("SAR") regulations, notifying appropriate law enforcement authorities; taking appropriate steps to contain and control the incident to prevent further unauthorized access to or use of customer information (e.g., by monitoring, freezing, or closing affected accounts and preserving records and other evidence); and notifying customers when warranted.

The security guidelines note that financial institutions have an affirmative duty to protect their customers' information against unauthorized access or use, and that customer notification of a security breach involving the customer's's information is a key part of that duty. The guidelines prohibit institutions from forgoing or delaying customer notification because of embarrassment or inconvenience.

The guidelines provide that when a financial institution becomes aware of an incident of unauthorized access to sensitive customer information, the institution should conduct a reasonable investigation to promptly determine the likelihood that the information has been or will be misused. If the institution determines that misuse has occurred or is reasonably possible, it should notify the affected customer as soon as possible. Customer notice may be delayed if an appropriate law enforcement agency determines that notification will interfere with a criminal investigation and provides the institution with a written request for the delay. The institution should notify its customers as soon as notification will no longer interfere with the investigation.

If a financial institution can determine which customers' information has been improperly accessed, it may limit notification to those customers whose information it determines has been misused or is reasonably likely to be misused. In situations where the institution determines that a group of files has been accessed improperly, but is unable to identify which specific customers' information has been accessed, and the institution determines that misuse of the information is reasonably possible, it should notify all customers in the group. The guidelines also address what information should be included in the notice sent to the financial institution's customers.