Regulator Holder

Regulator Holder

Massachusetts Privacy Regulations Affect Companies in all 50 States

Background - State Privacy Regulations

State privacy regulations safeguarding personal information have been established by over forty states. One of the most recent states to establish privacy regulations and security breach notification requirements is Massachusetts. The Massachusetts Privacy Regulations are the most comprehensive state regulations, and they are likely to become the model for other states. The Massachusetts Privacy Regulations require businesses and other holders of personal information to ensure that consumers’ information is kept safe. The Regulations may affect how your business protects certain confidential personal information, even if you are not located in Massachusetts.

The impetus for the Massachusetts Privacy Regulations included over 450 reported cases of stolen or lost personal information that affected nearly 700,000 Massachusetts residents during 2007-08.

Businesses and other organizations should achieve compliance with at least the minimum requirements of the Massachusetts Privacy Regulations. Doing so will likely minimize future compliance efforts as states and the federal government strengthen their requirements for protecting personal information.

Massachusetts Privacy Regulations 201 CMR 17.00

The Massachusetts Privacy Regulations affect companies in all 50 states. The Regulations apply to all businesses and legal entities that collect or store confidential personal data regarding consumers and employees residing in Massachusetts. and to consumers with no physical presence in Massachusetts.

The Massachusetts Privacy Regulations preserve the privacy of consumers and employees by increasing the level of security on personal information held by businesses and other types of organizations. The Regulations mandate that personal information, including a combination of a name along with a Social Security number, bank account number, or credit card number be encrypted when stored on portable devices, or transmitted wirelessly or on public networks. Encryption of personal information on portable devices carrying identity data including laptops, PDAs and flash drives must also be implemented by Jan. 1, 2010, ensuring increased protection of personal information.

The majority of personal information security breaches involve the theft of portable devices. Data encryption significantly neutralizes consumer risk if information is lost or stolen. The regulations require businesses to encrypt documents containing personal information sent over the Internet or saved on laptops or flash drives, encrypt wirelessly transmitted data, and utilize up-to-date firewall protection that creates an electronic gatekeeper between the data and the outside world and only permits authorized users to access or transmit data.

The Massachusetts Privacy Regulations require businesses and other organizations to prepare and maintain an up to date Written Information Security Program (WISP) to achieve compliance with the Regulation and to prepare for compliance audits. Conducting a State Privacy Regulation Compliance Survey is a highly effective way to gather comprehensive information required for creating a WISP and achieving compliance with privacy regulations. Personal Information Privacy Compliance Surveys collect information from your company’s employees about their handling of employees’ and customers’ personal information.

State Privacy Regulation Compliance Surveys

State Privacy Regulation Surveys assess how companies and other types of organizations currently handle employee and consumer personal information as part of their effort to comply with state privacy regulations.

The Massachusetts Privacy Regulations Survey gathers comprehensive information that identifies what needs to be done to comply with the Massachusetts Privacy Regulations. The survey collects a wide range of information from employees located in Massachusetts and across the U.S.  Survey reports provide data about the handling of private customer and employee information for the organization overall and for each organizational unit.

Complying with the Massachusetts Privacy Regulations and other state personal information privacy regulations requires knowing which employees in your organization receive, handle, store (including on-site and 3rd party off-site storage), transmit and perform other processes with personal information in electronic and paper formats. Companies are also required to know the sources and where, how and how frequently personal information is received, handled, stored and transmitted. The Massachusetts Privacy Regulations also require having control over document/data retention/destruction schedules where personal information is included. You also need to know which automated and manual systems are used for storing and transmitting personal information.

State Privacy Regulation Surveys enable companies and other types of organizations to comply with federal and state privacy laws. The surveys help avoid costs and negative publicity associated with breaches in personal information privacy due to personal information theft and carelessness on the part of employees while handling personal information of customers and employees.

Massachusetts Privacy Regulations Compliance Deadlines

• The general compliance deadline for 201 CMR 17.00 was extended from January 1, 2009 to May 1, 2009.
• The deadline for ensuring that third-party service providers are capable of protecting personal information and contractually binding them to do so will was extended from January 1, 2009 to May 1, 2009, and the deadline for requiring written certification from third-party providers will be further extended to January 1, 2010.
• The deadline for ensuring encryption of laptops was extended from January 1, 2009 to May 1, 2009, and the deadline for ensuring encryption of other portable devices was extended to January 1, 2010.

< 201 CMR 17.00 – Answers to Frequently Asked Questions (FAQs)

1.  Your information security program must be in writing. Everyone who stores or maintains personal information must have a written plan detailing the measures adopted to safeguard such information.

2.  You are responsible for independent contractors working for you. You have the duty to take all reasonable steps (1) to verify that any third-party service provider with access to personal information has the capacity to protect personal information as provided for in 201 CMR 17.00; and (2) to ensure that third party service providers are applying to personal information protective security measures at least as stringent as those required to be applied to personal information under 201 CMR 17.00.

3.  You do not have to inventory your paper and electronic records. You do need to identify which of your records contain personal information so that you can handle and protect that information in a manner that complies with the regulations.

4.  You need to determine if your current computer system complies with the encryption requirements. You do need to make sure that the encryption process you are using is transforming the data so that it cannot be understood without the use of a confidential key or process.

5.  Both the statute and the regulations specify that compliance is to be judged taking into account the size and scope of your business, the resources that you have available to you, the amount of data you store, and the need for confidentiality.

6.  You will need to do enough training to ensure that employees with access to personal information know what their obligations are regarding the protection of that information as defined by the regulations.

7.  The Massachusetts regulations require limiting access to personal information only to those individuals who are reasonably required to have access in order to accomplish a legitimate business purpose, or to comply with other state of federal regulations. You should identify your business needs, determine what tasks are reasonably necessary to satisfy those business needs, and identify who must have access to carry out those tasks.

8.  The correct approach for limiting the amount of personal information collected involves determining your legitimate business needs, identifying the kind of personal information reasonably needed to perform the tasks required to satisfy those business needs. Collection of personal information needed for compliance with state or federal laws/regulations is permitted.

9.  Your need for new computer software or equipment will depend on whether your current equipment meets the minimum requirements for running the software that will secure any electronic records containing personal information. The versions of the security and operating system that you currently have must be supported to receive security updates, and your computer equipment must meet the minimum requirements for running the needed software. If not, you will need new software, new hardware, or both.

10.  The level of monitoring necessary to ensure your information security program is providing protection from unauthorized access to, or use of personal information, and effectively limiting risks will depend largely on the nature of your business, your business practices, and the amount of personal information you are maintaining or storing. It will also depend on the form in which the information is kept and stored. Information stored as a paper record will require different monitoring techniques from those applicable to electronically stored records. The monitoring that you implement must be reasonably likely to reveal unauthorized access or use.

11.  Businesses that store or maintain electronic records, and do not have in-house IT resources or regular access to providers of IT services, will need to hire someone to set up user identification protocols, secure access control measures, and firewalls, even if only on a one-time or part-time basis.

Massachusetts Privacy Regulation (201 CMR 17.00) Compliance Checklist

The State of Massachusetts Office of Consumer Affairs and Business Regulation compiled a checklist to help businesses in their effort to comply with 201 CMR 17.00.

Businesses should have a Written Information Security Program (WISP) to achieve compliance with the Regulations and to prepare for compliance audits. The following checklist is adapted from the Massachusetts Office of Consumer Affairs and Business Regulation’s checklist. Each item identifies an aspect of the regulations that requires attention for a plan to be compliant:

Comprehensive Written Information Security Program (WISP) Checklist:

1.  Your business/other type of organization should have a comprehensive, written information security program (“WISP”) applicable to all records containing personal information about a resident of the Commonwealth of Massachusetts.

2.  Include administrative, technical, and physical safeguards for personal information protection in your WISP.

3.  Designate one or more employees to maintain and supervise WISP implementation and performance.

4.  Identify paper, electronic and other records, computing systems, and storage media, including laptops and portable devices that contain personal information.

5.  An alternative is treat all of your records as if they all contain personal information.

6.  Identify and evaluate reasonably foreseeable internal and external risks to paper and electronic records containing personal information.

7.  Evaluate the effectiveness of current safeguards.

8.  The WISP should include ongoing employee training and procedures for monitoring employee compliance.

9.  Include disciplinary measures for violators of the WISP.

10.  Include policies and procedures for when and how records containing personal information should be kept, accessed or transported off your business premises in the WISP.

11.  Include immediately blocking terminated employees’ physical and electronic access to personal information records (including deactivating their passwords and user names) in the WISP.

12.  Take all reasonable steps to verify that third-party service providers with access to personal information have the capacity to protect personal information as provided for in 201 CMR 17.00.

13.  Take all reasonable steps to ensure that your third party service providers with access to personal information are applying personal information protective security measures at least as stringent as those required to be applied to personal information under 201 CMR 17.00.

14.  The amount of personal information that you have and continue to collect should be limited to the amount reasonably necessary to accomplish your legitimate business purposes, or to comply with state or federal regulations.

15.  The length of time that you are storing records containing personal information should be limited to the time reasonably necessary to accomplish your legitimate business purpose or to comply with state or federal regulations.

16.  Access to personal information records should be limited to employees/contractors who have a need to know in connection with your legitimate business purpose, or in order to comply with state or Federal regulations. Customers should only have access to their own personal information.

17.  Specify the manner in which physical access to personal information records is to be restricted in your WISP.

18.  Store records and data containing personal information in locked facilities, storage areas or containers.

19.  Implement a process for regularly monitoring the WISP to ensure that it is operating in a manner reasonably calculated to prevent unauthorized access to or unauthorized use of personal information; and for upgrading the WISP as necessary.

20.  Review security measures at least annually, or whenever there is a material change in business practices that may affect the security or integrity of personal information records. Conducting a Personal Information State Privacy Regulation Survey is an effective way to gather information for achieving initial and ongoing compliance with the Massachusetts and other state personal information privacy regulations.

21. Implement a process for documenting any actions taken in connection with any breach of security. The procedure should require post-incident review of events and actions taken to improve security.

Information about Massachusetts Privacy Regulations Surveys

http://www.quantisoft.com/Industries/Privacy.htm

Information about Quantisoft’s Surveys

http://www.quantisoft.com/Index.htm

About the Author

Howard Deutsch is CEO of Quantisoft, a full service survey company. Quantisoft conducted a comprehensive Personal Information Privacy Compliance Survey for a leading biotechnology company, enabling them to comply with the Massachusetts Privacy Regulations. Contact Howard at (609) 409-9945 or hdeutschatquantisoft.com.

Campbellhausfeld Mini Regulator MP514803AV $36.83 Regulator

Regulator $13.38 12v Regulator. Markings: M0507T09-1 Length: 42mm Width: 57mm Height: 20mm

Holder $1.2 Holder

Window Holder $19.95 Holds Door Glass While Working on Window Regulator. ? Works on all cars and trucks with a top door frame. ? Simply loop cable over door frame and attach suction cups to each side of glass. ? Window glass is then securely held above the door while work is performed. By Lisle.

Pigment Regulator $99.48 Pigment Regulator by Skin Ceuticals for Unisex - 1 oz Pigment Regulator

The Regulator $21.98 A COLLECTION OF STORIES BY THE MULTI TALENTED CORBEYRAN AND MORENO FROM THE PAGES OF HEAVY METAL MAGAZINE

Regulator Conversion Kit; Pressure Regulator $72.99 Regulator Conversion Kit; Pressure Regulator; Adjustable; Chevrolet TPI Pressure Regulator; 30-75 psi Range;

Fuel Pressure Regulator $105.99 Fuel Pressure Regulator; Adjustable Pressure Regulator; Multiport;

The Return Of The Regulator [Explicit] $4.99 The Return Of The Regulator [Explicit]

Terk TV Volume Regulator $24.99 TV Volume Regulator

Regulator A Light $39 Download the Regulator A Light font for Mac or Windows in OpenType, TrueType or PostScript format.

Regulator A Bold $39 Download the Regulator A Bold font for Mac or Windows in OpenType, TrueType or PostScript format.

Regulator BThin $39 Download the Regulator BThin font for Mac or Windows in OpenType, TrueType or PostScript format.

Regulator A Cameo $39 Download the Regulator A Cameo font for Mac or Windows in OpenType, TrueType or PostScript format.

Regulator A Volume $139 Download the Regulator A Volume font for Mac or Windows in OpenType, TrueType or PostScript format.

Medline Assembly, Regulator, For Suction Regulator. Each $50.1 Manufacturer: Medline. Each. Pictured with complete Vac-Assist aspirator system. Customers also search for: Discount Assembly, Regulator, For Suction Regulator, Buy Assembly, Regulator, For Suction Regulator, Wholesale Assembly, Regulator, For Suction Reg

Regulator Cover $23.99 Drag Specialties Regulator Cover Chrome replacement for drab OEM cover Fits over the existing regulator Chrome mounting hardware included

Campbell Hausfeld PA2123 Pressure Regulator $44.99 Pressure Regulator - PA2123

Morris IA174 Gauge for Air Regulator $31.2 Gauge for Air Regulator.

皮肤�用� Skin Ceuticals Pigment Regulator 30ml/1oz $599 Pigment Regulator

DPA105 Natural Gas Regulator $18 Broilmaster DPA105 Natural Gas Regulator Kit

ARB Barrel Regulator $34.99 ARB. Barrel Regulator. Adjustable. 50-145 PSI