Data Security Breach Bill Calls for Strict Notification Requirements
A data breach bill filed August 5 requires entities that hold consumers' sensitive information to create a robust data compliance protection plan and holds them to strict breach notification requirements.
U.S. Senators Mark Pryor (D-AR) and Jay Rockefeller (D-WV) filed the "Data Security and Breach Notification Act of 2010," which would be regulated by the Federal Trade Commission (FTC).
According to the language in the bill, healthcare entities and their business associates (BAs) would be in the clear so long as they complied with the Health Information Technology for Economic and Clinical Health (HITECH)Act or any other federal laws that satisfy similar or stronger requirements.
It is unclear, however, if compliance with the FTC's Red Flags Rule for identity theft protections would exempt entities from the requirements in the new bill.
E-mails to each Senator's office were not immediately returned.
No matter to whom the bill applies, healthcare entities should watch the bill's progress in light of new privacy and security laws in HITECH that call for greater patient rights to protected health information (PHI) and greater penalties for breaches of unsecured PHI.
The bill extends civil action power to state attorneys general, much like HITECH does. It includes a maximum of $11,000 per day for each day an entity is found not to be in compliance and caps a single violation at:
- $5 million for each violation of the security and compliance requirements
- $5 million for all violations of the breach notification requirements
- CFO Exchange: Smartphones Poised to Disrupt Healthcare, Says Topol
- Consumerism Drives Healthcare Branding, Rebranding Efforts
- PA Ranks See 'Phenomenal Growth,' Lack of Diversity
- 3 Traits Personality Assessments Can't Reveal
- CNO on Hospital Redesign: 'You Can't Over-Communicate'
- How Digital Strategy Shapes Patient Engagement at Boston Children's Hospital
- Antibiotic Overuse a 'Huge Threat' to Patient Safety, Says CDC
- CHS Hacked, 4.5M Patient Records Compromised
- Carondelet to Pay $35M to Settle Fraud Allegations
- Half of All Primary Care, Internal Medicine Jobs Unfilled in 2013