Data Security Breach Bill Calls for Strict Notification Requirements
Such security and compliance requirements include:
- Security policy with respect to the collection, use, sale, other dissemination, and maintenance of such personal information
- Identification of an officer or other individual as the point of contact with responsibility for the management of information security
- Process for identifying and assessing any reasonably foreseeable vulnerabilities and regular monitoring for a breach of security
- Process for taking preventive and corrective action to mitigate against any vulnerabilities
- Process for disposing of data in electronic form containing personal information by shredding, permanently erasing, or otherwise modifying the personal information to make permanently unreadable or indecipherable
The bill's breach notification requirements include:
Nationwide notification. Following the discovery of a breach of security, the covered entity must:
- Notify each individual who is a citizen or resident of the United States whose personal information was acquired or accessed as a result of such a breach of security
- Notify the FTC
Third-party/service provider notification requirements. Much like a BA of a healthcare covered entity, a third-party or service provider handling sensitive information must notify the covered entity of the breach of security.
Reports to credit agencies. If a breach involves more than 5,000 individuals, the covered entity must notify the major credit reporting agencies that compile and maintain files on consumers on a nationwide basis.
60-day requirement. Notification must be made not later than 60 days following the discovery of a breach of security, unless the covered entity providing notice can show that providing notice within such a timeframe is not feasible due to circumstances necessary to accurately identify affected consumers, or to prevent further breach or unauthorized disclosures, and reasonably restore the integrity of the data system.
The bill is in the hands of the Committee on Commerce, Science and Technology.
Dom Nicastro is a contributing writer. He edits the Medical Records Briefings newsletter and manages the HIPAA Update Blog.
- CFO Exchange: Smartphones Poised to Disrupt Healthcare, Says Topol
- Consumerism Drives Healthcare Branding, Rebranding Efforts
- PA Ranks See 'Phenomenal Growth,' Lack of Diversity
- 3 Traits Personality Assessments Can't Reveal
- CNO on Hospital Redesign: 'You Can't Over-Communicate'
- How Digital Strategy Shapes Patient Engagement at Boston Children's Hospital
- Antibiotic Overuse a 'Huge Threat' to Patient Safety, Says CDC
- Carondelet to Pay $35M to Settle Fraud Allegations
- Half of All Primary Care, Internal Medicine Jobs Unfilled in 2013
- CHS Hacked, 4.5M Patient Records Compromised