FTC Supports Breach Notification Bill

The Federal Trade Commission has approved a data breach bill requiring entities that hold consumers' sensitive information to create a robust data compliance protection plan. The intention of the plan is to enforce strict breach notification requirements.

The FTC submitted testimony for a Senate hearing on the bill and said it "strongly supports" the bill.

"Notification in appropriate circumstances can be beneficial," the Commission says. "Notification laws that have increased public awareness of the harm breaches can cause.  Breach notification at the federal level would extend notification nationwide and accomplish similar goals."

The bill would serve as a complement to several breach notification laws on a state level already in effect, the FTC says.

U.S. Senators Mark Pryor (D-AR) and Jay Rockefeller (D-WV) filed in August the "Data Security and Breach Notification Act of 2010," which would be regulated by the FTC.

According to the language in the bill, healthcare entities and their business associates (BAs) would be in the clear so long as they complied with the Health Information Technology for Economic and Clinical Health (HITECH) Act or any other federal laws that satisfy similar or stronger requirements.

It is unclear, however, if compliance with the FTC's Red Flags Rule for identity theft protections would exempt entities from the requirements in the new bill.

No matter to whom the bill applies, healthcare entities should watch the bill's progress in light of new privacy and security laws in HITECH that call for greater patient rights to protected health information (PHI) and greater penalties for breaches of unsecured PHI.

The FTC's testimony this week called for additions to the bill:

• The provision that requires that companies notify consumers in the event of an information security breach should not be limited to entities that possess data in electronic form
• The proposed requirements should be extended so that they apply to telephone companies
• The bill should grant the agency rulemaking authority to determine circumstances under which providing free credit reports or credit monitoring may not be warranted

The bill extends civil action power to state attorneys general, much like HITECH does. It includes a maximum of $11,000 per day for each day an entity is found not to be in compliance and caps a single violation at:

• $5 million for each violation of the security and compliance requirements
• $5 million for all violations of the breach notification requirements

Read more about the bill's security and compliance requirements.