Processes personal data, in Massachusetts

Mass. Gen. Laws ch. 93H, § 3 · Read the law's page

• Notify the Massachusetts Attorney General, the Director of Consumer Affairs and Business Regulation, and each affected Massachusetts resident as soon as practicable and without unreasonable delay after learning of a breach of security involving personal information.
• Do not rely on ch. 93H to cover a breach exposing only biometric data; its personal information definition does not reach biometric identifiers at all.

Mass. Gen. Laws ch. 93H, § 6 · Read the law's page

• Expect ch. 93H's own enforcement clause to arm only the Massachusetts Attorney General; look to 940 CMR 3.16(3), not this section, for the route by which a private plaintiff may sue over a breach-notice violation.

Mass. Gen. Laws ch. 93I, sec. 2 · Read the law's page

• This binds each agency or person that disposes of records containing personal information.
• Dispose of paper documents containing personal information by redacting, burning, pulverizing or shredding them so that personal data cannot practicably be read or reconstructed.
• Destroy or erase electronic media and other non-paper media containing personal information so that the personal information cannot practicably be read or reconstructed.
• If you are a third party hired to dispose of material containing personal information, implement and monitor compliance with policies and procedures that prohibit unauthorized access to or acquisition of or use of personal information during the collection, transportation and disposal of personal information.

201 CMR 17.01-17.05 · Read the law's page

• This binds any person that owns or licenses personal information about a Massachusetts resident, meaning any person or business that receives, stores, maintains, processes, or otherwise has access to it in connection with providing goods or services or in connection with employment; it reaches a business outside Massachusetts that holds a Massachusetts resident's personal information the same as one located here.
• Develop, implement, and maintain a comprehensive written information security program (WISP), in one or more readily accessible parts, with administrative, technical, and physical safeguards appropriate to your size, scope, resources, amount of stored data, and the sensitivity of the personal information you hold.
• Designate one or more employees to maintain the WISP; identify and assess foreseeable internal and external risks to personal information and evaluate whether your safeguards limit them; train employees; discipline violations; cut off a terminated employee's access to records; restrict and secure physical access to records; review the WISP's scope at least annually or after a material change in business practice; document your response to any security-breach incident; and select only third-party service providers capable of maintaining appropriate security measures, requiring those measures by contract.
• For personal information you store or transmit electronically, build a computer-system security program with secure user authentication, access controls limiting records to those who need them, encryption of records transmitted across public networks or wirelessly and of personal information stored on a laptop or other portable device, up-to-date firewalls and operating-system security patches for any internet-connected system, up-to-date malware protection, and employee training on the security system.
• There is no compliance runway left to build against: every covered person has been required to be in full compliance since March 1, 2010.

Mass. Gen. Laws ch. 93H, § 3A · Read the law's page

• Offer at least 18 months of free credit monitoring to a Massachusetts resident whose Social Security number was disclosed, or reasonably believed disclosed, in a breach of security.
• If you are a consumer reporting agency that experienced the breach, offer not less than 42 months of free credit monitoring instead of 18.
• Do not require a resident to waive any right to a private right of action as a condition of the credit-monitoring offer.

940 CMR 3.16(3); Mass. Gen. Laws ch. 93A, §§ 2, 9 · Read the law's page

• Expect a failure to comply with an existing law meant to protect the public's health, safety or welfare and intended to protect consumers to be a ch. 93A section 2 violation under 940 CMR 3.16(3), on which an injured person may sue under ch. 93A section 9; whether ch. 93H's breach-notice duty and 201 CMR 17.00's information security program mandate are such laws is unsettled.

Mass. Gen. Laws ch. 111, § 70G · Read the law's page

• If you are a facility, physician or health care provider, test a person for genetic information only after you obtain that person's prior written consent. A prior written consent is a signed form that is not a general waiver, and states the purpose of the test, that the person discussed the reliability of the results with the ordering practitioner, that genetic counseling is available, a general description of each condition tested for, and who may receive the results.
• If you are a facility, physician or health care provider, do not disclose a genetic test result to anyone other than the person tested, and do not identify the person tested to anyone, without informed written consent, a separate written consent form that states the purpose of the request, or a proper judicial order. Confidential research information used only for epidemiological or clinical research is excepted from the disclosure bar.
• If you are a hospital, laboratory, registry, physician, insurance institution, insurance support organization, insurance representative or commercial genetic testing company, do not divulge reports and records pertaining to genetic information without informed written consent, except as subsection (b) provides: on proper judicial order, to a person whose official duties the commissioner finds entitle receipt, in connection with life, disability and long term care insurance as chapter 175I authorizes, or as confidential research information.
• If you are a laboratory, run a requested genetic test only when the request carries the ordering practitioner's signed statement that the appropriate prior written consent has been obtained, unless the test is conducted as confidential research information.

Mass. Gen. Laws ch. 175, §§ 108H, 108I and 120E · Read the law's page

• If you are a company, officer, agent or insurance broker writing an individual or group accident and sickness policy that provides hospital and surgical expense insurance, do not cancel, refuse to issue or renew, or make any distinction in premiums, rates, length of coverage or other terms based on genetic information, and do not require genetic tests or genetic information as a condition of issuing or renewing the policy (section 108H).
• If you are an insurer, agent or broker authorized to issue disability, long term care or life policies in the commonwealth, do not practice unfair discrimination against a person because of the results of a genetic test or the provision of genetic information, meaning cancelling, refusing to issue or renew, charging any increased rate or restricting any length of coverage, unless the action rests on reliable information about the insured's mortality or morbidity based on sound actuarial principles or actual or reasonably anticipated claim experience (sections 108I and 120E).
• Do not require an applicant for a disability, long term care or life policy to undergo a genetic test as a condition of issuing or renewing the policy (sections 108I and 120E).
• If an application asks whether the applicant has taken a genetic test, state on or with the application that the applicant is not required to answer and that failing to answer may result in an increased rate or denial of coverage (sections 108I and 120E).

Mass. Gen. Laws ch. 176A, § 3B; ch. 176B, § 5B; ch. 176G, § 24 · Read the law's page

• If you are a corporation subject to chapter 176A or 176B (a nonprofit hospital or medical service corporation), or an officer or agent of one, do not cancel, refuse to issue or renew, or make any distinction in premiums, rates, length of coverage or other terms of a medical service plan based on genetic information, and do not require genetic tests or private genetic information as a condition of issuing or renewing a hospital service plan (section 3B) or a medical service plan (section 5B).
• If you are a health maintenance organization subject to chapter 176G, or an officer or agent of one, do not cancel, refuse to issue or renew, or make any distinction in premium, rates, length of coverage or other terms of a health maintenance contract based on genetic information, and do not require genetic tests or private genetic information as a condition of issuing or renewing the contract (section 24).

Mass. Gen. Laws ch. 176I, § 4A · Read the law's page

• If you are an organization or preferred provider under chapter 176I, do not cancel, refuse to issue or renew, or make any distinction in premiums, rates, length of coverage or other terms of a health benefit plan based on genetic information, and do not require genetic tests or private genetic information as a condition of issuing or renewing the plan.

Mass. S.2619 (formerly S.2608); House substitute H.5472/H.5479, 194th Gen. Ct. · Read the law's page

• Track the Massachusetts Data Privacy Act's conference committee process, since the bill has passed both chambers in different forms.