Computer System Security Requirements

The standards also list mandatory minimum elements to be included in the security system (the "system"). Briefly, they include:

• Secure user authentication protocols;
• Secure access control measures;
• Encryption of transmitted records and files, to the extent feasible;
• Reasonable monitoring of systems, for unauthorized access to personal information;
• Encryption of all personal information stored on laptops or other portable devices;
• Reasonable up-to-date firewall protection for files containing protected information on a system that is connected to the Internet;
• Reasonably up-to-date versions of system security agent software which must include malware protection and reasonably up-to-date patches and virus definitions;
• Education and training of employees on the proper use of the system and the importance of personal information security.

The standards also specify features required for secure user authentication protocols and secure access control measures.

Recommendations for Compliance

Companies should begin now to audit and review its policies and procedures currently in place to determine what changes should be made in order to comply with the statute and Standards. Companies should also review termination policies of employees and their potential access to confidential information. They should also consider when drafting contracts or entering into independent consultant agreements obtaining written verification that the other party has a compliant program in place. Lastly, companies must ensure encryption of all personal information stored on computers, laptops, Blackberrys, iPhones and other portable devices. It should be noted that it remains unclear what is considered a "portable device" under the standards. This term could include USB drives, cell phones, PDAs and even Blackberrys.

What If I'm Not Located In Massachusetts?

The standards apply to your company. The standards apply to any business—wherever located—that own, license, maintain or store the "personal information" of Massachusetts residents.

What Happens If You DON'T Comply: Penalties

It is crucial for businesses to understand and comply with the newly enacted data breach legislation to avoid potentially severe monetary penalties. Massachusetts, unlike the majority of states, provides for civil penalties in cases of non-compliance with its data breach notification statute, Massachusetts General Law 93H. In particular, a civil penalty of $5,000 may be awarded for each violation of 93H. In addition, under the portion of 93H concerning data disposal, businesses can be subject to a fine of up to $50,000 for each instance of improper disposal. Therefore, while implementation of the standards might require additional expenditures and seem costly, potential fines might result in greater financial damage to a business, not to mention the likely negative publicity. May 1, 2009 is right around the corner.

Cynthia Larose is a member in Mintz Levin's Boston office and is a Certified Information Privacy Professional (CIPP). She heads the firm's Privacy and Security practice. Elissa Flynn-Poppey is an associate in Mintz Levin's Boston office.