Although federal law only requires that financial institutions and health care providers maintain a written information security policy or “WISP,” approximately thirty four states have enacted legislation that requires organizations in other industries to take steps to keep certain forms of personal information safe. These statutes are broadly referred to as “safeguards” legislation. In some states safeguards legislation requires that organizations adopt certain security-oriented practices such as encrypting highly sensitive personal information or irrevocably destroying sensitive documents. In other states safeguards legislation requires the adoption of a comprehensive written information security policy. The following provides a snapshot of information concerning safeguards legislation.
4
Number of states that require that some, or all, of the security program be memorialized in writing.1
|
3
Number of states that require that an employee be designated to maintain the security program.2
|
7
Number of states that require that a security provision be included in contracts with service providers.3
|
$100 - $500,000
Range of State Safeguard Law Penalties4
|
The following are the most popular types of personal information protected by state statutes:5
91%
|
Social Security Numbers
|
74%
|
Financial Account Number
|
72%
|
Driver’s License Number
|
31%
|
Health records
|
15%
|
Federal, State, or Local Tax Returns
|
12.5%
|
Biometric data
|
Top 10 sections typically included in a WISP:
-
Designated employee responsible for overseeing security program.
-
Procedures for appropriately destroying documents with sensitive information.
-
Encryption standards for mobile devices.
-
Encryption standards for transmitting sensitive information.
-
Employee training.
-
Data breach incident response.
-
Vendor management.
-
Process for provisioning user access.
-
Process for de-provisioning user access.
-
Disciplinary measures for security violations.
