Businesses throughout Massachusetts are trying to comply with the not so new privacy protection regulations known as CMR-17. If you have personal information of others, you need to know about this regulation.
Any business which holds personally identifying information on its customers needs to take specific steps to secure that data, including both physical (paper) or electronic data. Relevant personal information includes:
A person’s first initial (or name) and last name, and any one of the following:
Every person or business that stores this information must establish a comprehensive information security plan, known as a "written information security plan", or WISP which must include:
-
A designated security officer.
-
Identify and assess reasonable risks to the confidentiality of any information held.
-
Identify all places where personal information may be kept within an office, and take steps to secure it (locked file cabinets, controlled access).
-
Create written procedures on physical access to records.
-
Develop security programs for employee access to electronic information.
-
Limiting personal information collected to relevant information to get the job done.
-
Impose disciplinary measures for security violations by employees.
-
Prevent terminated employees from accessing previously authorized areas by disabling access to any accounts holding personal information.
-
Taking steps to verify that third party service providers have similar security programs in place.
-
Regular monitoring of the “Written Information Security Plan” (WISP); documenting actions taken, and reviewing at least annuall
Establishing a WISP involves Human Resources, IT, security, and must be a top-down initiative. The fines and legal liabilities associated with a data breach may be the greatest threat your business faces today. If you need assistance navigating these new rules, contact us.
If you'd like an application to quantify the cost of this insurance to your business, click below or just give us a call at 781-659-2262.
