Guide to Massachusetts Data Privacy Laws & Steps you can take towards Compliance

Overview of Laws M.G.L. 93H – Defines Personal Information – Requirement to notify the state and affected parties in the event of a security breach or unauthorized usage of personal information. M.G.L. 93I – Requires that personal information be destroyed in a manner that leaves it unrecoverable.

Overview of Laws 201 CMR – Requires an individual be appointed to maintain a program to protect personal information within your organization. – Take reasonable steps to verify that third party vendors with access to personal information do not introduce risk. – Requirements to limit the amount of personal information collected.

Definition of Sensitive Data M.G.L. Ch. 93H defines Personal Information as: – An individual’s name in combination with any of the following: Social Security Number Driver’s License Number State Identification Card Number Financial Account Number, credit or debit card number

Day to Day Impact As faculty or staff, how does this impact you? – Protect the Information! – Look for and report suspicious activity!

Protecting the Information Do you have access to personal information? – Select secure passwords and do not use shared accounts. – Make sure that you have a valid business requirement for accessing the information; if not, work with your FSP to remove the access. – Work with your FSP to ensure that you have up-to-date Anti-Virus and security software on your desktop or laptop computers. – If you store personal information on a laptop, work with your FSP to install Whole Disk Laptop encryption – it’s the law! Install reasonably up-to-date Anti-Virus software & Security Agent software System must be up to date on patches A firewall must be used (host or network based) Reasonable monitoring for unauthorized use or access to personal information

Day to Day Impact Look for Suspicious Behavior – The state requires notification in the event of a Data Breach – When data is accessed by an unauthorized individual; including Tufts employees! Unauthorized Usage – When individuals use data in ways that it was not intended, such as when doctors look at celebrity medical records. Don’t send s that contain personal information!

Data Retention If data exists, is it required? – Yes? Then it must be protected – No? Then it must be securely destroyed UIT can provide assistance with identifying tools or resources to securely destroy paper, electronic files, tapes or hard drives.

Protecting the Data Is the data stored on a P: or Q: drive? – Limit access to only those who have a legitimate business requirement to have access – Install reasonably up-to-date Anti-Virus software & Security Agent software – System must be up to date on patches

Protecting the Data Internet or Wireless Access to Application? – Needs to be encrypted Work with UIT to find a solution if the application does not support native encryption.

Protecting the Data Accessing this data from a home computer? – Is it required? No – Legal responsibility to securely remove any sensitive data from that machine. Yes – Requires approval – All system requirements pertain to that computer: Up to date on patches Anti-Virus Firewall Strong authentication Secure passwords

Recommendations

Approach 1.Understand what constitutes sensitive data 2.Identify sensitive data used within your organization 3.Identify what is necessary, securely destroy what is not. 4.Identify laptops, desktops & servers that contain sensitive data

Identify Sensitive Data within your Environment Staff – Read the Tufts University Written Information Security Plan (WISP) – Designate an individual to be responsible for this within your school or department. – Hold discussions with staff to determine if sensitive data exists within your organization and how it is used. Technology – UIT provides tools to install on computers to scan for potential sensitive data

Protecting the Data Physical paper work? – Keep it locked up. Limit access to those who have a legitimate business requirement. – Securely Destroy it when no longer required Electronic Data – Stored on a laptop? It must be encrypted. UIT provides whole disk laptop protection for Windows PCs and recommendations for those running alternative operating systems.

Vendor Management Organizations have a legal responsibility to ensure that third party vendors meet the following obligations: – Select and retain vendors that are capable of maintaining safeguards for personal information – Contractually require service providers to maintain such safeguards – Effective March 1, 2010 for new contracts – Effective March 1, 2012 for existing contracts created before March 1, 2010

Unauthorized Usage In the event of a security breach or identified unauthorized usage, Tufts has a legal requirement to notify the Attorney General and impacted users. If you suspect a security breach or have identified unauthorized usage of sensitive data, contact Tufts University Legal Counsel immediately.

Additional Resources Laws: – MGL 93H MGL 93H – MGL 93I MGL 93I – 201 CMR CMR 17.00