Legislation title
Definition personal
data
Data classifications
Processing of
information
provided in paragraph
(2) of this definition,
30
that is: (i) Transmitted
by electronic media;
(ii) Maintained in
electronic media; or
(iii) Transmitted or
maintained in any
other form or
medium
31
(e-PHI) While HIPPA
protects PHI, there are
additional requirements that apply to
e-PHI
32
contractors which
require all data processors to (1) adopt
administrative, physical, and technical
safeguards to protect
the confidentiality,
integrity, and availability of the information; and
(2) report security
incidents
33
Controlling the
Assault of
Non-Solicited Pornography and Marketing Act
(CAN-SPAM Act)
Regulates the collection and use of e-mail
addresses. Covers all
commercial messages,
which the law defines
as “any electronic
mail message the primary purpose of
which is the commercial advertisement or
promotion of a commercial product or
service”, including
email that promotes
content on commercial websites
Regulates “commercial” and “transactional or relationship”
emails. Commercial
email must include
non-deceptive sender
and subject information; opt-out provisions; sender’s
address; and clear and
conspicuous identification that the e-mail
is an advertisement or
solicitation
34
The Act imposes
criminal penalties on
individuals who: harvest email addresses
or generate them
through a dictionary
attack
35
(continued)
30 “(2) Protected health information excludes individually identifiable health information in:
(i) Education records covered by the Family Educational Rights and Privacy Act, as amended,
20 U.S.C. 1232g; (ii) Records described at 20 U.S.C. 1232g (a)(4)(B)(iv); and (iii) Employment
records held by a covered entity in its role as employer.” See §160.103.
31 Individually identifiable health information includes demographic data, that relates to: the individual’s past, present or future physical or mental health or condition, the provision of health care to
the individual, or the past, present, or future payment for the provision of health care to the
individual, and that identifies the individual or for which there is a reasonable basis to believe
can be used to identify the individual. See 45 CFR 160.103.
32 Specifically, covered entities must: “Ensure the confidentiality, integrity, and availability of all
e-PHI they create, receive, maintain or transmit; Identify and protect against reasonably anticipated
threats to the security or integrity of the information; Protect against reasonably anticipated,
impermissible uses or disclosures; and ensure compliance by their workforce.” See https://www.
hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html.
33 Eisenhauer (2007), p. 2.
34 15 U.S.C. §§7701–7713.
35 “CAN-SPAM Act: A Compliance Guide for Business”, Federal Trade Commission. Available at:
https://www.ftc.gov/tips-advice/business-center/guidance/can-spam-act-compliance-guidebusiness.
Data Protection in the United States: U.S. National Report
413
Definition personal
data
Data classifications
Processing of
information
provided in paragraph
(2) of this definition,
30
that is: (i) Transmitted
by electronic media;
(ii) Maintained in
electronic media; or
(iii) Transmitted or
maintained in any
other form or
medium
31
(e-PHI) While HIPPA
protects PHI, there are
additional requirements that apply to
e-PHI
32
contractors which
require all data processors to (1) adopt
administrative, physical, and technical
safeguards to protect
the confidentiality,
integrity, and availability of the information; and
(2) report security
incidents
33
Controlling the
Assault of
Non-Solicited Pornography and Marketing Act
(CAN-SPAM Act)
Regulates the collection and use of e-mail
addresses. Covers all
commercial messages,
which the law defines
as “any electronic
mail message the primary purpose of
which is the commercial advertisement or
promotion of a commercial product or
service”, including
email that promotes
content on commercial websites
Regulates “commercial” and “transactional or relationship”
emails. Commercial
email must include
non-deceptive sender
and subject information; opt-out provisions; sender’s
address; and clear and
conspicuous identification that the e-mail
is an advertisement or
solicitation
34
The Act imposes
criminal penalties on
individuals who: harvest email addresses
or generate them
through a dictionary
attack
35
(continued)
30 “(2) Protected health information excludes individually identifiable health information in:
(i) Education records covered by the Family Educational Rights and Privacy Act, as amended,
20 U.S.C. 1232g; (ii) Records described at 20 U.S.C. 1232g (a)(4)(B)(iv); and (iii) Employment
records held by a covered entity in its role as employer.” See §160.103.
31 Individually identifiable health information includes demographic data, that relates to: the individual’s past, present or future physical or mental health or condition, the provision of health care to
the individual, or the past, present, or future payment for the provision of health care to the
individual, and that identifies the individual or for which there is a reasonable basis to believe
can be used to identify the individual. See 45 CFR 160.103.
32 Specifically, covered entities must: “Ensure the confidentiality, integrity, and availability of all
e-PHI they create, receive, maintain or transmit; Identify and protect against reasonably anticipated
threats to the security or integrity of the information; Protect against reasonably anticipated,
impermissible uses or disclosures; and ensure compliance by their workforce.” See https://www.
hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html.
33 Eisenhauer (2007), p. 2.
34 15 U.S.C. §§7701–7713.
35 “CAN-SPAM Act: A Compliance Guide for Business”, Federal Trade Commission. Available at:
https://www.ftc.gov/tips-advice/business-center/guidance/can-spam-act-compliance-guidebusiness.
Data Protection in the United States: U.S. National Report
413