(GINA), the Americans with Disabilities Act (ADAAA), and other statutes that
specifically protect personally identifiable information such as the Fair and Accurate
Credit Transactions Act.
145 Pursuant to this legislation, employers must keep Information about an employee’s medical condition, genetics, disability, reasonable
accommodations, and positive drug test results in a separate, confidential, secure
electronic or physical file, and disclosed only to those within the company who need
to know the information.
146
2.7 Data Breach Notification Obligations
Despite efforts to pass legislation on the federal level that would mandate notification procedures across industry sectors, the only applicable federal legislation to date
is the sector specific legislation in the credit, financial services, health care, government, securities, and internet sectors.
147 The various sector-specific legislative
enactments contain Information security provisions that are designed to protect
personally identifiable information or sensitive personal information from
unauthorized disclosure, acquisition, or access.
148 These notification provisions
usually require covered entities to implement a notification policy and include
provisions for incident reporting and handling as well as breach notification
requirements.
149
The major privacy rights laws that contain breach provisions are detailed in the
Table below:
Name of legislation
Industry
targeted
Breach provisions
Security provisions
Health Information Technology for Economic and
Clinical Health
(HITECH) Act
(P.L. 111-5) (2009).
Section 13407
Health Care
Section 13410(d) of the
HITECH Act
Requires web-based
businesses to notify
consumers when the
security of their electronic health information is breached.
Applies to both vendors
of personal health
records, which provide
online record keeping
systems that consumers
may use to track their
health records, and
(continued)
145 McGinnis (2014).
146 Id.
147 Stevens (2010), p. 1.
148 Id.
149 Id.
428
S. M. Boyne
specifically protect personally identifiable information such as the Fair and Accurate
Credit Transactions Act.
145 Pursuant to this legislation, employers must keep Information about an employee’s medical condition, genetics, disability, reasonable
accommodations, and positive drug test results in a separate, confidential, secure
electronic or physical file, and disclosed only to those within the company who need
to know the information.
146
2.7 Data Breach Notification Obligations
Despite efforts to pass legislation on the federal level that would mandate notification procedures across industry sectors, the only applicable federal legislation to date
is the sector specific legislation in the credit, financial services, health care, government, securities, and internet sectors.
147 The various sector-specific legislative
enactments contain Information security provisions that are designed to protect
personally identifiable information or sensitive personal information from
unauthorized disclosure, acquisition, or access.
148 These notification provisions
usually require covered entities to implement a notification policy and include
provisions for incident reporting and handling as well as breach notification
requirements.
149
The major privacy rights laws that contain breach provisions are detailed in the
Table below:
Name of legislation
Industry
targeted
Breach provisions
Security provisions
Health Information Technology for Economic and
Clinical Health
(HITECH) Act
(P.L. 111-5) (2009).
Section 13407
Health Care
Section 13410(d) of the
HITECH Act
Requires web-based
businesses to notify
consumers when the
security of their electronic health information is breached.
Applies to both vendors
of personal health
records, which provide
online record keeping
systems that consumers
may use to track their
health records, and
(continued)
145 McGinnis (2014).
146 Id.
147 Stevens (2010), p. 1.
148 Id.
149 Id.
428
S. M. Boyne