Name of legislation
Industry
targeted
Breach provisions
Security provisions
entities that offer thirdparty applications for
personal health
records
150
“Safeguarding Against
and Responding to the
Breach of Personally
Identifiable Information”.
OMB Memorandum
M-07-16
Federal Government
Agencies
Federal Information
Security Management
Act of 2002 (FISMA)
and the Privacy Act of
1974
Requires federal agencies to implement a
breach notification policy to safeguard “personally identifiable
information”. Agencies
must report all incidents
involving personally
identifiable information
within one hour of discovery/detection. Following the detection of
a breach, agencies
should notify affected
parties without unreasonable delay unless
law enforcement,
national security, or
agency needs permit a
delay
151
Veterans Affairs Information Security Act
152
Department of
Veterans
Affairs
38 U.S.C. §§5724 and
5727
In the event of a “data
breach” of sensitive
personal information
processed or maintained
by the VA Secretary,
the Secretary must
ensure that either a
non-VA entity or the
VA’s Inspector General
conduct an independent
risk analysis of the data
breach to determine the
level of risk associated
with the data breach.
153
Based upon this analysis, if a reasonable risk
of the potential misuse
of sensitive personal
(continued)
150 Health Breach Notification Rule, 16 C.F.R. 318.
151 Stevens (2010), p. 8.
152 The Veterans Benefits, Health Care, and Information Technology Act of 2006, P.L. 109–461
(December 22, 2006); 38 U.S.C. §§ 5722 et seq.
153 38 U.S. C. § 5724(a)(1).
Data Protection in the United States: U.S. National Report
429
Industry
targeted
Breach provisions
Security provisions
entities that offer thirdparty applications for
personal health
records
150
“Safeguarding Against
and Responding to the
Breach of Personally
Identifiable Information”.
OMB Memorandum
M-07-16
Federal Government
Agencies
Federal Information
Security Management
Act of 2002 (FISMA)
and the Privacy Act of
1974
Requires federal agencies to implement a
breach notification policy to safeguard “personally identifiable
information”. Agencies
must report all incidents
involving personally
identifiable information
within one hour of discovery/detection. Following the detection of
a breach, agencies
should notify affected
parties without unreasonable delay unless
law enforcement,
national security, or
agency needs permit a
delay
151
Veterans Affairs Information Security Act
152
Department of
Veterans
Affairs
38 U.S.C. §§5724 and
5727
In the event of a “data
breach” of sensitive
personal information
processed or maintained
by the VA Secretary,
the Secretary must
ensure that either a
non-VA entity or the
VA’s Inspector General
conduct an independent
risk analysis of the data
breach to determine the
level of risk associated
with the data breach.
153
Based upon this analysis, if a reasonable risk
of the potential misuse
of sensitive personal
(continued)
150 Health Breach Notification Rule, 16 C.F.R. 318.
151 Stevens (2010), p. 8.
152 The Veterans Benefits, Health Care, and Information Technology Act of 2006, P.L. 109–461
(December 22, 2006); 38 U.S.C. §§ 5722 et seq.
153 38 U.S. C. § 5724(a)(1).
Data Protection in the United States: U.S. National Report
429