Massachusetts Forces Businesses To Implement Sweeping Information Security Measures By January 1, 2009

The Commonwealth of Massachusetts recently adopted regulations requiring all businesses that own, license, store or maintain personal information about a resident of Massachusetts to adopt a comprehensive, written information security program. The security program must include a computer security system that encrypts all records and files containing personal information, including all employee and consumer information.

Information Security Program

The new regulations apply to any person or entity that owns, licenses, stores or maintains any personal information of a Massachusetts resident. The regulations define "personal information" as any combination of a resident's name with a Social Security number, driver's license number, bank account number or credit card number.