Privacy and security continue to be at the forefront for legislatures across the nation, despite (or perhaps because of) the COVID-19 pandemic. In late May, with back-to-back amendments, Washington D.C. and Vermont significantly overhauled their data breach notification laws, including expansion of the definition of personal information, and heightened notice requirements. Now, Michigan may follow
Small Michigan Medical Practice To Close Following Ransomware Attack
Small and midsized enterprises (SMEs) continue to be targeted by ransomware, phishing and other cyberattacks; the consequences of which could be devastating. Those consequences include putting SMEs out of business, which is unfortunately the case for one small medical practice in Battle Creek, Michigan, as reported by HIPAAJournal.
The reality is that the effects
Bans on Employers Requesting Social Media Passwords Continue as New Year Approaches
Michigan becomes fourth state to enact law banning employers from requiring access to employees’/applicants’ social media accounts
Continue Reading Bans on Employers Requesting Social Media Passwords Continue as New Year Approaches
Maryland Restricts Employer Use of Credit History Information
On April 12, 2011, Maryland Governor Martin O’Malley signed into law S.B. 132/H.B. 87. Under this law, Maryland employers, except in limited circumstances, are prohibited from using an individual’s consumer credit history for hiring or other employment purposes. 
Beginning October 1, 2011, employers are prohibited from using credit report data to deny employment, discharge an
Cautionary Tale for Health Care Providers Subject to HIPAA – Don’t Forget State Law
This recent Michigan case makes clear that when handling protected health information, HIPAA is not the only game in town. Health care providers also must consider state law protections which, as this and other courts have held, will trump HIPAA when the state laws are more protective.
Continue Reading Cautionary Tale for Health Care Providers Subject to HIPAA – Don’t Forget State Law
Florida, Michigan, and Montana Follow National Trend and Consider Banning the Use of Applicant Credit History Background Checks in Hiring Decisions
In the face of increasing unemployment, in March 2011, Florida, Michigan, and Montana joined the ranks of approximately fifteen other states that are considering bills limiting employers’ ability to use credit checks for employment purposes.
Florida. Florida’s Senate Bill 1562, introduced on March 3, would prohibit employers from using an applicant’s personal credit history
Data Security, Destruction and Encryption Leads the Way for States in 2010
Less than one month into 2010 the trend to address data security, destruction, and encryption has
continued among state lawmakers. Specifically, Florida, Michigan, Kentucky, Kansas, Pennsylvania, and New York all have introduced, reintroduced, or amended legislation of this kind.
- The Florida and Michigan laws would amend personal data destruction rules for companies.
- The New York law would mandate data security and encryption measures.
- The Kentucky bill would require government agencies to protect all personal data under the Gramm-Leach-Bliley Act.
- The Michigan bill includes a state version of the Federal Trade Commission’s Red Flags Rule and would require creditors in the state to implement programs aimed at spotting “red flags” of possible identity theft and put in place mitigation measures. Michigan is also considering a number of other measures.
- The Kansas law would require state agencies to engage in periodic network security reviews.
- The Pennsylvania bill would require public agencies to notify state residents of a breach of their personal information within seven days of the discovery of the breach.
While 5 states remain without data breach notice bills (Alabama, Kentucky, Mississippi, New Mexico, and South Dakota), Congress is considering legislation, the Data Accountability and Trust Act (DATA) (H.R. 2221), that would preempt all state notification laws and instead establish a national breach notice standard.
As we have previously mentioned, we anticipate data privacy and security legislation and case law to be at the forefront of legal issues in 2010. Employers should begin by reading the Data Security Primer and consider implementing comprehensive data security policies and procedures that would allow them to comply with the various state laws that may impact their business. Continue Reading Data Security, Destruction and Encryption Leads the Way for States in 2010