A new Massachusetts law requires a long list of security measures to protect certain personal information held by any “person” who is a citizen of Massachusetts (e.g., a company, hospital, HIN,...

A new Massachusetts law requires a long list of security measures to protect certain

personal information held by any “person” who is a citizen of Massachusetts (e.g.,

a company, hospital, HIN, individual). Review these measures and the situations to

which they apply. Describe how the law would affect an HIN s security program.

Would the personal information of a citizen of Massachusetts be covered by this

law if the HIN itself was not in Massachusetts? Would the law s applicability vary,

depending on whether the data of the citizen of Massachusetts came from a care

episode in Massachusetts or not? The law can be found by searching for “201 CMR

17.00” under www.mass.gov.