Sec. 208. Data security and protection of covered data
593 words·~3 min read·
/bill/117/hr/8152/ih/section-208A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
A covered entity or service provider shall establish, implement, and maintain reasonable administrative, technical, and physical data security practices and procedures to protect and secure covered data against unauthorized access and acquisition. The reasonable administrative, technical, and physical data security practices required under paragraph
(1)shall be appropriate to— the size and complexity of the covered entity or service provider; the nature and scope of the covered entity or the service provider’s collecting, processing, or transferring of covered data; the volume and nature of the covered data collected, processed, or transferred by the covered entity or service provider; the sensitivity of the covered data collected, processed, or transferred; the current state of the art in administrative, technical, and physical safeguards for protecting such covered data; and the cost of available tools to improve security and reduce vulnerabilities to unauthorized access and acquisition of such covered data in relation to the risks and nature of the covered data. The data security practices required under subsection
(a)shall include, at a minimum, the following practices: Identifying and assessing any material internal and external risk to, and vulnerability in, the security of each system maintained by the covered entity that collects, processes, or transfers covered data, or service provider that collects, processes, or transfers covered data on behalf of the covered entity, including unauthorized access to or risks to such covered data, human vulnerabilities, access rights, and the use of service providers. With respect to large data holders, such activities shall include a plan to receive and respond to unsolicited reports of vulnerabilities by any entity or individual. Taking preventive and corrective action designed to mitigate any reasonably foreseeable risks or vulnerabilities to covered data identified by the covered entity or service provider, consistent with the nature of such risk or vulnerability, which may include implementing administrative, technical, or physical safeguards or changes to data security practices or the architecture, installation, or implementation of network or operating software, among other actions. Evaluating and making reasonable adjustments to the safeguards described in paragraph
(2)in light of any material changes in technology, internal or external threats to covered data, and the covered entity or service provider’s own changing business arrangements or operations. Disposing of covered data that is required to be deleted by law or is no longer necessary for the purpose for which the data was collected, processed, or transferred, unless an individual has provided affirmative express consent to such retention. Such disposal shall include destroying, permanently erasing, or otherwise modifying the covered data to make such data permanently unreadable or indecipherable and unrecoverable to ensure ongoing compliance with this section. Training each employee with access to covered data on how to safeguard covered data and updating such training as necessary. Designating an officer, employee, or employees to maintain and implement such practices. Implementing procedures to detect, respond to, or recover from security incidents or breaches. The Commission may promulgate in accordance with section 553 of title 5, United States Code, technology-neutral regulations to establish processes for complying with this section. A covered entity that is required to comply with title V of the Gramm-Leach-Bliley Act ( 15 U.S.C. 6801 et seq. ) or the Health Information Technology for Economic and Clinical Health Act ( 42 U.S.C. 17931 et seq. ), and is in compliance with the information security requirements of such Act as determined by the enforcement authority in such Act, shall be deemed to be in compliance with the requirements of this section with respect to any data covered by such information security requirements.
Connectionstraces to 2
Citation graph
cites case law
Cites 2Cited by 0 across 0 sources