This week I want to take a look at encryption laws. Only a few short years ago no law or regulation really had explicit encryption requirements. HIPAA, passed in 1996 with effective compliance deadline requirements in 2003 (Privacy Rule) and 2005 (Security Rule) included withint the Security Rule that encryption was “addressable” based upon the results of risk assessment.
However, encryption became a more hotly debated topic with the more recent Massachusetts and Nevada laws that explicitly require organizations to encrypt personally identifiable information (PII). Now the question of whether or not the Massachusetts law will indeed be enforced upon the current compliance date of January 1, 2010 is once more in the news…

(more…)