Privacy laws vary from state to state within the United States of America. Several states have recently passed new legislation that adapt to changes in cyber security laws, medical privacy laws, and other privacy related laws. State laws are typically extensions of existing United States federal laws, expanding them or changing the implementation of the law.
History Historically, state laws on privacy date back before the founding of the United States and most authorities left protection of personal information to the individual. However, after the creation of a national economy as a result of the Civil War, governmental agencies were created to recommend stronger privacy protections. This led to the creation of de facto privacy commissioners, such as the Federal Trade Commission (FTC) and the State Attorney General.
The FTC was created in 1914 to protect individuals from harmful trade practices, and in 1995 the FTC began to study and analyze privacy issues in electronic commerce and began to place and enforce regulations.
Most state legislation on privacy are expansions of federal laws.
The Uniform Law Commission has proposed a model bill – the Uniform Personal Data Protection Act (“UPDPA”), which “provides a reasonable level of consumer protection without incurring the compliance and regulatory costs associated with some existing state regimes.”
Types of privacy legislation There are several different types of privacy legislation currently in place. State laws vary between these niche privacy spheres. Each type of legislation tries to protect a certain area of privacy. Types of legislation include:
Medical Privacy Data Privacy Financial Privacy
Medical privacy
Laws on biobanks One major aspect of medical privacy is laws placed on biobanks. A biobank is a collection source that stores and manages human specimens. Major federal laws that apply to biobanks are regulations by the Food and Drug Administration and Common Rule. The Common Rule is a guideline for in the United States on research involving human subjects. Other major federals laws that govern biobanks include: The Privacy Act of 1974, Health Insurance Portability and Accountability Act (HIPAA), Genetic Information Nondiscrimination Act (GINA), Health Information Technology for Economic and Clinical Health (HITECH) Act, and Newborn Screening Saves Lives Reauthorization Act of 2014.
State legislation on privacy tends to follow the same patterns and orders as federal laws in these matters. But in some cases state laws can be more detailed and stringent, while being in ordinance to the federal laws in place. With focus to biobanks, state laws can restrict a laboratory's ability to reject a customer and can regulate what happened with data after a test. Certain states have privacy laws that deal with genetic-specific information. Genetic-specific information relates to information what information like DNA that can be used to find details about individuals. Information that can be collected includes race and gender. State can place legislation that let individuals have control over the tests conducted on their genes and regulate how long data is stored in biobanks. State laws can also control who has control, the individual from whom they were collected or the pharmaceutical companies.
Digital privacy laws
Corporate data security laws An important aspect of digital privacy laws is cyber security, which encompasses corporate data security. At the national level, the Federal Trade Commission (FTC) is in charge of data security regulation. With relation to cyber security, the FTC makes sure that companies have security application in place and that companies are not misrepresenting their level of digital security. Several aspects of the FTC regulations are outdated and are loosely connected to data security though section 5. Section 5 of the FTC fines companies for having substandard security measures, neglecting the security of consumer data, and failing to train employees on data security. Additional federal laws on this topic include: the Cybersecurity Act of 2015, the Electronics Communications Privacy Act, Computer Fraud and Abuse Act and the Economic Espionage Act.
Financial privacy laws Financial Privacy laws regulate how companies, specifically those with a focus in finance, handle financial consumer information. Federal laws that regulate this include, Gramm-Leach-Bliley Act, Fair Credit Reporting Act, Fair and Accurate Credit Transactions Act, Credit and Debit Card Receipt Clarification Act, Bank Secrecy Act, Fair Debt Collection Practices Act, Electronic Funds Transfer Act, and the Dodd-Frank Wall Street Reform and Consumer Protection Act. All of these acts make changes at the national level.
States
Alabama
Name of ArticlePurposeType of Privacy ProtectedLaw onAla. Admin. Code r. 420-5-7-.05(4) Privacy and safety. (a) The patient has the right to personal privacy.
(b) The patient has the right to receive care in a safe setting.
(c) The patient has the right to be free from all forms of abuse or harassment.
(5) Confidentiality of Patient Records.
(a) The patient has the right to the confidentiality of his or her clinical records.
(b) The patient has the right to access information contained in his or her clinical records within a reasonable time frame. The hospital shall not frustrate the legitimate efforts of individuals to gain access to their own medical records and shallMedical PrivacyConfidentiality of informationAla. Admin. Code r. 420-5-7-.13(3) Form and retention of record. The hospital shall maintain a medical record for each inpatient and outpatient. Medical records shall be accurately written, promptly completed, properly filed and retained, and accessible. The hospital shall use a system of author identification and record maintenance that ensures the integrity of the authentication and protects the security of all record entries.
(c) The hospital shall have a procedure for ensuring the confidentiality of patient records. Information from or copies of records may be released only to authorized individuals, and the hospital shall ensure that unauthorized individuals cannot gain access to or alter patient records. Original medical records shall be released by the hospital only in accordance with federal or state laws, court orders, or subpoenas.
(4) Content of record. The medical record shall contain information to justify admission and continued hospitalization, support the diagnosis, and describe the patient's progress and response to medications and services.Medical PrivacyMedical record servicesAla. Admin. Code r. 545-X-4-.08(1) Physicians should maintain legible well documented records reflecting the history, findings, diagnosis and course of treatment in the care of a patient. Medical records should be maintained by the treating physician for such period as may be necessary to treat the patient and for such additional time as may be required for medical legal purposes.
(2) Access. On the request of a patient, and with the authorization of the patient, a physician should provide a copy or a summary of the medical record to the patient or to another physician, attorney or other person designated by the patient. By state law, a physician is allowed to condition the release of copies of medical records on the payment by the requesting party of the reasonable costs of reproducing the record. Reasonable cost as defined by law may not exceed onedollar ($1.00) per page for the first twenty-five (25) pages, fifty cents ($.50) per page for each page in excess of twenty-five (25) pages, plus the actual cost of mailing the record. In addition, the actual costs of reproducing x-rays or other special records may be included. For medical records provided in an electronic file, a flat fee that would not exceed the cost of providing the records in paper form may be charged. Records subpoenaed by the State Board of Medical Examiners are exempt from this law. Physicians charging for the cost of reproduction of medical records should give primary consideration to the ethical and professional duties owed to other physicians and to their patients, and waive copying charges when appropriate.Medical PrivacyMedical RecordsAla. Code § 25-5-339(b) Employers, laboratories, medical review officers, employee assistance programs, drug or alcohol rehabilitation programs, and their agents who receive or have access to information concerning test results shall keep all information confidential. Release of such information under any other circumstance shall be solely pursuant to a written consent form signed voluntarily by the person tested, unless the release is compelled by an agency of the state or a court of competent jurisdiction or unless deemed appropriate by a professional or occupational licensing board in a related disciplinary proceeding. The consent form shall contain at a minimum all of the following:
(1) The name of the person who is authorized to obtain the information.
(2) The purpose of the disclosure.
(3) The precise information to be disclosed.
(4) The duration of the consent.
(5) The signature of the person authorizing release of the informationMedical PrivacyConfidentiality of informationAlabama Data Breach Notification ActIn case of hacking, notice to an affected individual under this section shall be given in writing, sent to the mailing address of the individual in the records of the covered entity, or by email notice sent to the email address of the individual in the records of the covered entity. The notice shall include, at a minimum, all of the following:
(1) The date, estimated date, or estimated date range of the breach.
(2) A description of the sensitive personally identifying information that was acquired by an unauthorized person as part of the breach.
(3) A general description of the actions taken by a covered entity to restore the security and confidentiality of the personal information involved in the breach.
(4) A general description of steps an affected individual can take to protect himself or herself from identity theft.
(5) Information that the individual can use to contact the covered entity to inquire about the breach. Data PrivacyBreach notificationAlabama Insurance Regulation Chapter 482-1-122 A. Initial notice requirement. A licensee shall provide a clear and conspicuous notice that accurately reflects its privacy policies and practices to both of the following: (1) Customer. An individual who becomes the licensee's customer, not later than when the licensee establishes a customer relationship, except as provided in Subsection E of this section.
(2) Consumer. A consumer, before the licensee discloses any nonpublic personal financial information about the consumer to any nonaffiliated third party, if the licensee makes a disclosure other than as authorized by Sections 15 and 16.
B. When initial notice to a consumer is not required. A licensee is not required to provide an initial notice to a consumer under Subsection A(2) of this section if either of the following are true:
(1) The licensee does not disclose any nonpublic personal financial information about the consumer to any nonaffiliated third party, other than as authorized by Sections 15 and 16, and the licensee does not have a customer relationship with the consumer.
(2) A notice has been provided by an affiliated licensee, as long as the notice clearly identifies all licensees to whom the notice applies and is accurate with respect to the licensee and the other institutions. Financial PrivacyThird Parties
Alaska