Massachusetts 201 CMR 17 Compliance — Protecting Personal Information of MA Residents

Massachusetts 201 CMR 17 applies to any person that owns or licenses personal information about residents of the Commonwealth of Massachusetts. There is no minimum employee count, no revenue threshold, and no industry restriction. The regulation applies to businesses located outside Massachusetts just as it applies to Massachusetts-based businesses — the trigger is holding personal information about Massachusetts residents, not being located in Massachusetts. Exemptions exist for personal information subject to HIPAA (to the extent HIPAA and 201 CMR 17 conflict) and for certain government agencies, but virtually all private businesses that hold personal information about Massachusetts residents — including customer data, employee data, and patient data — are subject to the regulation.

Under 201 CMR 17, personal information means a Massachusetts resident’s first name and last name or first initial and last name in combination with any one or more of the following: Social Security number; driver’s license number or state-issued identification card number; financial account number (with or without required security codes); or medical/health insurance information. Personal information does not include information that is lawfully obtained from publicly available information or from federal, state, or local government records lawfully made available to the general public. The regulation covers personal information in both electronic and paper form.

A 201 CMR 17-compliant WISP must document the scope of the program, the personal information it protects, and the administrative safeguards (including employee training and disciplinary measures), technical safeguards (access controls, encryption, malware protection, monitoring, patch management), and physical safeguards (physical access controls, paper record handling) in place. The WISP must also document third-party service provider requirements, a process for evaluating the program’s continued effectiveness, and breach response procedures. The WISP must be written, maintained, and updated as business circumstances change. Regulators reviewing the WISP expect to see specific, operational controls described — not vague aspirational language.

Massachusetts 201 CMR 17 mandates the following technical controls: secure user authentication practices including password management; restriction of access to personal information to those with a legitimate business need; encryption of personal information stored on laptops and portable devices; encryption of personal information transmitted wirelessly or over public networks; reasonable monitoring for unauthorized access; up-to-date firewall protection for systems containing personal information; up-to-date software security patches; up-to-date malware protection; and education of employees about security. These controls are mandatory — the regulation does not permit risk-based decisions to forgo encryption of laptop-stored personal information, for example.

Encryption is one of the most explicit and unambiguous requirements of 201 CMR 17. The regulation specifically requires encryption of personal information stored on laptops or other portable devices and encryption of personal information transmitted wirelessly or across public networks. Unlike some federal regulations where encryption is an addressable safeguard subject to risk analysis, the Massachusetts requirement is categorical. A business that allows employee laptops to contain personal information without full disk encryption, or that transmits personal information over the internet without TLS encryption, is in direct violation of 201 CMR 17 — and a breach involving such data would trigger both notification obligations and regulatory scrutiny of the encryption failure.

The Massachusetts Attorney General enforces 201 CMR 17 under the Massachusetts Consumer Protection Act (Chapter 93A). Violations may result in civil penalties of up to $5,000 per violation under Chapter 93A, with each affected consumer potentially constituting a separate violation. Willful or knowing violations may result in double or triple damages. The AG may also seek injunctive relief requiring implementation of compliant security measures. Following a data breach, investigations typically examine whether the breached business maintained a compliant WISP, whether encryption was in place for the affected data, whether employee training had been conducted, and whether third-party vendors had appropriate security obligations in their contracts. Gaps in any of these areas become leverage for enforcement.

Triton Technologies provides end-to-end MA 201 CMR 17 compliance services for businesses across Connecticut, New York, Rhode Island, and Massachusetts. We begin with a gap assessment to identify all personal information of Massachusetts residents in your environment and measure your current security program against 201 CMR 17 requirements. We then build the complete compliance program: a custom Written Information Security Program, role-specific employee training with documentation, access control implementation (role-based access, password policies, MFA for remote access), laptop and portable device encryption, network security and patch management, third-party vendor contract review and remediation, and a breach response plan. Ongoing compliance management keeps your program current as your business and the regulatory environment evolve.