What is “Sensitive Personal Information” Under the Texas Data Breach Notification Law?
“Sensitive Personal Information” is defined as an individual’s first name or first initial and last name in combination with any one (or more) of the following items:
◈ Social Security Number;
◈ Driver license number or government-issued ID number;
◈ Bank account number;
◈ Credit or debit card number; or
◈ The security codes of those credit or debit cards.
“Sensitive Personal Information” also includes information that identifies an individual and relates to:
◈ The physical or mental health or condition of the individual
◈ The provision of health care to the individual
◈ Payment for the provision of health care to the individual
The definition of sensitive personal information under the Texas data breach notification law is essentially the same as the definition of PHI under HIPAA – personally identifiable information, combined with information relating to a person’s health status; healthcare they have received, are receiving, or will receive; or healthcare payment.
Under the Texas data breach notification law, businesses must implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect sensitive personal information from unlawful use or disclosure.
What is a Data Breach Under the Texas Data Breach Notification Law?
A data breach is defined by the Texas data breach notification law as “an unauthorized acquisition of computerized data,” that compromises the “security, confidentiality, or integrity” of sensitive personal Information.
Under the Texas data breach notification law, an entity must disclose any breach of system security, after discovering or receiving notification of the breach. Disclosure must be made to any individual whose sensitive PI was, or is reasonably believed to have been, acquired by an unauthorized person. The disclosure must be made without unreasonable delay, and, in any event, no later than the 60 days after determining that a breach occurred.
There is an additional requirement for those entities required to provide notification of a data breach of at least 250 Texas residents. These entities must notify the Texas Attorney General of the breach no later than 60 days after determining a breach has occurred. The notification must contain the following language:
◈ A detailed description of the nature and circumstances of the breach or the use of sensitive personal information acquired as a result of the breach;
◈ The number of Texas residents affected by the breach at the time of notification;
◈ The measures taken by the entity regarding the breach;
◈ Any measures the entity intends to take regarding the breach after notification; and
◈ Information regarding whether law enforcement is investigating the breach.
If an entity is required to notify, at one time, more than 10,000 individuals of a breach, the entity must also notify all consumer reporting agencies of the timing, distribution, and content of the notices. The notification to consumer reporting agencies must be made “without unreasonable delay.”