The Alabama Data Breach Notification Act of 2018

On June 1, 2018, any person or business that acquires or uses personally identifiable information of an Alabama resident, or contracts to maintain, store, process or access such information, may be subject to The Alabama Data Breach Notification Act of 2018. On March 28, Alabama, following unanimous vote of the house and senate, became the 50^th state to enact legislation to protect the data of its residents. The time taken to structure the legislation resulted in a stringent Act that addresses current cybersecurity threats, such as hacking events that circumvent encryption technologies. For a healthcare provider or vendor, the Act is comparable to HIPAA and provides a HIPAA safeharbor for HIPAA compliant organizations.

Provision	Alabama	HIPAA
Who is regulated: Covered Entity	person, sole proprietorship, partnership, government entity, corporation, nonprofit, trust, estate, cooperative association or other business entity that acquires or uses sensitive personally identifying information	Health plan, healthcare clearinghouse or healthcare provider transmitting HIPAA transaction
Who is regulated: Third Party Agent vs. Business Associate	entity that has contracted to maintain, store, process, or otherwise access sensitive personally identifying information when providing services to covered entity	Person, other than workforce, , that creates, receives, maintains or transmits PHI for covered entity
Who is protected	Alabama residents	Individual whose PHI is created, received, maintained or transmitted
What is protected	Sensitive personally identifiable information: first name or initial and last name plus non-truncated SSI, tax ID, state or government issued ID, financial account information with access information, and any information regarding an individual's medical history, condition, treatment or diagnosis; health insurance policy number or ID number and unique insurer ID; name or email plus password or security question and answer to enable access to a covered entity account.	PHI: individually identifiable health information, including demographics, created or received that relates to the past, present, or future health condition, treatment or payment
	Electronic or digital, including tapes or storage devices	Electronic, paper or other
What is a Breach	Unauthorized acquisition with limited exceptions including good faith of covered entity employee and law enforcement	Acquisition, access, use or disclosure of PHI not permitted by the Privacy Rule which compromises the security or privacy of PHI; some limited exceptions
Breach Risk Assessment	Information was actually acquired or reasonably believed to be acquired and the breach is reasonably likely to cause substantial harm to individuals; consider if the information in the physical control of another (lost/stolen device); downloaded or copied; unauthorized use (accounts opened/identity theft reported) or information made public	Consider if there is a low probability of risk to PHI: (1) nature and extent of PHI; (2) unauthorized person who used or to whom disclosure was made; (3) was it actually acquired or viewed; (4) extent of mitigation
Encryption Safeharbor	Yes but not if the encryption key or code is compromised	Yes; but HHS guidance notes that encryption is not a safeharbor when unauthorized access circumvents the encryption level
How is it protected?
HIPAA Safeharbor	Compliance with HIPAA and notice for ≥1000
Security Measures	Security officer, risk assessment and identification, and adoption and assessment of safeguards to address risks	HIPAA Security Rule
Security Risk Assessment	Identify internal and external risks	HIPAA Security Rule
Contracts	contracts with service providers requiring appropriate safeguards; CE may contract with 3^rd Party regarding breach notice obligations	BAAs
Management Reports	Informing management and board of overall security measures	None but OIG guidance recommends similar action
Disposal	Reasonable measures to dispose of records in custody or control	HIPAA Security Rule
Notice	Individuals; if ≥ 1000, notice to Attorney General and consumer reporting agencies; substitute notice allowed	Individuals; if ≥ 500, notice to HHS and media; substitute notice allowed
Covered Entity Timing	As expeditiously as possible if at CE; within 45 if at 3^rd Party	Within 60 days; HHS considers this the outer limit and possibly inadequate in some circumstances
Business Associate Timing	Notice to Covered Entity as expeditiously as possible after determination of breach or reason to believe breach occurred but no later than 10 days	Within 60 days; HHS considers this the outer limit and inadequate in some circumstances
Penalty/Fine	Unlawful trade practice; civil penalties; no criminal penalty (max. $500,000/breach); $5000/day for delayed notice	Civil and criminal fines and penalties
	Covered entity and 3^rd party liability	Covered entity and business associate liability
	Attorney General representative action	U.S. Attorney General restitution to victims
	No private right of action	No private right of action