Massachusetts 201 CMR 17.00 (Standards for the Protection of Personal Information)
Massachusetts data security regulation requiring a written information security program (WISP) protecting personal information of MA residents, with specific technical requirements.
Primary source
201 CMR 17.00 — Massachusetts Office of Consumer Affairs →https://www.mass.gov/regulations/201-CMR-17-standards-for-the-protection-of-personal-information-of-residents-of-the
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
201 CMR 17.00 — Massachusetts' Standards for the Protection of Personal Information of Residents of the Commonwealth — applies to any person or entity owning or licensing personal information of a Massachusetts resident.
Required Written Information Security Program (WISP) elements:
- Designating one or more employees to maintain the WISP.
- Identifying and assessing reasonably foreseeable internal and external risks.
- Implementing reasonable safeguards (administrative, technical, physical).
- Regular monitoring of safeguards' effectiveness.
- Disciplinary measures for violations.
- Preventing terminated employees from accessing personal information.
- Imposing the program on third-party service providers and verifying they have appropriate safeguards.
Required computer system security elements (17.04): user authentication; secure access control; encryption of all transmitted personal information that will travel across public networks or wirelessly; reasonable monitoring of systems for unauthorized use or access; encryption of personal information stored on laptops or other portable devices; firewall protection and operating system patching; reasonably up-to-date system security agent software including malware protection; education and training of employees.
The encryption-on-portable-devices requirement is notably strict — applicable regardless of risk analysis. MA-domiciled practices and any practice holding MA-resident records must verify WISP coverage of every laptop, USB device, and portable storage medium.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationConnecticut Data Privacy Act (CTDPA, Public Act 22-15)Connecticut comprehensive consumer data privacy law with consumer rights, controller/processor obligations, and an AG enforcement framework — with substantial healthcare carve-outs.
- RegulationNew York SHIELD Act (Stop Hacks and Improve Electronic Data Security Act, N.Y. Gen. Bus. Law § 899-bb)New York data breach and information security law requiring reasonable administrative, technical, and physical safeguards for private information of NY residents, with expanded breach notification.
- RegulationHIPAA Security Rule: General Rules (45 CFR 164.306)Required objectives — confidentiality, integrity, and availability of ePHI — plus the flexibility provisions that govern how covered entities select and implement specific safeguards.
- ComplianceMassachusetts 201 CMR 17.00 for Healthcare: The Written Information Security ProgramMassachusetts 201 CMR 17.00 vs HIPAA for medical practices: mandatory WISP, encryption requirements, M.G.L. c. 93H breach notice, 93A private right of action.
- StateAlaska healthcare compliance overlayAlaska has no state-specific medical-information privacy statute beyond HIPAA, and no health-data-only breach rule.
- StateAlabama healthcare compliance overlayAlabama was the last U.
- StateArkansas healthcare compliance overlayArkansas's Personal Information Protection Act adds 'medical information' to the categories triggering breach notification but does not impose health-information-specific privacy rules beyond HIPAA.
- StateArizona healthcare compliance overlayArizona broadened its breach statute in 2018 to add medical information, health insurance identifiers, biometric data, and online credentials.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.