Skip to main content

Standards and Frameworks

Updated Jan 30, 2024 ·

HIPAA​

HIPAA, or the Insurance Portability and Accountability Act, is a U.S. law regulating the protection of patient health information.

  • It sets rules for healthcare providers, insurers, and other entities on handling and sharing medical data to ensure patient privacy.
  • Includes the Privacy Rule for patient rights and the Security Rule for data protection safeguards.
  • Violating HIPAA can lead to severe penalties, including fines and criminal charges.

PCI DSS​

The Payment Card Industry Data Security Standard (PCI DSS) is a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment. PCI DSS was developed by the Payment Card Industry Security Standards Council (PCI SSC) to protect cardholder data and reduce credit card fraud.

  • Applies to any organization handling, processing, or storing cardholder information.
  • Requires measures like encryption, access controls, and security assessments to prevent data breaches.
  • Non-compliance can lead to fines, penalties, or loss of the right to process card payments.

FERPA​

The Family Educational Rights and Privacy Act (FERPA), enacted in 1974, is a federal law designed to protect the privacy of student education records. FERPA applies to all educational institutions that receive federal funding, including schools and universities.

  • Privacy Protection: Safeguards personally identifiable information in student records.
  • Rights to Access: Grants parents and eligible students rights to access and amend educational records.
  • Disclosure Restrictions: Limits disclosure of student information without consent, with exceptions for certain authorized parties.
  • Compliance Oversight: Regulated and enforced by the U.S. Department of Education to ensure adherence by educational institutions.

GLBA​

The Gramm-Leach-Bliley Act (GLBA), enacted in 1999, is a significant United States federal law that addresses consumer data privacy and security within the financial sector. It aims to protect personal financial information held by financial institutions, including banks, securities firms, insurance companies, and other financial service providers.

  • Requires financial institutions to disclose data privacy practices to customers.
  • A specific individual needs to be designated as a security office resposible for information security.
  • Defines and protects nonpublic personal information of consumers.
  • Regulated by federal agencies like the Federal Trade Commission (FTC) to enforce adherence.

COPPA​

The Children's Online Privacy Protection Act (COPPA), enacted in 1998 and revised in 2013, is a United States federal law designed to protect the online privacy of children under 13 years of age. COPPA addresses concerns over how personal information collected online from children is used and disclosed.

  • Requires operators to provide notice of their privacy practices and obtain parental consent for data collection.
  • Grants parents control over their children's online activities and access to their personal information.
  • Restricts the sharing of children's personal information without parental consent.
  • Regulated and enforced by the Federal Trade Commission (FTC) to ensure adherence by online services and websites directed at children.

Privacy Act of 1974​

The Privacy Act of 1974 is a United States federal law that establishes safeguards for protecting the privacy of personal information collected by federal agencies. It aims to balance the government's need to maintain information about individuals with the rights of individuals to be protected against unwarranted invasions of their privacy.

  • Requires federal agencies to maintain accurate, relevant, timely, and complete records to ensure fairness to individuals.
  • Grants individuals the right to access their own records and request amendments to correct inaccuracies.
  • Prohibits disclosure of personal information without consent unless authorized by law.
  • Regulated by the U.S. Department of Justice and other federal agencies to ensure compliance and protect individuals' privacy rights.

EU Data Protection Provisions​

In the European Union (EU), data protection provisions are governed by the General Data Protection Regulation (GDPR), which sets a high standard for privacy and security of personal data. The GDPR applies to all organizations processing the personal data of individuals residing in the EU, regardless of the organization's location.

  1. Personal data must be processed lawfully, fairly, and transparently.

  2. Personal data must be collected for specified, explicit, and legitimate purposes.

  3. Personal data must be adequate, relevant, and limited to what is necessary.

  4. Personal data must be accurate, updated as necessary, and corrected without delay.

  5. Personal data should be kept for no longer than necessary for the purposes.

  6. Personal data must be processed securely, including protection against unauthorized or unlawful processing, and against accidental loss, destruction, or damage.

GDPR​

The General Data Protection Regulation (GDPR) is a strict EU law governing the collection and handling of personal data.

  • Gives EU residents rights over their data, like access, correction, deletion, and data use restrictions.
  • Organizations must implement strong data protection and report data breaches within 72 hours.
  • Violating GDPR can result in heavy fines, up to 4% of global revenue or €20 million.