PTIN renewal season is here. Make sure your WISP documentation is current before you complete your renewal attestation.

Check your readiness
Free Readiness Check
Home Massachusetts

Massachusetts

The obligation almost nobody sells against

Massachusetts requires a written information security program from every person who holds a resident's personal information. There is no employee count threshold and no revenue floor. A one-person firm with one Massachusetts client is in scope.

“201 CMR 17.00 applies to all persons that own or license personal information about a resident of the Commonwealth.” 201 CMR 17.01(2), Scope

What counts as personal information

A Massachusetts resident's name, first initial and last name or first and last name, combined with any one of the following:

  • Social Security number
  • Driver's license number or state-issued identification card number
  • Financial account number, or credit or debit card number, with any access credential that would permit access to the account

If you prepare a Massachusetts resident's tax return, you hold the first of these. The question of whether the regulation applies to you is usually not close.

201 CMR 17.02 Definitions

The program

Ten elements your written program must contain

Comprehensive information security program

201 CMR 17.03(2)(a) through (j)

17.03(2)(a)Designated employeeOne or more employees named to maintain the program.
17.03(2)(b)Risk identification and assessmentIncluding ongoing employee training, employee compliance with policies, and means for detecting and preventing security failures.
17.03(2)(c)Policies for records off premisesStorage, access, and transportation of records containing personal information outside business premises.
17.03(2)(d)Disciplinary measuresStated consequences for violations of the program rules.
17.03(2)(e)Terminated employee accessPrevention of access by former employees to records containing personal information.
17.03(2)(f)Service provider oversightTaking reasonable steps to select providers capable of maintaining appropriate safeguards, and requiring those safeguards by contract.
17.03(2)(g)Physical access restrictionsReasonable restrictions on physical access to records, and storage in locked facilities, cabinets, or containers.
17.03(2)(h)Regular monitoringMonitoring to ensure the program is operating in a manner reasonably calculated to prevent unauthorized access, and upgrading safeguards as needed.
17.03(2)(i)Annual reviewReviewing the scope of the security measures at least annually, or whenever there is a material change in business practices that may reasonably implicate the security or integrity of records.
17.03(2)(j)Post-incident documentationDocumenting responsive actions taken in connection with any breach of security, and conducting a mandatory post-incident review of events and actions taken.

The controls

Eight computer system security requirements

To the extent technically feasible, these are the controls the regulation names.

Computer system security requirements

201 CMR 17.04(1) through (8)

17.04(1)Secure user authentication protocolsControl of user IDs, a reasonably secure method of assigning and selecting passwords, control of data security passwords, restriction of access to active users, and lockout after multiple unsuccessful attempts.
17.04(2)Secure access control measuresAccess restricted to those who need it to perform their jobs, with unique identifications and reasonably designed passwords.
17.04(3)Encryption in transitEncryption of all transmitted records containing personal information that travel across public networks, and of all data transmitted wirelessly.
17.04(4)MonitoringReasonable monitoring of systems for unauthorized use of or access to personal information.
17.04(5)Encryption on portable devicesEncryption of all personal information stored on laptops or other portable devices.
17.04(6)Firewall protection and patchingReasonably up-to-date firewall protection and operating system security patches for systems containing personal information that are connected to the internet.
17.04(7)Security agent softwareReasonably up-to-date versions of system security agent software including malware protection, with current patches and virus definitions.
17.04(8)Education and trainingEducation and training of employees on the proper use of the computer security system and the importance of personal information security.

What else Massachusetts law puts on you

Breach notification

Chapter 93H requires notice to the Attorney General, to the Director of Consumer Affairs and Business Regulation, and to the affected resident.

M.G.L. c. 93H

Secure destruction

Chapter 93I governs the disposal of records containing personal information, in both paper and electronic form.

M.G.L. c. 93I

Consumer protection exposure

Failures can be pursued under Chapter 93A. In the business-to-business provision, a willful or knowing violation carries two to three times damages and an award of attorney's fees to the prevailing party.

M.G.L. c. 93A §§ 9, 11

Vendor flow-down

Because 17.03(2)(f) requires you to impose safeguards on your service providers by contract, your own clients and referral partners are required to impose them on you.

201 CMR 17.03(2)(f)

Correct a common assumption

Massachusetts does not currently have a comprehensive consumer privacy law of the California type. The Massachusetts Data Privacy Act has moved through both chambers and, as of the last date this page was reviewed, had not been enacted. Do not plan against a statute that is not law, and do not let anyone sell you compliance with one. The operative duties today are 201 CMR 17.00 and Chapters 93H and 93I.

Legislative status changes. Confirm the current position with Massachusetts counsel before relying on this paragraph.

How ProtPTX handles it

One intake, two regimes, one document set

You answer the intake once. ProtPTX maps your answers against the federal elements and the Massachusetts elements at the same time, and generates a single program that satisfies both, with each clause labeled by the provision it addresses.

Dual mapping

Every clause tagged to 16 CFR 314.4 and to 201 CMR 17.03 or 17.04, so you can produce either view on demand.

The annual review, as a document

17.03(2)(i) requires a review at least annually or on material change. ProtPTX produces it as a dated, signed artifact rather than a calendar alert.

Material change detection

New vendor, new office, new remote worker, new AI tool. Each one is a trigger under 17.03(2)(i), and each one opens an action rather than passing unnoticed.

Run the Massachusetts checklist against your firm

The free assessment covers all ten program elements and all eight computer security controls, alongside the federal requirements. Most firms have never seen this list applied to themselves.

Free WISP Readiness CheckTalk to a specialist