Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<p>North Dakota has amended its Notice of Security Breach for Personal Information statute, <a href="http://www.legis.nd.gov/cencode/t51c30.pdf?20130929152020">North Dakota Century Code Section 51-30 et seq.</a>, to expand the definition of &nbsp;&ldquo;personal information&rdquo; to include &ldquo;medical information&rdquo; and health insurance information.&rdquo;&nbsp; Pursuant to the amended statute, &ldquo;medical information&rdquo; includes any information regarding an individual&rsquo;s medical history, mental or physical condition, or medical treatment or diagnosis by a health care professional.&nbsp; &ldquo;Health Insurance Information&rdquo; is defined as an individual&rsquo;s health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual.&nbsp; The amended statute also includes a carve out for covered entities, business associates, or subcontractors subject to breach notification obligations under HIPAA/HITECH.&nbsp; The amended statute took effect on August 1, 2013.&nbsp;</p>
<p>Prior to the amendment, North Dakota was already a state with a breach notification statute that defines personal information more broadly than an individual&rsquo;s first name or first initial and last name plus one of the following data elements:&nbsp; Social Security number; driver&rsquo;s license number or state issued ID card number; an account, credit card number or debit card number combined with security code, access code, PIN or password needed to access an account.&nbsp; Also included in North Dakota&rsquo;s data breach statute&rsquo;s definition of personal information are an individual&rsquo;s date of birth, mother&rsquo;s maiden name, employee identification number, and electronic signature.</p>

North Dakota Breach Notification Law – Personal Information Includes Health Information