AUTHOR'S / SPONSOR'S STATEMENT OF INTENT
H.B. 300, 82nd Legislature, Regular Session, 2011, enhanced the protection of personal health information. Unfortunately, certain provisions have resulted in unintended consequences. Any person who handles personal health information must be aware of the breach notification laws of every state and any potential changes to them. This creates a substantial and unnecessary administrative burden on professionals who handle personal health information in Texas.
S.B. 1610 clarifies that Texans must comply with Texas breach notification laws when notifying persons of a breach of personal health information. The bill eliminates the need for every person who handles personal health information to monitor the legislative developments of other states. It further clarifies that when providing written notice, that notice may be provided at the last known address of the individual.
As proposed, S.B. 1610 amends current law relating to the notification of individuals following a breach of security of computerized data.
RULEMAKING AUTHORITY
This bill does not expressly grant any additional rulemaking authority to a state officer, institution, or agency.
SECTION BY SECTION ANALYSIS
SECTION 1. Amends Section 521.053(e), Business & Commerce Code, to authorize a person to give notice as required by Subsection (b) (relating to requiring a person who conducts business and owns computer data to disclose any breach of system security) or (c) (relating to requiring any person who maintains computerized data that includes sensitive personal information not owned by the person to report upon discovering a breach) by providing written notice at the last known address of the individual.
SECTION 2. Repealer: Section 521.053(b-1) (relating to an individual whose sensitive personal information was acquired by an unauthorized person), Business & Commerce Code.
SECTION 3. Effective date: upon passage or September 1, 2013.