House Bill 1197 Signed Into Law by Governor Daniels

As expected, Governor Daniels signed the revised version of HB 1197 into law Tuesday, March 25, 2008.

The bill amends Indiana's existing security breach notification law by eliminating the exception to public reporting of security breaches involving remote electronic devices that are "password protected."   Under the new law, an organization that discovers unauthorized access to a remote electronic device containing an Indiana resident's first and last name, or first initial and last name, coupled with the individual's unredacted credit card number, drivers' license number or Social Security number, must report the breach to each affected individual unless the information was "encrypted."   Indiana was the only state of the 40 states that have passed security breach notification laws to offer the password protection exception. 

Prior versions of the bill also contained a requirement for the Indiana Attorney General's Office to post all security breaches involving Indiana residents.   That part has been eliminated.  Unfortunately, however, the bill still contains a July 1, 2008, enforcement date.  Despite vigorous resistance to this very short time frame, the bill's sponsor, Representative Matt Pierce (Bloomington), remains convinced that most Indiana businesses already encrypt remote devices (which is certainly not the case), and that those that do not can easily do so in time to meet the deadline.

In the last few years, encryption has become much easier from an IT perspective, but remains challenging and time-consuming from an operational perspective - especially in large organizations.   Nevertheless, given the alternative - i.e., public reporting of a security breach for every non-encrypted laptop or other remote electronic device that exposes an Indiana resident's name in connection with credit card or Social Security number - it is certainly worthwhile to proceed with encryption.  Currently, about 50 percent of all publicized security breaches involve lost, stolen or improperly accessed remote devices. 

To view the version of the bill that was brought to Governor Daniels for signature, please click here.