Creating a Compliant WISP (Written Information Security Program) for Massachusetts Businesses

In an era of constant cyberattacks, protecting consumer data is no longer optional. Massachusetts has implemented some of the most aggressive data privacy regulations in the country. If your business collects a customer's name combined with their Social Security number, driver's license, or financial account details, you are legally required to have a Comprehensive Written Information Security Program (WISP). Browsing our directory to find a Massachusetts corporate compliance attorney can help you draft this mandatory document and shield your business from catastrophic state penalties.

What is the Massachusetts WISP Law? (201 CMR 17.00)

The regulations are governed by Standards for the Protection of Personal Information, 201 CMR 17.00. This law applies to every person or business that owns, licenses, stores, or maintains personal information about a Massachusetts resident. It does not matter if your company is a massive corporation in Boston or a two-person startup in Quincy; if you have sensitive data, you must have a WISP. The law mandates that your business must develop, implement, and maintain a comprehensive, written security program that contains both administrative and technical safeguards to protect this data.

How Different Businesses Must Comply

The law states that a WISP must be appropriate to the size and scope of your business. A massive hospital needs a different program than a small bookstore.

CPA & Accounting Firms

Accounting and tax preparation firms handle the most sensitive data imaginable: Social Security numbers and unencrypted tax returns. For CPAs, a WISP must include strict protocols for encrypting laptops, securely shredding physical paper files, and ensuring that temporary tax-season workers do not have unauthorized access to the main client database.

Healthcare & Dental Providers (HIPAA Overlap)

Medical offices already comply with federal HIPAA regulations, but they must also comply with Massachusetts law. Fortunately, 201 CMR 17.00 allows healthcare providers to integrate their HIPAA security protocols into their WISP. However, dentists and doctors must ensure their WISP specifically names a designated security coordinator and addresses how they audit third-party vendors (like medical billing companies) to ensure those vendors also protect patient data.

Retail Shops & E-Commerce

Retailers frequently store customer credit card information or loyalty program data. A retail WISP must heavily focus on Point-of-Sale (POS) security. This includes mandatory rules prohibiting cashiers from writing down credit card numbers, ensuring public Wi-Fi is separated from the network used for transactions, and implementing strict password changes for all employee computer terminals.

Mandatory Elements of a Compliant WISP

An attorney will draft a WISP specifically tailored to your business, but the state requires every policy to include certain elements:

• Designated Coordinator: You must name a specific employee responsible for maintaining the WISP.
• Vendor Management: You must take reasonable steps to verify that your third-party service providers have the capacity to protect the personal information you share with them.
• Employee Training: You must have a written policy for training employees on data security and disciplinary measures for those who violate the rules.
• Device Encryption: Any laptops, flash drives, or mobile devices containing personal data that travel outside the physical office must be fully encrypted.

Fines and Legal Liability for Data Breaches

If your business is hacked or an employee loses a company laptop, you are required under the Massachusetts Security Breaches Law, Mass. Gen. Laws ch. 93H, § 3 to notify the Office of Consumer Affairs and Business Regulation, Boston and the Massachusetts Attorney General's Office, Data Privacy and Security Division, Boston. You must file a Online Form - New Data Breach Notification Submissions, Massachusetts, Office of Consumer Affairs and Business Regulation, Data Breach Notification.

When the Attorney General investigates the breach, their first question will be: 'Show us your WISP.' If you do not have one, or if you failed to follow it, the state can sue your business under the Mass. Gen. Laws ch. 93A, § 4. Fines can reach $5,000 per violation (per customer affected). For a database of 1,000 customers, your business could face millions in penalties.

Steps to Draft and Implement Your Policy

Drafting a WISP is not just about printing a template off the internet. Follow these steps:

• Step 1: Data Audit. Identify exactly what personal data you collect, where it is stored (cloud, filing cabinets), and who has access to it.
• Step 2: Hire an Attorney and IT Firm. Have a lawyer draft the administrative side (policies, employee agreements) while an IT professional handles the technical side (firewalls, encryption).
• Step 3: Train Your Staff. The WISP is useless if your employees do not know about it. Have every employee sign an acknowledgment form stating they have read and understood the security protocols.
• Step 4: Annual Review. The state requires you to review and update your WISP at least once a year, or whenever there is a major change in your business practices.

Frequently Asked Questions (FAQ)