Compliance: the records rules that reach office printing and copying

Where a copier, printer or scanner touches personal records, a few state rules apply. This page is orientation, not legal advice, and it points to the text to read.

Which records a copier or scanner can put at risk

Massachusetts sets a written security standard for personal information about its residents. It applies to a business wherever the business is located, and it has no size cutoff, so a small office holding that information falls inside it.

201 CMR 17.00 applies to all persons that own or license personal information about a resident of the Commonwealth.

Massachusetts regulation, 201 CMR, section 17.01, Purpose and Scope

Read the rule text itself, and take the questions it raises to a lawyer or an accountant who knows your office.

Three figures behind the Massachusetts rule

201 CMR 17.00: The Massachusetts data security regulation. It applies to every person that owns or licenses personal information about a resident, with no size cutoff.
3: The identifiers that, paired with a resident's first and last name, make a record personal information under 201 CMR 17.02: a Social Security number, a driver's license or state ID number, and a financial account or credit or debit card number.
2: State breach-notice rules this page covers, for Massachusetts and for New Hampshire, each with its own notice duties.

Scans, forms and held jobs that carry personal details

A scan to a folder, a scan to email or a held print job can carry a form with a name and a Social Security number on it. Under 201 CMR 17.02 that pairing is personal information, so the stored or sent file is what the rule reaches. What the machine itself keeps is covered on the security page.

A closed multifunction printer with its document feeder and control panel, beside an orange cabinet — A multifunction printer of the kind that scans to a folder or to email.

A dental office receptionist taking a printed form from the output tray of a multifunction printer at a front desk — A printed form leaves the output tray at a front desk. Forms like this can carry a name and an identifier, and that is when the rule applies.

Putting the rules to work, in order

First, list the records the office keeps that pair a name with a Social Security number, a driver's license or state ID number, or a financial account or card number. Include copies and scans of forms, ID cards, payroll and invoices, because those stored scans are what the rule reaches. Second, note every place a copier, printer or scanner prints, scans or sends one of those records. The copier's own drive is covered on the security page, so keep a separate note for it.

Third, check that the office's written information security program covers its machines, as 201 CMR 17.03 requires, and that any dealer or service vendor with access to personal information is bound by contract to keep appropriate security measures. Fourth, confirm that records sent across public networks are encrypted, as 201 CMR 17.04 requires. If a breach happens, Massachusetts requires notice under General Laws chapter 93H, section 3, as soon as practicable and without unreasonable delay. New Hampshire requires notice under RSA 359-C:20 as soon as possible, and to the New Hampshire attorney general's office unless a regulator of the business covers the breach.

This page does not say that any provider is compliant, and it leaves what the machine itself stores and exposes to the security page.