The Terms and the Map

Every argument about privacy law turns on a definition. Whether a company has to send letters after a hack depends on what the state calls "personal information." Whether a health app has to answer to HHS depends on whether it is a "covered entity." Whether you can stop a website from passing your browsing history to an ad network depends on whether the transfer is a "sale," a "share" or "targeted advertising" under your state's law. This lesson builds the map first, then goes term by term, quoting the definitions where the wording decides the outcome.

How U.S. privacy law is built

Europe has one general data protection law. The United States never passed one. Congress has instead written laws as problems surfaced, and each one is fenced to a sector, a kind of data or a kind of organization. Credit reports got the Fair Credit Reporting Act in 1970. Federal agency files got the Privacy Act of 1974. Student records got FERPA the same year. Health records got HIPAA in 1996. Children online got COPPA in 1998. Banks and other financial firms got Gramm-Leach-Bliley in 1999. The result is a stack, and the honest first question about any piece of data is which layer, if any, covers it.

Four layers do the work:

• Federal sector laws. HIPAA, GLBA, FCRA, FERPA, COPPA, the Privacy Act, the Driver's Privacy Protection Act, the wiretap and stored communications laws, the TCPA and CAN-SPAM. Each binds a defined group and protects a defined kind of data. Lessons 02 to 07 take them in turn.
• The FTC Act. Section 5 of the FTC Act, 15 U.S.C. 45, declares "unfair or deceptive acts or practices in or affecting commerce" unlawful. The FTC uses it to police broken privacy promises and careless security at almost any business that no other regulator watches. Under Section 45(n), a practice is unfair only if it causes or is likely to cause substantial injury that consumers cannot reasonably avoid and that is not outweighed by benefits to consumers or competition. Lesson 07 covers the FTC's cases.
• State laws. Every state has a breach notice law (lesson 09). A growing list of states have broad consumer privacy laws on the California and Virginia models (lesson 08). Some states add laws for biometrics, health data, student data, data brokers or children. Idaho's statutes are in lesson 10.
• The Constitution. The Fourth Amendment limits searches by government, and courts have read privacy interests into other parts of the Bill of Rights. None of it binds a private company. Police surveillance, warrants and plate readers are covered in Fourth Amendment Basics in the Surveillance and Privacy course, and this course does not repeat them.

Two consequences follow. First, a single company can sit under several layers at once: a pharmacy chain is a HIPAA covered entity for prescriptions, a GLBA financial institution if it offers store credit, a controller under several state privacy laws for its loyalty program, and subject to the FTC for everything else. Second, a lot of personal data sits under no specific law at all. A fitness tracker's step counts, a grocery store's purchase history and a weather app's location trail are not "protected health information," even when they reveal a health condition. That gap is why states have started writing their own health data laws, which lesson 03 covers.

Personal information: one phrase, three meanings

The phrase "personal information" appears in almost every privacy statute, and it rarely means the same thing twice. Compare three.

Idaho's breach law. Idaho Code 28-51-104 defines personal information as an Idaho resident's first name or first initial and last name combined with any one of three data elements, when either the name or the data element is not encrypted: a Social Security number; a driver's license or Idaho identification card number; or an account, credit card or debit card number together with any required security code, access code or password that would permit access to the financial account. Information lawfully made public from government records or widely distributed media is excluded. That is the whole list. A leaked file of names, birth dates and medical diagnoses is outside Idaho's breach law, however much harm it might do.

California's breach law. Civil Code 1798.82(h) starts the same way and keeps going. Name plus a Social Security number; a driver's license, California ID, tax ID, passport, military ID or other government number used to verify identity; an account or card number with its access code; medical information; health insurance information; unique biometric data used to authenticate a person; information from an automated license plate recognition system; or genetic data. It adds a second, name-free category: a username or email address together with a password or security question and answer that would permit access to an online account. The same leaked medical file that slips past Idaho's law triggers California's.

California's consumer privacy law. The CCPA, at Civil Code 1798.140(v), uses the same phrase for something far broader: information that "identifies, relates to, describes, is reasonably capable of being associated with" a consumer or household, followed by a list of examples that runs from identifiers and purchase history to biometric information, geolocation and inferences drawn to build a profile. It excludes lawfully public government records, information the business reasonably believes is lawfully available to the public, and de-identified or aggregate data. Under this definition, an advertising ID tied to a phone is personal information.

Most other state consumer privacy laws use the Virginia wording and call it personal data: "any information that is linked or reasonably linkable to an identified or identifiable natural person," excluding de-identified data and publicly available information (Va. Code 59.1-575). Virginia's "consumer" is a resident acting "only in an individual or household context," which leaves out employees and business contacts. California's consumer is any natural person who is a California resident, so the CCPA reaches employee and business contact data too.

PII in federal government usage

Federal agencies say personally identifiable information, or PII. OMB's breach memo M-17-12 (January 3, 2017) defines it as "information that can be used to distinguish or trace an individual's identity, either alone or when combined with other information that is linked or linkable to a specific individual." M-17-12 rescinded and replaced the older M-07-16 (May 22, 2007), which many textbooks still cite. NIST's guide on protecting PII, SP 800-122, uses a GAO-derived definition that starts with "any information about an individual maintained by an agency," then splits it into information that can distinguish or trace a person and information that is linked or linkable to one, such as medical, educational, financial and employment information. The NIST glossary lists both versions side by side. The point of the federal definition is context: a ZIP code alone rarely identifies anyone, while a ZIP code, birth date and sex together can single out a person.

Sensitive data

State consumer privacy laws carve out a special class that needs extra protection. Virginia's list has four parts: personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; genetic or biometric data processed to identify a person; personal data collected from a known child; and precise geolocation data. Under Va. Code 59.1-578, a controller may not process sensitive data without the consumer's consent, and the current text also bars selling precise geolocation data. California calls it sensitive personal information and lists more: government ID numbers, account log-ins with passwords, precise geolocation, racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership, the contents of mail, email and texts the business is not the intended recipient of, genetic data, biometric processing to identify a person, and information about health, sex life or sexual orientation. California's model differs: consumers get a right to limit the use of sensitive personal information, an opt-out structure, where Virginia and most other states require opt-in consent first.

The sector law vocabulary

Protected health information

HIPAA's definitions sit at 45 CFR 160.103. Protected health information (PHI) is individually identifiable health information that is transmitted or maintained in any form or medium, electronic, paper or oral. Individually identifiable health information is health information, including demographic information, that a provider, health plan, employer or clearinghouse creates or receives, that relates to a person's past, present or future physical or mental health, care or payment for care, and that identifies the person or could reasonably be used to. The definition excludes education records covered by FERPA, employment records a covered entity holds in its role as employer, and information about a person who has been dead more than 50 years. PHI exists only at a covered entity (a health plan, a health care clearinghouse, or a health care provider that transmits health information electronically in a standard transaction such as a claim) or its business associate (a person or company that creates, receives, maintains or transmits PHI on a covered entity's behalf, other than a workforce member). Lesson 03 goes deeper.

Nonpublic personal information

Under the Gramm-Leach-Bliley Act, 15 U.S.C. 6809(4), nonpublic personal information (NPI) is "personally identifiable financial information" that a consumer provides to a financial institution, that results from a transaction or service, or that the institution otherwise obtains. Publicly available information is excluded, but a customer list derived from nonpublic information is included even if each name on it is public. A "financial institution" is any institution whose business is engaging in financial activities as described in the Bank Holding Company Act, which reaches well past banks to lenders, tax preparers, auto dealers that finance and many others. The fact that a person is your customer at all can be NPI.

Education records

FERPA, 20 U.S.C. 1232g(a)(4), defines education records as records, files, documents and other materials that contain information directly related to a student and are maintained by an educational agency or institution or by a person acting for it. Four kinds of records are excluded: a teacher's or administrator's personal notes kept in sole possession; records of a school's law enforcement unit created for law enforcement; ordinary employment records of staff who are not students; and treatment records of students 18 or older or in college made by a doctor or counselor. FERPA also defines directory information, such as name, address, phone listing, dates of attendance and sports participation, which a school may release after notice and a chance to opt out. Lesson 05 covers FERPA.

Consumer report

The Fair Credit Reporting Act's central term, at 15 U.S.C. 1681a(d), is the consumer report: any communication by a consumer reporting agency bearing on a consumer's "credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics, or mode of living," used or expected to be used as a factor in eligibility for personal credit or insurance, for employment, or for another purpose the act authorizes. The definition is about use, not content. A tenant screening report and an employment background check are both consumer reports if a consumer reporting agency prepares them for a third party. Lesson 04 covers FCRA.

Breach, incident and the encryption safe harbor

An incident is the wide term. The federal agency definition in 44 U.S.C. 3552(b)(2), which OMB and NIST repeat, is an occurrence that actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality or availability of information or an information system, or that is a violation or imminent threat of violation of law, security policies, security procedures or acceptable use policies. A phishing email that lands, a laptop left in a cab, a server that goes down after a ransomware note: all incidents.

A breach is a legal conclusion that each law reaches differently.

• Federal agencies (OMB M-17-12): "the loss of control, compromise, unauthorized disclosure, unauthorized acquisition, or any similar occurrence" where someone other than an authorized user accesses or potentially accesses PII, or an authorized user does so for an unauthorized purpose. "Potentially accesses" makes this the broadest definition in common use.
• HIPAA (45 CFR 164.402): "the acquisition, access, use, or disclosure of protected health information in a manner not permitted" by the Privacy Rule "which compromises the security or privacy" of the information. Three exclusions follow: good-faith unintentional access by a workforce member acting within scope; inadvertent disclosure between people authorized at the same organization; and a disclosure where the recipient could not reasonably have kept the information. Anything else is presumed to be a breach unless the covered entity or business associate documents a low probability of compromise after weighing at least four factors: the nature and extent of the PHI, the unauthorized person who received it, whether it was actually acquired or viewed, and how far the risk was mitigated.
• Idaho (28-51-104): "breach of the security of the system" is the illegal acquisition of unencrypted computerized data that materially compromises the security, confidentiality or integrity of personal information. Good-faith acquisition by an employee or agent for the entity's purposes is excluded if the data is not misused or further disclosed. Paper records are outside it.
• FTC Safeguards Rule (16 CFR 314.2(m)): a "notification event" is "acquisition of unencrypted customer information without the authorization of the individual."

Notice the split between acquisition laws (Idaho, the Safeguards Rule, most states) and access laws (HIPAA, and some states covered in lesson 09). Under an acquisition standard, an intruder who could have opened a database but left no trace of copying it is a closer call than under an access standard. Notice also that Idaho builds a harm test into the duty to notify, not into the definition: 28-51-105 requires a prompt, good-faith investigation and notice only if misuse "has occurred or is reasonably likely to occur."

The encryption safe harbor

Almost every breach law exempts encrypted data, and the exemption has a catch about keys. HIPAA does it through the phrase unsecured protected health information: PHI not rendered "unusable, unreadable, or indecipherable to unauthorized persons" by a method the Secretary names in guidance. HHS's guidance names encryption consistent with NIST SP 800-111 for data at rest and NIST SP 800-52, 800-77 or 800-113 (or other FIPS 140-2 validated processes) for data in transit, and destruction of media under NIST SP 800-88. It applies only if the key or decryption process was not compromised, and HHS says keys should be stored apart from the data. California writes the key rule into its statute: encrypted data counts if the key or security credential was, or is reasonably believed to have been, acquired too. The Safeguards Rule, in 16 CFR 314.2(m), treats customer information as unencrypted if the encryption key was accessed by an unauthorized person. An encrypted laptop stolen with the password on a sticky note is not safe harbored.

Who is who: controllers, processors and their cousins

Every privacy law sorts the parties to a data relationship. The labels differ by law and the duties follow the labels.

Law	Party that decides	Party acting for it	Everyone else
Virginia model (most state consumer privacy laws)	Controller: "determines the purpose and means of processing personal data"	Processor: processes personal data "on behalf of a controller"	Third party: anyone other than the consumer, controller, processor or their affiliates
CCPA (California)	Business: a for-profit entity doing business in California that meets a threshold ($25 million gross revenue as adjusted, buys, sells or shares data of 100,000 or more consumers or households, or gets 50 percent of revenue from selling or sharing)	Service provider or contractor, each under a written contract that bars selling, sharing or using the data outside the contract	Third party: anyone who is not the business the consumer interacts with, its service provider or its contractor
HIPAA	Covered entity: health plan, clearinghouse or provider billing electronically	Business associate, under a business associate agreement	Anyone else: a disclosure to them needs a Privacy Rule permission or the patient's authorization
GLBA	Financial institution	Service provider, which the institution must oversee	Nonaffiliated third party, sharing with whom triggers notice and opt-out rights
Idaho breach law	Entity that "owns or licenses" the data	Entity that "maintains" data it does not own	Not defined; the vendor must notify the owner "immediately following discovery"

The label is about role, not size. A three-person payroll company can be a processor for a hundred controllers and a controller for its own employees' data. A hospital is a covered entity for patient records and an ordinary employer for staff files. When a law says "the controller must," check which hat the organization is wearing for the data in front of you.

Consent, opt-out, sale and targeted advertising

Consent in the Virginia-model laws means "a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement," given in writing, electronically or by another unambiguous affirmative action. A pre-checked box or silence is not an affirmative act. Some later state laws spell out further things that do not count as consent, so read the definition in each statute.

The default in most state laws is opt-out for ordinary data and opt-in for sensitive data. A consumer can tell a controller to stop selling personal data, stop using it for targeted advertising, and stop profiling that leads to decisions with legal or similarly significant effects. Sensitive data needs consent before processing begins.

Universal opt-out signals let a browser send the opt-out automatically. California's Attorney General describes the Global Privacy Control as a "stop selling or sharing my data switch" that covered businesses must honor. Colorado's Attorney General says controllers have had to accept opt-outs through recognized universal opt-out mechanisms since July 1, 2024, and named the Global Privacy Control as the state's first. Other states have followed with their own dates; lesson 08 lists them.

Sale is the definition fight that matters most. Virginia's is narrow: "the exchange of personal data for monetary consideration by the controller to a third party," with exclusions for processors, affiliates, data the consumer asked to be disclosed, data the consumer made public, and merger or bankruptcy transfers. California's is wide: making personal information available to a third party "for monetary or other valuable consideration." An ad network that gives a website free analytics in return for the visitor data can be a sale in California and not in Virginia. California added a second term, share, for disclosure to a third party for cross-context behavioral advertising, "whether or not for monetary or other valuable consideration." Virginia reaches the same practice through targeted advertising: ads chosen based on personal data "obtained from that consumer's activities over time and across nonaffiliated websites" or apps. Ads based on the page you are on (contextual ads) and ads based only on activity on the company's own site are excluded.

Data brokers

A data broker buys or gathers personal data about people it has never dealt with and sells it on. The definitions differ in a way that decides who has to register.

• California (Civil Code 1798.99.80, as amended by the Delete Act, SB 362 of 2023): "a business that knowingly collects and sells to third parties the personal information of a consumer with whom the business does not have a direct relationship." Entities covered by FCRA, GLBA or California's insurance privacy act are excluded to the extent covered, as are certain HIPAA-exempt processors.
• Texas (Business and Commerce Code 509.001(4)): the 2023 law (SB 2105) defined a data broker as "a business entity whose principal source of revenue is derived from the collecting, processing, or transferring of personal data that the entity did not collect directly from the individual." SB 2121 of 2025, effective September 1, 2025, rewrote it, according to a WilmerHale summary: a data broker is now "a business entity that collects, processes, or transfers personal data" it did not collect directly from the individual, and the size test moved to 509.003. The chapter applies when, in any 12-month period, the business gets more than 50 percent of its revenue directly from processing or transferring such data, or, per the same summary, gets revenue from such data on more than 50,000 individuals.

The original Texas "principal source of revenue" test exempted a large company that sells data as a side business; the 2025 revenue share and head-count tests narrow that gap. California's test asks only whether the company knowingly sells data about people it has no direct relationship with. Data broker registries and California's deletion platform are in lesson 08, and police purchases of broker data are in Data Brokers and Police Purchases.

De-identified and pseudonymous data

Data that cannot be tied to a person falls outside most privacy laws, so the standard for "cannot be tied" is a gate.

HIPAA offers two routes in 45 CFR 164.514(b). Under expert determination, a person with statistical and scientific expertise concludes and documents that the risk an anticipated recipient could identify anyone is very small. Under the safe harbor, the covered entity removes 18 identifiers of the person and of relatives, employers and household members, and has no actual knowledge that what is left could identify anyone. The 18 include names, geographic units smaller than a state, all date elements except the year (and ages over 89), phone and fax numbers, email addresses, Social Security, medical record, health plan and account numbers, certificate and license numbers, vehicle and device identifiers, URLs, IP addresses, biometric identifiers, full-face photos and any other unique code. The first three digits of a ZIP code may stay only if the area they cover holds more than 20,000 people under current Census data.

State consumer privacy laws use a three-part standard. Virginia's de-identified data is data that "cannot reasonably be linked to an identified or identifiable natural person, or a device linked to such person," and the controller must take reasonable measures to keep it that way, publicly commit not to re-identify it, and bind recipients by contract. California's 1798.140(m) has the same three duties. Pseudonymous data is a middle category: personal data that "cannot be attributed to a specific natural person without the use of additional information," with that additional information kept separately and protected. Pseudonymous data is still personal data. Under Va. Code 59.1-581, the first four consumer rights (to confirm, correct, delete and get a copy) and the controller duties in 59.1-578 do not apply to pseudonymous data if the controller can show the identifying information is kept separately under effective controls that keep the controller itself from reaching it. California's matching verb is "pseudonymize."

Assessments and notice deadlines

A data protection assessment is a written weighing of risks and benefits that a controller must do before certain processing. Va. Code 59.1-580 requires one for targeted advertising, selling personal data, risky profiling, processing sensitive data and any other processing with a heightened risk of harm. The assessment weighs benefits to the controller, the consumer and the public against risks to the consumer, as reduced by safeguards. California's privacy agency has its own risk assessment and cybersecurity audit regulations, covered in lesson 08. HIPAA's version is the security risk analysis (lesson 03).

Notice deadlines come in two styles. Standards like "without unreasonable delay" or Idaho's "in the most expedient time possible and without unreasonable delay" leave the clock to a regulator's judgment. Fixed day counts set an outer limit, and most fixed-count laws still require faster notice when possible.

Law	What triggers it	Deadline	Who is told
Idaho Code 28-51-105	Breach of the security of the system, where misuse has occurred or is reasonably likely	Most expedient time possible, without unreasonable delay; public agencies tell the Idaho Attorney General within 24 hours of discovery	Affected Idaho residents; for agencies, also the AG
California Civil Code 1798.82	Breach of the defined personal information	Within 30 calendar days of discovery or notification, since January 1, 2026 (SB 446), allowing for law enforcement needs and scoping; sample notice to the AG within 15 days of notifying more than 500 residents	Affected California residents; AG
HIPAA, 45 CFR 164.404 to 164.408	Breach of unsecured PHI	Without unreasonable delay and no later than 60 days after discovery; under 500, HHS gets an annual log	Individuals, HHS, media for more than 500 in a state
FTC Safeguards Rule, 16 CFR 314.4(j)	Notification event involving at least 500 consumers	As soon as possible and no later than 30 days after discovery (in effect since May 13, 2024)	The FTC
FTC Health Breach Notification Rule, 16 CFR Part 318	Breach of security of PHR identifiable health information	No later than 60 calendar days after discovery	Individuals, the FTC, media for 500 or more in a state

The big terms table

Term	Where it is defined	The definition in brief	Why it matters
Personal information (breach)	Idaho Code 28-51-104; Cal. Civil Code 1798.82(h)	Name plus a listed data element (Idaho: SSN, license or ID number, account number with code). California adds medical, insurance, biometric, plate reader and genetic data and online credentials	Decides whether a leak triggers letters
Personal information (CCPA)	Cal. Civil Code 1798.140(v)	Information that identifies, relates to or could reasonably be associated with a consumer or household	Decides which data carries CCPA rights
Personal data	Va. Code 59.1-575 and copies	Information linked or reasonably linkable to an identified or identifiable person	The Virginia-model version of the same gate
PII	OMB M-17-12; NIST SP 800-122	Information that can distinguish or trace identity, alone or combined with linkable information	Federal agency security and breach duties
Sensitive data	Va. Code 59.1-575; Cal. 1798.140(ae)	Race, religion, health, sexual orientation, immigration status, genetic and biometric data, child data, precise location (California adds more)	Opt-in consent in most states; right to limit in California
Protected health information	45 CFR 160.103	Individually identifiable health information held by a covered entity or business associate	Turns on HIPAA
Nonpublic personal information	15 U.S.C. 6809(4)	Personally identifiable financial information a financial institution gets from or about a consumer	Turns on GLBA notice, opt-out and safeguards
Education records	20 U.S.C. 1232g(a)(4)	Records directly related to a student maintained by a school or someone acting for it	Turns on FERPA
Consumer report	15 U.S.C. 1681a(d)	A consumer reporting agency's communication used for credit, insurance, employment or another authorized purpose	Turns on FCRA
Incident	44 U.S.C. 3552(b)(2)	An occurrence that jeopardizes confidentiality, integrity or availability, or violates security policy	Starts the investigation clock
Breach	45 CFR 164.402; Idaho 28-51-104; OMB M-17-12	Varies: impermissible use or disclosure of PHI; illegal acquisition of unencrypted data; loss of control of PII	Starts the notice clock
Unsecured PHI	45 CFR 164.402 and HHS guidance	PHI not made unusable by NIST-grade encryption or destruction	Encryption safe harbor for HIPAA
Controller / processor	Va. Code 59.1-575	Decides purpose and means / processes on the controller's behalf	Who owes consumers what
Covered entity / business associate	45 CFR 160.103	Plan, clearinghouse or electronic-billing provider / vendor handling PHI for one	Who HIPAA binds
Service provider / contractor / third party	Cal. 1798.140(ag), (j), (ai)	Contracted processors versus everyone else	Disclosure to a third party can be a sale or share
Consent	Va. Code 59.1-575	A clear affirmative act showing freely given, specific, informed and unambiguous agreement	Required before sensitive data processing
Sale	Va. 59.1-575; Cal. 1798.140(ad)	Virginia: exchange for money. California: for money or other valuable consideration	Opt-out right
Share / targeted advertising	Cal. 1798.140(ah), (k); Va. 59.1-575	Disclosure for, or ads based on, activity across other companies' sites and apps	Opt-out right
Data broker	Cal. 1798.99.80; Tex. Bus. and Com. Code 509.001	Sells data on people it has no direct relationship with (California) / collects, processes or transfers data it did not collect directly, with a revenue share or head-count test since SB 2121 of 2025 (Texas)	Registration and deletion duties
De-identified data	45 CFR 164.514(b); Va. 59.1-575; Cal. 1798.140(m)	Cannot reasonably be linked to a person, with safeguards and public commitments	Falls outside most duties
Pseudonymous data	Va. 59.1-575; Cal. 1798.140(aa)	Cannot be attributed without separately kept extra information	Still personal data, with some rights relaxed
Data protection assessment	Va. Code 59.1-580	Written risk and benefit weighing for high-risk processing	Producible to the attorney general

Questions and answers

Why doesn't the United States just have one privacy law?

Congress has tried. The bills that came closest, covered in lesson 07, stalled over two questions: whether a federal law should override stronger state laws, and whether individuals should be able to sue. Meanwhile each sector law was passed to fix a specific problem, and the agencies that enforce them (HHS, the FTC, the Department of Education, the CFPB) each built their own rules. The stack is what fifty years of patching produced.

Is my name personal information?

Alone, under Idaho's breach law, no: 28-51-104 requires a name plus a listed data element. Under the CCPA and the Virginia-model laws, yes, because a name identifies you. Under federal agency usage, yes, because it can distinguish you. The answer always depends on which law is asking.

My doctor's office uses an outside billing company. Is that company bound by HIPAA?

Yes, as a business associate. 45 CFR 160.103 defines a business associate as a person who creates, receives, maintains or transmits PHI on behalf of a covered entity, and billing is one of the listed functions. The billing company must sign a business associate agreement and follow the Security Rule directly.

What does "reasonably linkable" mean?

It means the data can be tied to a person using means a party could reasonably use, even if no name is attached. A phone's advertising ID, an IP address combined with logs, or a home address plus a car model can all be reasonably linkable. The test is practical, which is why de-identification laws demand safeguards and public commitments, not just removing names.

If a company encrypts everything, does it ever have to notify anyone?

Yes, if the key went with the data, if the data was decrypted while in use (many attacks steal data from running systems where it is readable), or if the law in question covers something besides the encrypted files. HHS's guidance applies the safe harbor only when the key was not compromised, and California and the Safeguards Rule say the same in their text.

Is a hospital's employee file PHI?

No. The definition of PHI excludes "employment records held by a covered entity in its role as employer." A nurse's personnel file is protected by employment law and, in some states, by state privacy law. The nurse's own patient chart at that hospital is PHI.

What is the difference between a sale and targeted advertising?

A sale is a transfer of data to a third party for payment (Virginia) or for anything of value (California). Targeted advertising is a use: picking ads based on what a person did across other companies' sites and apps. A company can do targeted advertising without selling anything, by using its own data, and the Virginia-model laws let consumers opt out of either.

Does a browser privacy signal actually do anything?

In California and Colorado it is legally binding on covered businesses. California's Attorney General says covered businesses must honor the Global Privacy Control as a valid opt-out of sale and sharing. Colorado required controllers to accept recognized universal opt-out mechanisms from July 1, 2024. In states without such a rule, the signal is a request the site may ignore.

Hard questions

Should breach laws use an access standard or an acquisition standard?

Those who favor access argue that once an intruder could read the data, the victim cannot know what was taken, so people deserve notice; HIPAA's presumption of breach rests on that logic in 45 CFR 164.402. Those who favor acquisition argue that notice about data nobody took produces letter fatigue and costs money that could go to security, and that a harm test, like Idaho's "misuse has occurred or is reasonably likely," keeps notices meaningful. The evidence each side relies on is mostly about behavior: how often people act on letters, and how often access without acquisition leads to fraud. Neither has settled it, and states have chosen both ways.

Should "sale" include trades for something other than money?

California says yes: "other valuable consideration" in 1798.140(ad) catches data swaps and free services paid for with data, and the separate "share" term catches ad targeting even with no exchange. Supporters argue that most data flows in online advertising involve no cash per transfer, so a money-only definition misses the practice the law was aimed at. Virginia's money-only definition reflects the opposite view: that a clear line is easier to comply with and enforce, and that targeted advertising can be handled by its own opt-out without stretching "sale." The practical gap between the two narrows because Virginia gives a separate targeted advertising opt-out.

Is the encryption safe harbor too generous?

Supporters say it is the best incentive the law offers: it rewards the single control that most reliably makes stolen data useless, and HHS ties it to specific NIST standards. Skeptics point out that encryption at rest does nothing when attackers steal data from running systems where it is decrypted, and that weak key handling can leave encrypted data readable. The statutes answer part of this by excluding cases where the key was taken. Whether they should also require proof that the data was encrypted at the moment of theft, not just in storage, is an open question.

Should de-identified data be exempt at all?

Researchers and public health agencies argue that de-identified data is how medical research, census work and safety studies get done, and that the HIPAA safe harbor and expert determination methods in 45 CFR 164.514 have supported that work for decades. Privacy advocates point to re-identification studies showing that combinations of ZIP code, birth date and sex can single out many people, and argue that rich data sets can rarely be truly de-identified. The state laws' answer is to pair the exemption with duties: reasonable measures, a public commitment not to re-identify, and contracts binding every recipient.

Should privacy rules turn on who holds the data or on what the data is?

The federal sector model turns on the holder: the same diagnosis is PHI at a clinic and unregulated at an app. Supporters of that model say it fits rules to the industries that already have regulators and avoids burdening everyone. Others argue it leaves the fastest-growing data collectors outside the strongest rules, which is why Washington, Nevada and Connecticut wrote health data laws keyed to the data itself (lesson 03), and why the state consumer privacy laws define sensitive data by content. Both approaches now coexist, and the overlap is where most compliance disputes start.