The Smart Path to Compliance

Maryland PIPA (§ 14-3503) requires "reasonable security" for any business that keeps Marylanders' personal information. If you have a breach, the clearest way to show your security was "reasonable" is a written policy from before the event. Without one, that is much harder to prove.

The Insurance Trap: Many General Liability (GL) policies exclude data-breach claims. Cyber policies ask about your security on the application, and a carrier can deny a claim or rescind the policy if those answers turn out to be wrong.

The HIPAA Security Rule already requires a risk analysis and written security policies. HHS has also proposed a major update (published January 6, 2025; not final as of October 2026) that would make nearly all "addressable" safeguards required and require Multi-Factor Authentication (MFA) for systems that hold ePHI. For businesses it covers, Maryland MODPA also limits collecting health data outside HIPAA to what is strictly necessary for a service the patient asked for.

• The "Texting" Trap: A hygienist texts a patient a schedule update from a personal iPhone. The phone is lost at a bar. If it wasn't encrypted, the loss is presumed to be a reportable breach to HHS (OCR). A written BYOD Policy that requires encryption and MDM remote-wipe is how you prevent that.
• The Ransomware Lockout: A front-desk admin clicks a "Invoice Overdue" link. Your patient database is encrypted. Because you didn't have a Testable Data Restoration Plan (HIPAA requirement), you pay the $50k ransom or close for 2 weeks.

Under Maryland MODPA (in force since October 2025), a firm that handles personal data of 35,000 or more Maryland consumers is a "Controller" with legal duties for that data. ABA Formal Opinion 483 imposes an ethical duty to monitor for breaches and notify clients promptly.

• The "Deepfake" Wire: A Partner's voice is cloned using AI (Vishing) to call a paralegal and request an "urgent settlement wire." Without a written Out-of-Band Verification Protocol, the money is gone, and your Malpractice Insurance may deny the claim.
• The Discovery Nightmare: During eDiscovery for a case, opposing counsel requests your firm's Data Retention Policy to prove spoliation wasn't accidental. You don't have one, and the firm faces possible court sanctions.

The FTC Safeguards Rule treats professional tax preparers and accountants as "financial institutions" and requires a written information security plan (WISP). Your PTIN renewal (Form W-12, line 11) asks you to confirm you know that, and the form is signed under penalties of perjury. The requirement comes from the FTC rule (16 CFR 314); IRS Pub 5708 is the IRS's free sample plan.

• The Review: After a data breach, investigators ask to see your written plan. If you don't have one, that gap becomes the problem, right in the middle of tax season.
• The Vendor Breach: Your payroll software gets hacked. The FTC asks for your Vendor Due Diligence Scorecard. You don't have one. The Safeguards Rule requires you to vet and monitor your vendors (16 CFR 314.4(f)), so you are out of compliance.

The FTC Safeguards Rule treats any dealer who facilitates financing as a "Financial Institution." You MUST have a designated Qualified Individual (QI) and a Written Annual Report presented to your owners/board (the annual report is waived if you hold data on fewer than 5,000 consumers). "Shelfware" policies from 2023 won't hold up: the rule requires you to test, monitor and update your program (16 CFR 314.4(d), (g)).

• The Sales Floor Leak: A salesperson snaps a photo of a driver's license and texts it to a lender on their personal phone. That phone is unencrypted. That runs against the Safeguards Rule's encryption requirement and can lead to an FTC investigation.
• The Franchise Audit: Your manufacturer audits your compliance. You can't produce a current Vulnerability Assessment Report. You risk losing your franchise agreement.

Under Maryland PIPA, you must protect the personal information clients give you, such as Social Security and driver's license numbers and financial account numbers with their access codes. Brokerage policies typically cover the Corporate Office, not your specific team's assistants or transaction coordinators. Real estate closings are a favorite target for Business Email Compromise (BEC).

• The $50k Wire: Your assistant's email is spoofed. A client wires closing funds to a hacker. The Brokerage's E&O insurance may deny the claim because your Team lacked a written Wire Fraud Prevention Protocol.
• The "Silent" Breach: A hacker sits in your email for months, scraping contracts. When discovered, you have no Incident Response Plan, you miss the required notice steps, and the Maryland Attorney General's office opens an inquiry.

Maryland's Local Cybersecurity Support Act (2022) requires every local government to report cyber incidents to the State and certify that it meets the State's minimum cybersecurity standards, and requires counties, school systems and health departments to keep a cybersecurity preparedness and response plan. CJIS v6.0 requires strict access logging for anyone touching law enforcement data.

• The FOIA Leak: A clerk fulfills a public records request but accidentally includes unredacted PII (Home addresses of officers). Without a written Redaction Policy, the municipality faces legal exposure.
• The Utility Ransomware: Hackers lock the town's water billing system. You don't have an offline Backup & Recovery Policy. You are forced to pay the ransom with taxpayer money, triggering a state investigation.

PCI-DSS v4.0.1 (all requirements mandatory since March 31, 2025) requires documented "Anti-Skimming" inspections for terminals and script management for e-commerce sites. Your processor only covers the transaction, not your Loyalty Database or employee HR files.

• The Skimmer Attack: A criminal installs a skimmer on your terminal. Banks audit you. Because you didn't have a Terminal Inspection Log (Req 9.5.1.2), you can be held liable for the fraudulent charges.
• The Loyalty Leak: Your loyalty database is hacked. Under MD PIPA, members' names with card numbers and their security codes, or emails with passwords that also open a member's email account, can make it a reportable breach. If your General Liability policy has the standard data-breach exclusion, it pays $0, and without a written plan you can't show your security was reasonable.

Unlike many state privacy laws, Maryland's MODPA does NOT exempt non-profits (it applies once you handle data on 35,000 or more Maryland consumers). And MD PIPA's "Reasonable Security" rule covers non-profits the same as companies whenever you keep donors' personal information, such as names with card numbers and security codes. Attackers target charities because defenses are often thin.

• The Volunteer Theft: A board member leaves but keeps the major donor list on their personal laptop. They start a competing charity. Without a signed Volunteer Acceptable Use Policy, it is much harder to show the data was yours to protect and get it back.
• The Grant Audit: A major federal or private grant requires proof of data stewardship. You have no WISP. You lose the funding.

Supply Chain Risk Management (SCRM) is the new standard. More commercial buyers, not just DoD primes, now ask vendors for a written security plan, often a NIST SP 800-171 aligned "System Security Plan" (SSP). If you can't prove you protect your Intellectual Property (IP), you lose the bid.

• The "Scorecard" Rejection: You bid on a lucrative commercial contract. The prime contractor asks for your written security documentation. You have no written policies. You are disqualified instantly.
• Ransomware on the Floor: A CNC machine controller connected to the Wi-Fi gets infected. Production stops for 10 days. Business Interruption Insurance may deny the claim because you had no Network Segmentation Policy separating OT (Operational Tech) from IT.