Massachusetts has recently become the first state to mandate that those storing personal information of residents of Massachusetts comply with specific security practices as required under 201 CMR § 17.00. These standards go into effect on January 1, 2010. The following is an analysis of how the Massachusetts legislation lines up with the existing HIPAA security standards that are described in detail in 45 CFR § 164 as promulgated in 2003 and effective in 2005.??