New Massachusetts regulations effective January 1, 2009, mandate the development of a "written, comprehensive information security program" to safeguard the personal information of Massachusetts employees and consumers. These new regulations represent a new phase in efforts by states to combat identity theft. They should be a wake-up call to employers and their human resources departments to implement policies and procedures to safeguard employees' personal information.