Three acronyms come up constantly in conversations about nonprofit data, and they get guessed at just as often. It’s worth knowing which ones actually apply to you, because the answer is usually “more than you’d think,” with one important exception.
PII: almost certainly yes
PII stands for personally identifiable information. It means names combined with anything that identifies a person: an address, a phone number, a date of birth, a donation history.
Essentially every nonprofit holds it, and state breach notification laws attach to it. Virginia has one. If you hold records on people in other states, their laws may apply too. These laws generally require you to notify people, and sometimes regulators, if certain personal information is exposed.
HIPAA: probably narrower than you think
Holding health information doesn’t, by itself, put you under HIPAA. A lot of nonprofits assume it does, and a lot assume the opposite. Both can be wrong.
HIPAA generally applies to a nonprofit in one of two situations:
- You provide health care and bill insurance electronically for it. That makes you what the law calls a covered entity.
- You handle health information on behalf of an organization that is covered, such as a hospital or clinic you provide services to. That makes you what the law calls a business associate, and it catches organizations that assumed they were outside it.
If neither is true, HIPAA generally doesn’t apply to you. That doesn’t make health information less sensitive, and other laws or your grant agreements may still set rules for it. But it does mean you can stop guessing about HIPAA specifically.
If you’re not sure which side of that line you’re on, that is a question for your attorney. Not for a blog post, including this one.
PCI DSS: yes, if you take cards
PCI DSS is the card industry’s security standard, and it applies if you accept card payments, which is most of us.
Using a payment processor doesn’t remove the obligation. What matters most is how card details reach the processor. Card numbers read over the phone and written on a sticky note, or emailed in by a donor, are the problem. Card details should go straight into the processor’s own secure form and never touch your systems or your paper.
If you take donations by phone, enter them directly into the processor’s form while the donor is on the line, and don’t write the number down anywhere.
The underlying principle
Under all three is one idea: collect less, and keep it for less time.
Data you don’t hold can’t leak. Before collecting a new field on a form, ask whether you will actually use it. Once a year, look for old exports and spreadsheets that nobody needs anymore. Nobody has ever regretted deleting a 2016 donor export.
This week’s action
Write down which of the three apply to your organization, and where that data actually lives. If HIPAA is a maybe, add it to the list for your attorney.
Next in this section: your team is already using AI.