regulations require every person and organization, both in Massachusetts and elsewhere, that accesses the private personal information of Massachusetts’ citizens to follow these standards: a. Develop and implement a comprehensive written policy of information security procedures b. Comply with Massachusetts standards for issues such as paper document storage, access controls to information, monitoring standards, and training for employees c. Encrypt personal information records communicated over wireless networks or stored on personal devices d. Require outsourced or third-party providers handling per- sonal information to maintain commensurate compliance with the regulations