2 cissp ® Official Study Guide Eighth Edition

 Electronic Communications Privacy Act of 1986
The Electronic Communications Privacy 
Act (ECPA) makes it a crime to invade the electronic privacy of an individual. This act 
broadened the Federal Wiretap Act, which previously covered communications traveling via 
a physical wire, to apply to any illegal interception of electronic communications or to the 
intentional, unauthorized access of electronically stored data. It prohibits the interception or 
disclosure of electronic communication and defi nes those situations in which disclosure is le-
gal. It protects against the monitoring of email and voicemail communications and prevents 
providers of those services from making unauthorized disclosures of their content. 
One of the most notable provisions of the ECPA is that it makes it illegal to monitor mobile 
telephone conversations. In fact, such monitoring is punishable by a fi ne of up to $500 and a 
prison term of up to fi ve years.
 Communications Assistance for Law Enforcement Act (CALEA) of 1994
The Commu-
nications Assistance for Law Enforcement Act (CALEA) of 1994 amended the Electronic 
Communications Privacy Act of 1986. CALEA requires all communications carriers to make 
wiretaps possible for law enforcement with an appropriate court order, regardless of the 
technology in use.
 Economic Espionage Act of 1996
The Economic Espionage Act of 1996 extends the defi ni-
tion of property to include proprietary economic information so that the theft of this infor-
mation can be considered industrial or corporate espionage. This changed the legal defi nition 
of theft so that it was no longer restricted by physical constraints.
 Health Insurance Portability and Accountability Act of 1996
In 1996, Congress passed the 
Health Insurance Portability and Accountability Act (HIPAA), which made numerous chang-
es to the laws governing health insurance and health maintenance organizations (HMOs). 
Among the provisions of HIPAA are privacy and security regulations requiring strict security 

---

Laws 
143
measures for hospitals, physicians, insurance companies, and other organizations that pro-
cess or store private medical information about individuals. 
HIPAA also clearly defi nes the rights of individuals who are the subject of medical records 
and requires organizations that maintain such records to disclose these rights in writing.
The HIPAA privacy and security regulations are quite complex. You should 
be familiar with the broad intentions of the act, as described here. If you 
work in the healthcare industry, consider devoting time to an in-depth 
study of this law’s provisions.