# US Federal Privacy Law Applicability Assessment

## Organisation Details

| Field | Value |
|-------|-------|
| **Organisation Name** | [Legal entity name] |
| **Industry** | [Industry / Sector] |
| **States of Operation** | [List of states] |
| **Employee Count** | [Number] |
| **Annual Revenue** | [USD] |
| **Assessment Date** | [YYYY-MM-DD] |
| **Assessor** | [Name, Title] |

## Federal Law Applicability Matrix

| Federal Law | Applicable? | Basis | Primary Regulator | Key Obligations |
|------------|-------------|-------|-------------------|----------------|
| **HIPAA** | [Yes / No] | [Covered entity / Business associate / N/A] | HHS OCR | [Summary] |
| **42 CFR Part 2** | [Yes / No] | [SUD treatment programme / N/A] | SAMHSA | [Summary] |
| **FTC Health Breach Rule** | [Yes / No] | [PHR vendor / Health app / N/A] | FTC | [Summary] |
| **GLBA** | [Yes / No] | [Financial institution type] | [OCC/Fed/FDIC/NCUA/FTC/SEC] | [Summary] |
| **FCRA** | [Yes / No] | [CRA / User / Furnisher / N/A] | CFPB / FTC | [Summary] |
| **COPPA** | [Yes / No] | [Directed to children / Actual knowledge / N/A] | FTC | [Summary] |
| **FERPA** | [Yes / No] | [Educational institution / N/A] | Dept. of Education | [Summary] |
| **ECPA/Wiretap Act** | [Yes / No] | [Communications interception / Monitoring] | DOJ | [Summary] |
| **Stored Communications Act** | [Yes / No] | [ECS/RCS provider / N/A] | DOJ | [Summary] |
| **VPPA** | [Yes / No] | [Video service provider / Streaming / N/A] | Private action | [Summary] |
| **FTC Section 5** | [Yes / No] | [FTC jurisdiction confirmed / Exempt entity] | FTC | [Summary] |

## HIPAA Assessment (if applicable)

### Entity Classification

| Question | Answer |
|----------|--------|
| **Covered entity type** | [Health plan / Clearinghouse / Provider / N/A] |
| **Business associate?** | [Yes / No] |
| **BAAs executed with all BAs?** | [Yes / No — count: X of Y] |

### Compliance Status

| Requirement | Status | Evidence | Gap |
|-------------|--------|----------|-----|
| Privacy Officer designated | [Yes / No] | [Reference] | [Gap] |
| Notice of Privacy Practices | [Current / Outdated / Missing] | [Reference] | [Gap] |
| Minimum necessary implemented | [Yes / No / Partial] | [Reference] | [Gap] |
| Individual access rights | [Yes / No / Partial] | [Reference] | [Gap] |
| Risk analysis conducted | [Yes / No] | [Date of last analysis] | [Gap] |
| Security safeguards implemented | [Yes / No / Partial] | [Reference] | [Gap] |
| Breach notification procedure | [Documented / Not documented] | [Reference] | [Gap] |
| Workforce training | [Current / Outdated / None] | [Last training date] | [Gap] |

## GLBA Assessment (if applicable)

### Safeguards Rule Compliance (2023 Requirements)

| Requirement | Status | Evidence | Gap |
|-------------|--------|----------|-----|
| Qualified Individual designated | [Yes / No] | [Name, title] | [Gap] |
| Written risk assessment | [Current / Outdated / Missing] | [Date] | [Gap] |
| Access controls | [Implemented / Partial / Not implemented] | [Reference] | [Gap] |
| Encryption in transit and at rest | [Yes / No / Partial] | [Reference] | [Gap] |
| Multi-factor authentication | [Yes / No / Partial] | [Reference] | [Gap] |
| Secure disposal procedures | [Yes / No] | [Reference] | [Gap] |
| Penetration testing | [Annual / Not conducted] | [Last test date] | [Gap] |
| Vulnerability assessments | [Semi-annual / Not conducted] | [Last scan date] | [Gap] |
| Incident response plan | [Documented / Not documented] | [Reference] | [Gap] |
| Annual board report | [Submitted / Pending / N/A] | [Last report date] | [Gap] |

## COPPA Assessment (if applicable)

| Requirement | Status | Evidence | Gap |
|-------------|--------|----------|-----|
| Age-gating mechanism | [Implemented / Not implemented / N/A] | [Reference] | [Gap] |
| Parental consent mechanism | [Implemented / Not implemented] | [Method used] | [Gap] |
| Children's privacy notice | [Posted / Not posted] | [Reference] | [Gap] |
| Parental review/delete capability | [Yes / No] | [Reference] | [Gap] |
| Data minimisation for children | [Yes / No] | [Reference] | [Gap] |
| COPPA Safe Harbor membership | [Yes / No] | [Programme name] | [Gap] |

## Preemption Analysis

| State Law | Federal Law Interaction | Preempted? | Notes |
|-----------|----------------------|-----------|-------|
| [State law] | [Federal law] | [Yes / No / Partial] | [Explanation] |

## Remediation Plan

| Gap | Federal Law | Priority | Action Required | Owner | Target Date | Status |
|-----|-----------|----------|----------------|-------|-------------|--------|
| [Gap 1] | [Law] | [Critical / High / Medium / Low] | [Action] | [Name] | [YYYY-MM-DD] | [Open / In progress / Closed] |

## Sign-Off

| Role | Name | Signature | Date |
|------|------|-----------|------|
| Privacy Officer | [Name] | __________ | [YYYY-MM-DD] |
| Legal Counsel | [Name] | __________ | [YYYY-MM-DD] |
| Assessor | [Name] | __________ | [YYYY-MM-DD] |

---

*This assessment maps federal privacy obligations applicable to the organisation. It should be reviewed alongside the state privacy law tracker for comprehensive compliance.*