For more sensitive information, such as those elements listed, it's more common sense that you'd encrypt that data and have a security policy, regardless of what state in which the people in your database reside.

The title of this article so broad it implies that if you simply had a contact database (with no sensitive information) containing Mass residents that you'd have to file a security policy and encrypt every piece of information.