Category Archives: regulatory enforcement

Health care data Security. Non-HIPPA entities. Health & Wellness Apps Beware. Medical Billing Companies Hello. Bonjour Medical Transcribers.

What entities are the new targets for data security enforcement? HIPPA adjacent health and wellness companies. 

Why are HIPPA adjacent health and wellness companies the focus of regulators? These companies collect and store personal health information. For example:

  • Fitbit & health apps. That data from your fitbit gets stored somewhere and if it was collected and stored by a health care provider, it would be protected information. 
  • Medical billing companies
  • Medical Transcription…

New Agency Jumps into Data Security Regulations. Consumer Financial Entities. 3 Key Points.

  • the Consumer Financial Protection Bureau levied a fine against an online payment system company for the company’s data security practices in violation of the Consumer Finance Protection Act
  • Consumer Financial Protection Bureau? Sounds Like Consumer Credit Commissioner?
  • The regulators say the encryption touted by the company did not live up to its hype

Bloomberg BNA | Consumer Finance Agency Levies First Data Security Fine

National Law Review | Dwolla Fined $100,000 by CFPB in First…

January 28th: Data Privacy Day. 10 Data Security Trends for 2016.

  • Fitbits will get hacked.
  • The E.U. and U.S. fight on datat security will continue
  • Businesses should have data security policy & do risk assessments
  • Data Security will be guided by industry specific standards 
  • Telephone Consumer Protection Act will be a new source of data security lawsuits
  • Company issued electronic devices vs. personal electronic devices means more now that we’re in the age of data security
  • Curate and protect your social media like you do your health data from your…

INTERIM. Home of the Ducks is now Home of Data Security. 5 Bits of Informed Intel from a new Data Security State Law.

  • data breach defined in new Orgegon law as:
    • “an unauthorized acquisition of computerized data that materially compromises the security, confidentiality or integrity of personal information that a person maintains.”
  • personal information that triggers the notification statute
    • ​Social Security number;
    • Driver license number or state identification card number issued by the Department of Transportation;
    • Passport number or other United States issued identification number;…

Teacher Data Hacked. 3 Keys from the ISD Response.

What did hackers breach? Lawrence, MA Public Schools’ online database

How did the hackers breach the school database? A phishing attack 

What did hackers take? Teachers’ personal information:

  • names
  • phone numbers
  • addresses
  • Social Security numbers
  • calendar year 2015 gross earnings

How did the school district respond?

  • email to teachers informing them of the breach
  • explained that the district would:
    • mitigate the breach
      • directing teachers to sign up for 90 days of free credit…

Trend: Financial Regulators Target Security. 3 Trends.

The SEC is getting tough on data security. State financial agencies likely to follow suit. Here’s what’s happening:

  • Enforcement actions against companies with weak security protocols
  • The SEC expects financial firms to have security planning in place before a hack
  • Periodic risk assessments and encryption are key

Financial Times | Securities and Exchange Commission gets tough on cyber security

Data Security Meets Sharing Economy Meets Regulatory Enforcement Powers

Which state has an agency enforcement action against the sharing economy? New York’s Attorney General

Which part of the sharing economy is the NY Attorney General looking into? Ride Share

What’s the issue? Buzzfeed reported that company execuitves had access to rider locations through the ride share app

Let’s get to know what could happen in Texas, and look at what enforcement deal was worked out in NY. The settlement included:

  • a 20K fine
  • requiring ride share entity to adopt a data…

INTERIM. 4 Points from the EU to Guide Texas Data Security Legislation

The EU is revamping its data security statutes, why should Texas care? Because E.U. courts have taken a very libertarian and conservative view to protect personal information.

Did the EU take any actions that might translate to Texas? Yes, 4 Points to consider:

  • Stronger requirements for obtaining consent to collect/store data
  • Memorializing the “right to be forgotten”.Sounds an awful lot like the Texas Do Not Call List.
  • 72 hour noptification requirement for comapnies to notify the…