Category Archives: regulatory enforcement

Agency Slapped for Mismanaging Data Security Contract

Which agency is causing an uproar? The federal Office of Personnel Management. AKA “The OPM Breach of 2015”

How did the agency mishandle the data breach? A report this week from OPM’s Inspector General found 5 contracting irregularities when OPM awarded a $21M clean up the data breach contract. 

The 5 Government Contracting Problems:

  • OPM did not offer a complete scope of the work
  • Conduced inadequate market research
  • had an incomplete acquisition plan
  • exceeded dollar limits on blanket…

INTERIM Lege Trend: State Proposes 6 Data Security Standards for Businesses.

New York Legislature, at the behest of its Attorney General, is strengthening its data security laws. 

Assembly Bill 6866 adds new data to protection requirements and increases penalties.

This bill creates these standards that establish compliance with the law for businesses:

  • a business that protects data more than the law requires
  • a business that complies with Gramm-Leach-Bliley Act
  • a business that meets international standards for information security
  • a business that complies with…

INTERIM Lege Trend: State Data Security Laws. Upstate Ups the Ante on Health Care & Biometric Data. More fines for More companies.

New York Legislature is considering stronger data security laws which would:

  • increase penalties against companies from $150,000 to $1,000,000
  • in addition to current required protected information of  Social Security, driver’s license and credit card numbers, this bill would require protection of biometrics like fingerprints
  • user names, email addresses, securty questions and answers
  • health information protected under HIPPA
  • establishes reasonable safeguards for business
  • establishes…

Audit of State Cyber Security Reveals Security Flaws & Recommendations.

California’s state auditor released a report on the California’s technology department that:

  • found 73 of 77 failed to meet state cyber security standards
  • a recently adopted state pilot program to beef up cybersecurity compliance was blasted for taking too long & that compliance verification would take 20 years with existing state resources
  • self certification of agencies lacked enforcement mechanisms

The audit recommends:

  • a mandate that California’s technology department undertake a…

Trendy Lege & legal Issue: Did the Breach Lead to Harm? How one ALJ Decided.Courts Differ.

Courts and legislatures have differed as to whether a person can bring a lawsuit when their personal data is stolen, but the data has not been used to harm the person.

What happened in this administrative law case? The FTC has been trying to enforce sanctions against a health care company for a data breach.

The FTC legalese is that the health care company’s ” purported failure to institute reasonable data security constituted an unfair trade practice under section 5 of the FTC Act,…

Data Breach Enforcement: Cable Providers. Regulatory Enforcement. 3 Things to Know Now.

  • In 2014 Cox Communications was hacked. Millions of customer personal data was exposed.
  • Cox paid for notification and credit monitoring services for the millions of impacted customers.
  • Cox also faces regualtory enforcement from the FCC. The FCC is requiring:
    • A comprehensive compliance plan
    • A written information security program
    •  Cox will be monitored by the FCC for 7 years

JD Supra | FCC settles data security enforcement action with Cox

Regulatory Trend: Agency Gives 3rd Party Contractor Data. Oops. 3rd Party Health Contractors Beware. 3rd parties Pay Costs of Data Exposure.

The Illinois Department of Insurance accidentally led to the posting of Social Secrity Numbers of health records online. 

How did a 3rd party get caught in a date release of health records? The agency sent records, including social security numbers, to Blue Cross Blue Shield which Blue Cross Blue Shield posted online. 

What happened to the 3rd party? The Department of Insurance took immediate corrective measures against Blue Cross Blue Shield

What is the 3rd party’s…

Report: Health Care Woefully Unprepared for Data Breach. 3 Recommendations. 3 Conclusions.

A cybersecurity report from Forrester is not good for health care. The report concludes:

  • health care is ” woefully behind” in preparedness
  • HIPPA compliance is not enough. HIPPA doesn’t keep up with wearable technology like GPS astham inhalers or wearable tattoos that transmit health care data.
  • HHS is imposing sanctions on unprepared health care companies that suffer data breaches.

3 Recommendations:

 1) adopt two factor authentication for access to databases containing sensitive…

Campaigns. Low Data Security. Liability Risk. 3 Reasons Why.

  • Campaigns have no legal obligation to protect personal information data that they gather.
  • Campaigns have a trove of information from credit cards, answers to personal profile questions, and personal identification
  • Its unclear which agency would regulate and enforce campaign data security

The Hill  How presidential campaigns could be putting your data at risk