Category Archives: regulatory trend

3 New Rules from Cyber Insurance Coming to a Regulator Near You

  • Lots of cyber insurance policy litigation.
    • You know what lawyers mean- lawsuits and legislation.
  • 2015 was once in a lifetime groeth in cyberinsurance market
    • Hyper growth leads to regulation and legislation as the unintended consequences emerge
  • health care cyber insurance renewal rates are seeing 150% premium increases
    • Big premium cases mean, big regulatory and legislative changes are afoot

 

Property Casualty 360 | Cyber insurance 2015: Inside a robust and rapidly changing market

How 1 Western State Classifies Info as Public, Confidential, Secret, or Top Secret.

The Montana Information Technology Managers Council this fall promulgaed policy to require Montana state agencies to classify information in 4 categories:

  • public
  • confidential
  • secret
  • top secret

Open government? The category names depcit a conflict between category names IT professionals regularly utilize & the categories that political types would prefer,

The policy is htting the Montana Legislature with a roar.

Montana Standard | State mulls policy on public, secret, top secret…

Agency Slapped for Mismanaging Data Security Contract

Which agency is causing an uproar? The federal Office of Personnel Management. AKA “The OPM Breach of 2015”

How did the agency mishandle the data breach? A report this week from OPM’s Inspector General found 5 contracting irregularities when OPM awarded a $21M clean up the data breach contract. 

The 5 Government Contracting Problems:

  • OPM did not offer a complete scope of the work
  • Conduced inadequate market research
  • had an incomplete acquisition plan
  • exceeded dollar limits on blanket…

How 1 Health Insurer Responded to a Class Action Data Breach Suit Affecting 80 Million

Anthem Inc. responded to a class action lawsuit concerning a data breach affecting 80 million by focusing on the 1 hot botton issue legislatures and regulators are focusing on:

whether the person whose personal information was hacked suffered any actual damages

Why is this response from Anthem important? Because courts, legislatures, and regulators have come down on all sides of whether actual damages is required in a data breach suit.

Anthem also provided all 80 million customers with 2…

Health Care Data 12 times more Valuable to Hackers than Credit Card Data. 3 Reasons Why. Be Ahead of the Curve.

Security Experts say health care data is 4 to 12 times more valuable than credit card data to hackers. 

Why is health care data so valuable?

  • Health care data sets are “extremely detailed personal information.”
  • Health care data alone allows a hacker to:
    •  Apply for credit cards or loans
    • “Allows a hacker to generate huge sums from fraudulent medical charges,” 
  • Average financial loss for stolen health care data: $13,500 per victim

Health care Informatics | Survey: Majority of…

Data Breach Enforcement: Cable Providers. Regulatory Enforcement. 3 Things to Know Now.

  • In 2014 Cox Communications was hacked. Millions of customer personal data was exposed.
  • Cox paid for notification and credit monitoring services for the millions of impacted customers.
  • Cox also faces regualtory enforcement from the FCC. The FCC is requiring:
    • A comprehensive compliance plan
    • A written information security program
    •  Cox will be monitored by the FCC for 7 years

JD Supra | FCC settles data security enforcement action with Cox

Regulatory Trend: Agency Gives 3rd Party Contractor Data. Oops. 3rd Party Health Contractors Beware. 3rd parties Pay Costs of Data Exposure.

The Illinois Department of Insurance accidentally led to the posting of Social Secrity Numbers of health records online. 

How did a 3rd party get caught in a date release of health records? The agency sent records, including social security numbers, to Blue Cross Blue Shield which Blue Cross Blue Shield posted online. 

What happened to the 3rd party? The Department of Insurance took immediate corrective measures against Blue Cross Blue Shield

What is the 3rd party’s…

Report: Health Care Woefully Unprepared for Data Breach. 3 Recommendations. 3 Conclusions.

A cybersecurity report from Forrester is not good for health care. The report concludes:

  • health care is ” woefully behind” in preparedness
  • HIPPA compliance is not enough. HIPPA doesn’t keep up with wearable technology like GPS astham inhalers or wearable tattoos that transmit health care data.
  • HHS is imposing sanctions on unprepared health care companies that suffer data breaches.

3 Recommendations:

 1) adopt two factor authentication for access to databases containing sensitive…

3 Recommendations to Minimize Liability in Outsourced Data Security. Hello Vendors.

  • “include specific data security procedure obligations in contracts with vendors

  • verify a vendor’s capacity to adhere to the prescribed data security procedures

  • look at data security practices from an expert’s perspective to determine whether such practices are reasonable”

National Law Review | Piercing Outsourcing Veil: FTC Says Data Security Obligations Remain 

Regulatory Trend: Cybersecurity & Connected Cars. (Wifi Cars, not Trains)

What agency is talking cybersecurity & cars? The FTC

What committee heard from the FTC? Subcommittee on Commerce, Manufacturing and Trade of the House Energy and Commerce Committee

What did the FTC testify to?

  • FTC is the “the nation’s lead privacy and data security enforcement agency”
  • Proposed legislation is weaker than the FTC rulemaking on “connected cars”
  • Proposed safe harbor for auto manufacturers that submit privacy policies to the Department of Transportation was too…