2 Concerns. Local Governments Have about Federal Data Security Standards for Elections.

Local governments are concerned about federal DHS cybersecurity regulations for local elections, because those federal regulations may :

  • Add an unnecessary layer of bureaucratic oversight
  • Would centralize an inherently local — and decentralized — system

What did DHS do to trigger these concerns? Declared elections to be critical infrastructure, which triggers additional protections and resources from the federal government.

Governing | New Election Cyberprotections Cause Confusion and Concern

Empire Governor State Cyber Security Plan. 3 Point Plan.

New York Governor Andrew Cuomo set forth his plan for protecting the cybersecurity of New Yorkers by:

  • Creating a “response team” to handle confidential information breaches from state & local governments 
  • Create a graduated system of punishments for computer tampering crimes based on the amount of damage
  • More severe punishments for identity Theft

New York Law Journal | Cuomo Promises New Cybersecurity Measures in 2017

New Regulations. Medical Device Hacking.

What entity promulgated new medical device cybersecurity rule guidance? The FDA

What prompted the new guidance? Claims of heart device hacking

Policy Issues around medical device hacking:

  • assess whether the risk of patient harm is sufficiently controlled or uncontrolled
  • protection of PHI- protected health information- by devices
  • comprehensive risk management programs
  • NIST cybersecurity protocols should be the standard

Medical Marijuana Data Breach Leads to Offline State Records.

Where did the data breach occur? State of Nevada medical marijuana database

How many people had personally identifiable records affected? more than 11,000, but no patient records

The response by the state: Take the database offline

Weed News | Nevada Medical Marijuana Data Breach Highlights Need For Industry Information Security

Reno Gazette Journal | Thousands of Nevada medical marijuana dispensary applications exposed online

State Financial Data Security Rule Proposal Revision. 6 Key Pieces of Intel.

The state upping the ante on data security rules for the finance industry: New York

The new New York rules announced December 28th will:

  • Effective Date will be March 1, 2017 instead of January 1st
  • Require annual reporting to the state about data security compliance
  • Requires financial institutions to maintain comprehensive audit trails
  • Mandatory reporting of any cybersecurity event within 72 hours
  • Financial institutions must appoint a Chief Information Security Officer (CISO)
  • Required multifactor authentication for staff accessing internal networks or information systems externally

Business Insider | New York delays new cybersecurity rules for financial firms​

Data Breach Legislation & Regs. Carrot & the Stick. The Stats & The Regs.

What do you need to know about data breaches?

The carrot & the stick:

  • Increase the accountability of entities that hold data
  • By requiring the entities to shoulder more of the cost of a breach
  • Allow these entities to offer “credible security signals to the market” to provide a benefit to the entity

Tech Crunch | The carrot and stick of data breaches

Student Records Data Breach Prompts Legislation in Old Line State

The state: Maryland

The data breach: Student records, including names, brthdates and Social Security numbers in Frederick County Public Schools

Why legislation was triggered? 

  • A state senator didn’t think he was getting enough answers from education officials
  • An April 2015 audit called for increased data security measures for student data

The legislative proposal: 

  • Requiring up to 5 years of identity and credit monitoring for data breach victims
  • Not require schools to transfer student records to the state education agency until the state has “an industry-accepted standard in their information technology systems”

Government Technology | Maryland Delegate Promises New Legislation in Wake of Student Data Breach

AMA. 8 Principles for Mobile Health Data Protection. The Key: State laws & regulations.

  • Support the establishment or continuation of a valid patient-physician relationship;
  • Have a clinical evidence base to support their use in order to ensure mHealth app safety and effectiveness;
  • Follow evidence-based practice guidelines, to the degree they are available, to ensure patient safety, quality of care and positive health outcomes;
  • Support care delivery that is patient-centered, promotes care coordination and facilitates team-based communication;
  • Support data portability and interoperability in order to promote care coordination through medical home and accountable care models;
  • Abide by state licensure laws and state medical practice laws and requirements in the state in which the patient receives services facilitated by the app;
  • Require that physicians and other health practitioners delivering services through the app be licensed in the state where the patient receives services, or be providing these services as otherwise authorized by that state’s medical board; and
  • Ensure that the delivery of any services via the app be consistent with state scope of practice laws.

Data Law Insights | Crowell Morning | Illinois’ First Settlement under Biometric Law; AMA Adopts Principles for Mobile Health Apps; Ecuador to Enact Data Privacy Law