INTERIM. 3 Reasons Why State Laws are Necessary for Health Care Data Security. Data Privacy.

  • State Attorney Generals oppose federal control over health care data security and data privacy
  • States are better equipped to make fast changes in the data driven economy
  • Breaches that are small and localized are better handled by local authorities and not the federal government

Health IT Security | Are State Health Data Breach Notification Laws Needed?

INTERIM. Lege Trend: Data Security in Telemedicine. 3 Keys from 1 Western State. Read the Bill. Prep your Client.

What state recently enacted new telemedicine laws? Washington State

What data security elements were included in the Washington State legislation? 

  • Establishes best practices that complies with ““generally accepted health care practices and standards.” 
    • Boils down to HIPAA and the HITECH Act & existing state law
  • Establishes a technology standard of ““the standards required by state and federal laws governing the privacy and security of protected health information.”
  • Allows Health Plans to deny coverage if these standards are not met

WA SB 6519

Davis Wright Tremaine LLP | M.D. Phone Home: New Legislation Expands Telemedicine in Washington

 

3 Points Informed Intel. Why Hackers Target Healthcare Over All Other Industries.

Hacking incidents by industry:

  • 23% of data breaches occured in healthcare
  • 18% of data breaches occured in financial services
  • 16% of data breaches occured in education

34% of healthcare data breaches are caused by employee error

The average notification timeline after a breach:

  • 69 days to detect the incident
  • 7 days to contain it
  • 43 days to analyze what happened
  • 40 days to notify potentially affected individuals

Health IT Security | Healthcare Data Breaches Most Common in 2015 Incidents

INTERIM. 3 Ways 1 State Seeks to Tighten Education Contracts. Student Data Security. Read the Bill. Prepare an Offense. Prepare a Defense.

Which state is making a new move to protect student data? Colorado

What does it mean for education contractors? New Rules. New Data Security Requirements.

3 Key prohibitions in the bill:

  • prohibit education contractors from selling personally identifiable student information
  • prohibit use of student information for targeted advertising to students
  • Prohibitions follow to the subcontractors
  • Establishes data security protocols tied to education contractors

CO HB 16-1423

Chalkbeat Colorado | Colorado lawmakers try again to tighten protection of student data

Lege Trend: Shorten Notification Requirements for Business with Data Breaches.

Which state updated its data breach law in March to shorten the time line for notification? Tennessee

How long do Tennessee businesses with data breaches have for notification? 14 days from discovery or notification of the breach

Is there an exception to the 14 days? yes, a legitimate law enforcement need

Did Tennessee also expand what triggers a notification? Yes

What new event triggers a notification? When the breach is caused by your own employee

TN SB 2005

JD Supra | Alston & Bird | Tennessee Updates Data Breach Statute to Require Notice in 14 Days

Lege Trend: Reworking Agency Data Security. Procurement. Procurement. Procurement.

Which state passed new data security laws in 2016? Wyoming

Were the new laws the result of a breach or a legislative mandate? The result of a 2 year,  4-member Joint Task Force on Digital Information Privacy

What are agencies asked to do?  2 tasks

  • Agencies must review their data collection, handling, security and management.
  • Agencies must assess their stored data and explain why it collected it; and whether it really still needs to be stored

Where does procurement come into play? To fix and protect the data in perpetuity as state and local governmental entities determine industry best practices. Any wagers on whether government currently implements best practices protect data?

Wyoming SF 38 

Wyoming Tribune Eagle | Law requires state agencies take 2nd look at data security

Wyoming Business Report 

 

 

INTERIM. 2 Points Informed Intel. Regulatory Guidance for Data Security while Government Teleworking. Contracting Opportunities.

What entity released guidelines on teleworking and cyber security? The National Institute of Standards and Technology

What suggestions in the guidelines that will direct procurement opportunities?

  • virtual mobile infrastructure technologies

    • that create temporary, secure environments for teleworkers who need to access organizational data that are destroyed when the session is over

  • mobile device management technology
    • technology to force devices to adhere to certain security standards before granting them access to sensitive data

Fed Scoop | NIST issues draft cybersecurity guidelines for teleworking

Another Healthcare Facility Hit with Ransomeware. The Informed Intel in 3 Points.

  • Methodist Hospital in Kentucky was hit by ransomeware
  • The ransomeware, of the “Locky” strain,  encrypted, deleted original files  and is holding hostage all its data for $1,600, or 4 bitcoins
  • Hospital paperwork is being processed by hand

Krebs on Security | Hospital Declares ‘Internal State of Emergency’ After Ransomware Infection

Governing | Hackers Target Hospitals for Ransom