Hospital Association Hones in on Data Security. 5 Highlights.

  • California Hospital Association warns its members that health care is behind on data security
  • HIPPA compliance isn’t enough.
  • Hospitals also have to protect data in electronic medical equipment
  • Regulatory Fines are increasing exponentialluy every year. 
  • A Cybersecurity firm recommends these 3 corrective measures:
    • “1) adopt two factor authentication for access to databases containing sensitive patient information;
    • 2) use behavioral analytics to identify suspicious behavior and encrypt data;
    • 3) realize that identity protection is no longer a good enough mea culpa.”

California Hospital Association | Healthcare Way Behind on Data Security, Cyber Firm Says

NBC News | Healthcare Way Behind on Data Security, Cyber Firm Says

Realtors Warn of Data Security Issues in Real Estate. 4 State Law Highlights.

  • Hackers are looking for personally identifiable information such as:
    • credit card or bank account information
    • login credentials
    • employment details
    • physical address, e-mail address, and phone
    • social security number
  • Small Businesses account for the majority of the attacks according to the National Association of Realtors® technology policy expert
  • Real Estate can be impacted in 4 major ways:
    • financial harm from expenses resulting from the breach
    • legal risks from lawsuits from clients or others impacted by the hack
    • reputational risks from having to publicly disclose the hack.
    • commercial properties are also vulnerable from hacks into their automated or building control systems.  
  • Most of the data security laws & regulations are at the state level.

PRNewswire | Cybercriminals Targeting Real Estate Transactions

Data Breach Enforcement: Cable Providers. Regulatory Enforcement. 3 Things to Know Now.

  • In 2014 Cox Communications was hacked. Millions of customer personal data was exposed.
  • Cox paid for notification and credit monitoring services for the millions of impacted customers.
  • Cox also faces regualtory enforcement from the FCC. The FCC is requiring:
    • A comprehensive compliance plan
    • A written information security program
    •  Cox will be monitored by the FCC for 7 years

JD Supra | FCC settles data security enforcement action with Cox

Regulatory Trend: Agency Gives 3rd Party Contractor Data. Oops. 3rd Party Health Contractors Beware. 3rd parties Pay Costs of Data Exposure.

The Illinois Department of Insurance accidentally led to the posting of Social Secrity Numbers of health records online. 

How did a 3rd party get caught in a date release of health records? The agency sent records, including social security numbers, to Blue Cross Blue Shield which Blue Cross Blue Shield posted online. 

What happened to the 3rd party? The Department of Insurance took immediate corrective measures against Blue Cross Blue Shield

What is the 3rd party’s responsibility? Providing notice to affected persons, whose health records were identifiable by social security number. Potentially also required data protection services paid for by the 3rd party for all affected individuals.

lesson:  3rd party contracts should verify the information received from a state agency complies with all data security laws or the 3rd party maybear the cost of repairing the data breach.

 

Data Security Bills Expedited Due to Terrorism

A push in the UK is campaigning to move forward with expedited data security legislation to secure networks in light of the November 13, 2015 terrorism in Paris. 

Why is this relevant?

  • Because legislation passed under the threat of security issues can bring in corporate client data security mandates
  • And, can include mandates for the world’s most valuable data security records– health care records.

Press Association | Lord Carlile wants communications data legislation ‘expedited’

Report: Health Care Woefully Unprepared for Data Breach. 3 Recommendations. 3 Conclusions.

A cybersecurity report from Forrester is not good for health care. The report concludes:

  • health care is ” woefully behind” in preparedness
  • HIPPA compliance is not enough. HIPPA doesn’t keep up with wearable technology like GPS astham inhalers or wearable tattoos that transmit health care data.
  • HHS is imposing sanctions on unprepared health care companies that suffer data breaches.

3 Recommendations:

 1) adopt two factor authentication for access to databases containing sensitive patient information;

2) use behavioral analytics to identify suspicious behavior and encrypt data;

3) realize that identity protection is no longer a good enough mea culpa.

CNBC | US health care way behind on data security, says Forrester

Jail Contractor. Data Breach. Phone Records. 3 Reform to Follow.

  • Data Recording Limitations. Data breach included recorded attorney-client phone calls.
  • Data Retantion Limitations. If calls are recorded, how long are they to be kept and under which security protocols.
  • Data Protection. Attorney-client recorded calls were shared with prsoecutors.

Think Progress | Prison Phone Company Hit With Massive Data Breach

New Issue: Data Security. Insurance. Indemnification. 3rd Party Contractors.

Indemnification Clauses in Insurance Cybersecurity policies should do 3 things:

  • Be clear which entities are covered, none of this any and all other related entities mumbo jumbo
  • Explicitly state details like whether “indemnity for third parties extends beyond the policy’s expiration date”
  • Be flexible to constantly evolving laws and case law

Business Insurance | Precise policy language needed to cover affiliated businesses

Campaigns. Low Data Security. Liability Risk. 3 Reasons Why.

  • Campaigns have no legal obligation to protect personal information data that they gather.
  • Campaigns have a trove of information from credit cards, answers to personal profile questions, and personal identification
  • Its unclear which agency would regulate and enforce campaign data security

The Hill  How presidential campaigns could be putting your data at risk

76% of IT Decision Makers would Move Data Centers out of the US over Privacy.

Who was surveyed? 1000 IT decision makers across the UK and US

What did 76% say? 76% would “move their organization’s data to another country as a result of privacy concerns”

The privacy concern of businss: government snooping

How do the CEOs feel? 29% have moved data security to the top of the corporate agenda

Where are they moving their data storage? To Switzerland and Canada

The Data Center Journal | Information Exodus: 76% of IT Decision Makers Would Move Their Data to Another Country as a Result of Privacy Concerns