National Association of Professional (Insurance) Agents Ramps Up Data Breach Insurance

NAPA has new data breach compliance and certification. Data breaches are big business, people.  

Data breaches and protecting against data breaches generate:

  • Big legislative pushes
  • New regulations
  • Procurement Opportunities (hello, $21M emergency contract that the federal data breach sparked)

Data breaches impact:

  • bankers, credit unions, financial institutions
  • retailers
  • corporations
  • new lawsuit filings
  • health data
  • student data
  • +more

NAPA

All Data Breaches Lead to Court. 4 Lessons to Learn for Legislation & Corporate Governance.

Federal employees this week filed suit over the June 4th federal data breach. The breach is said to the largest in government history, and allegedly the result of Chinese hackers seeking super secret spy information. 

The crux of the lawsuit is something all corporations should pay heed to as its the same argument made by plaintiffs in Target and HomeDepot breaches too- how much knowledge did the government have about potential breaches and did the government fail to act? As for the feds, the  lawsuit alleges:

  • The federal government was on notice because:
  • “10 million confirmed intrusion attempts targeting its network in an average month”
  • OPM Breach potentially affects 18 million federal applicants
  • OIG found that in many areas the OPM’s performance actually got worse in that “a 2014 OIG report, the ‘drastic increase in the number of [software] systems operating without valid authorization is alarming and represents a systemic issue of inadequate planning by the OPM offices to authorize the [software] systems they own.”

Courthouse News Service

The Federal Government & Is Here to Help with Data Security. Never mind that massive federal government data breach…

The Federal Trade Commission has released new guidelines for corporate data security. FTC has the power to fine companies for data breaches, so take heed. 

Recommendations include:

  1. Start with security.
  2. Control access to data sensibly.
  3. Require secure passwords and authentication.
  4. Store sensitive personal information securely and protect it during transmission.
  5. Segment your network and monitor who’s trying to get in and out.
  6. Secure remote access to your network.
  7. Apply sound security practices when developing new products.
  8. Make sure your service providers implement reasonable security measures.
  9. Put procedures in place to keep your security current and address vulnerabilities that may arise.
  10. Secure paper, physical media, and devices.

FTC Start with Security coming to UT law November 5th

FTC Guide for Businesses

67% of Healthcare Companies Had Data Security Issues Last Year

Healthcare Management Information Systems Society released a new survey about data security and healthcare, the results:

  • 2/3 of healthcare companies repsonsing experienced a data security issue within the last year
  • 87% say data security is a increasingly higher business concern for healthcare
  • 69% say their concern about data security is motivated by phishing
  • 46% say the highest data security concern is internal negligence
  • 57% have at least 1 full time staff person dedicated to data security

MedCity News

Lege trend: 6 Ways the Home of the Ducks Strengthens Data Breach Law

  • “Expands the statute’s definition of “personal information” to include a resident’s biometric or medial information;
  • Requires entities or persons that own or license consumer personal information to notify the Oregon Attorney General of a data breach if the entity must notify more than 250 residents;
  • Raises the threshold for notifying Oregon consumers to a more generous “unlikely to suffer harm” standard;
  • Lowers the threshold for reporting to consumer report agencies (CRAs) by requiring notice to CRAs whenever a breach affects more than 1,000 residents;
  • Exempts covered entities under the Health Insurance Portability and Accountability Act (HIPAA) from compliance, so long as a copy of the notice sent to either the entity’s primary functional regulator or to state residents is sent to the Attorney General; and
  • Allows the Attorney General to bring action against entities that violate the data breach statute, pursuant to Oregon’s Unlawful Trade Practices Act (Ore. Rev. Stat. § 646.607).”

JD Supra | Privacy & Security Law

Status Check: National Data Security Bill Likelihood of Passage

Will Congress pass a national data security bill after the massive federal employee data breach. Odds are not high. There is a higher liklihood that next week there will be a new food trailer opening in Austin. 

What does this mean? States will pass stronger data security bills from everything from retailers to public education contractors to health care data.

Health Data Management

Constitutional Amendment to Protect Citizen Information

Protecting citizen data from the prying eyes of the government, hackers, and neighbors is the rally cry of everyone from Rand Paul to the Wyoming Legislature.

 Wyoming’s Task Force on Digital Information will recommend whether the Legislature should move forward with its constitutional amendment again in 2016.

In 2015, the constitutional amendment ran into hurdles when legislators realized that protecting privacy might make a mess of open records.

To head this disaster off at the pass, some press types recommended a right to know addition to the constitutional amendment. 

Courthouse News Service

Data Security Veto

One of Governor Abbott’s line item vetoes struck $5,000,000 in funding for University of Texas Center for Identity.  The Center seeks to limit impact of data security breaches.

The Governor’s rational: “If The Center þr ldentíty is a príority, the University may use íts appropriationfor ínstitutional enhancement, leverage public-private partnerships, or allocate other resources þr this purpose. “

Governor Abbott Budget Vetoes   UT Center for Identity