Alert!
Health Information Technology for Economic and Clinical Health Act (HITEC) points to some substantial changes in the rules relating to the minimum necessary disclosures of personal health information, imposes additional notice requirements in the case of security breaches and grants new enforcement powers to the states.
The Health and Human Services Department, which enforces HIPAA security and privacy laws, recently released guidance on what counts as “unsecured” information and a request for comments on breach notification under HITECH.
For employers whose health plans must comply with HIPAA privacy and security rules, HITECH means they will have to review and update contracts with business associates to ensure that the documents reflect the new privacy and security laws.
The changes introduced by HITECH will have enormous consequences for third-party vendors, such as benefits brokers and consultants, that act as business partners for self-funded group health plans and large, experience-rated insured plans.
Such vendors will need to take steps to conform to the substance of the HIPAA security standards. Compliance will, at a minimum, entail the adoption of physical, administrative and technical safeguards. This will include implementing security polices and procedures.
In the case of business associates, HITECH makes the following changes:
• Business associates are now subject to the substantive provisions of the HIPAA security rules generally in the same manner and to the same extent as covered entities;
• Business associates must now enter into and abide by a business associate agreement (previously, the burden was on the covered entity to identify business associates and to obtain the necessary business associate agreements);
• Business associates are now subject to civil and criminal penalties for violation of these rules; and
• HHS is required to conduct periodic compliance audits of business associates as well as covered entities.
Remember, the Red Flags Rule ammendment to FACTA also calls for changes in the contracts with service providers and third party vendors. Under law the changes must include an understanding of that vendors’ policy concerning information security and identity theft prevention. A lot of companies are not used to this kind of oversight, and might not understand their responsibility regarding sensitive information policy.
On August 1 of 2009 the FTC will begin the enforcement phase of the Red Flegs Rule meaning that since the law went into effect on January 1st of 2008, different industry sectors have been on notice to implement a program to address identity theft and how to respond in the event of a breach of information. Now enforcement in the form of audits and possible fines and prosecution will begin for businesses who have ignored or skirted the law as it applies to them. For more information on the Red Flags Rule see the link in my column to the Red Flags Rule.
When a medical facility, Human Resources contractor, or benefits broker applies the newest rules of HITEC with regard to medical information security they will not be precluded from adherence to FACTA as well. HIPAA and its initiatives only address the security of medical data not other types of personally identifiable information such as employee files or financial information. A recent case in January of this year involving the theft of 30,000 personnel files from the Kaiser Medical facilities in Oakland California points out graphically that compliance with one law doesn’t necessarily cover the business regarding the other, even though both laws address information security. Compliance for both inititiaves do have common ground however. A written policy is essential as a starting point to establish the culture of security from the Board down. Training, as I mention here as often as I can is next. I can’t over emphsize the importance of onging training of all staff. Contractor oversight is another common point. Without that the system cannot work effectively. It isn’t as important for one company to adhere to a good security program as it is for all the companies that share the information to do so.
It has also come to my attention that enforcement of the HITEC initiatives will be transferred to the FTC, and not be enforced by HSS as previously thought. Although oversight will remain with HSS, the FTC has a track record of enforcement of consumer protection regulations.
Thursday, May 21, 2009
Wednesday, May 20, 2009
No State Secrets Lost This Time, Just (maybe) Yours!
The FBI is investigating the loss of a computer hard drive from the National Archives record center, reports the New York Times. The drive contains a terabyte of data, including the personal information of individuals affiliated with the Clinton presidency. A National Archives statement said the drive houses "an as-yet unknown amount of personally identifiable information of White House staff and visitors." Social Security numbers, home addresses and security procedures, but no classified information, are believed to be on the drive. Authorities confirmed the breach in April. Analysts are still reviewing the drive's content.
No system or method of safekeeping of yours and my information will ever be completly fraud proof, nor will your information, which resides in everything from your elementary school records, your dentists' office, military records, to your County recorders' office, so on and so on, be safe from thieves. The opportunity for theft is too vast, and methods of theft too varied for any combinations of methodology to be effective.
This column is maintained to provide some insight for businesses and other enterprizes which maintain personal information. The fact of the matter is that unless we as individuals engage our own identity theft service we are at the mercy of data thieves and imperfect systems everywhere.
No system or method of safekeeping of yours and my information will ever be completly fraud proof, nor will your information, which resides in everything from your elementary school records, your dentists' office, military records, to your County recorders' office, so on and so on, be safe from thieves. The opportunity for theft is too vast, and methods of theft too varied for any combinations of methodology to be effective.
This column is maintained to provide some insight for businesses and other enterprizes which maintain personal information. The fact of the matter is that unless we as individuals engage our own identity theft service we are at the mercy of data thieves and imperfect systems everywhere.
Tuesday, May 19, 2009
A Matter of Value
I would like to step back from identity theft for a moment. The main business of Taylor and Associates is to offer certain benefits to employees in all types and sizes of organizations. The company that I represent, Pre-Paid Legal Services Inc is the only underwriter of legal services plans and identity theft restoration services in America. We are growing in public acceptance precisely because of the immediate and practical value our clients receive from the benefit. That is the topic of this column, value.
The services we represent are divided into seven separate areas of coverage. In 2008 our law firms were able to save or recover for our clients $21.9 million within just one benefit area alone! Unlike EAP programs which have limited legal services built in, our services are comprehensive and are not so severely limited. In fact the popularity of EAP programs is based partly on the demonstrated need for legal services. The majority of the legal needs of a family are completely covered by the membership without spending additional money. When you combine our legal plans with our identity theft program administered by Kroll Fraud Solutions for us, the employee has unparalleled coverage for the two biggest problems Americans face, access to quality private law firms for any and all legal needs, and full protection and restoration from any type of identity theft. According to the U.S. Secret Service identity theft has surpassed the international drug trade as the most profitable crime in the world. The legal plans were designed to address the areas that families encounter the most. Things like traffic court representation to keep auto insurance costs under control, or contract review when refinancing or making purchases, to consumer issues and product liability, estate planning, IRS audit help, and more. As a victim of massive identity theft in 2000 I was first advised to retain counsel. Because I didn't have the services of Pre-Paid at the time that became a $26,000 dollar episode for me. Remember, an identity theft episode is a legal situation.
When we work with employee groups the very first thing we do is to hold a Will Workshop with all of our new clients to get them started on a will along with the advance medical directive and durable POA, for each of them and their partners. I want them to receive a benefit the very first day they have our membership. I encourage them to use their services as often as possible simply because it can be a value benefit but only if they take advantage of what it can do for them. In this current economic crisis our attorney firms are making a real difference for people who are in danger of losing their homes to foreclosure, and along the Gulf Coast thousands of families have been helped in the aftermath of the devastating hurricanes. All of the law firms in our proprietary network also have privacy specialists on staff to directly handle identity theft issues. This fact has not been lost on the fifty sitting Attorneys General who have recognized us as a force for equal justice in America. The cost of these services is far less than a dollar a day for everything combined, and as we want to earn the business of each client monthly we never engage in long-term contracts.
After 37 years of continued growth Pre-Paid Legal Services is the pioneer and leader in this industry. Our position on the NYSE shows continuous growth in a volatile market. At Taylor and Associates we take great pride in delivering more value to our clients throughout the country than we receive in money from them. A benefit that people can use is a valued benefit.
I've spoken about the value we bring to employers in the past, but it does bear repeating that by offering the services of trained identity theft risk specialists and the compliance documentation we provide, there is an additional value to the company. Whether legal issues or identity theft, or both, the value to the employee cannot be calculated in simple dollar savings alone but also in terms of a peace of mind that family issues are being handled by professionals with the clients' best interest in mind. The value to the employer besides what I just mentioned is in the ongoing training and assistance we provide to help with an identity theft program as required by law for most employers. No other firm has all three components in place, identity theft protection services for the employee, comprehensive legal service plans for employees, and a program for the company to reduce its' risk from data breach and the fallout from identity theft episodes. All in all the value of the combination of these programs has a proven 37 year track record with over 35,000 employers in every type of business, local government, and non-profit. Value is at the core of how the plans are devised. Pre-Paid Legal Services has ammassed what I believe is the largest database of actuarial data in existence to bear this out.
The services we represent are divided into seven separate areas of coverage. In 2008 our law firms were able to save or recover for our clients $21.9 million within just one benefit area alone! Unlike EAP programs which have limited legal services built in, our services are comprehensive and are not so severely limited. In fact the popularity of EAP programs is based partly on the demonstrated need for legal services. The majority of the legal needs of a family are completely covered by the membership without spending additional money. When you combine our legal plans with our identity theft program administered by Kroll Fraud Solutions for us, the employee has unparalleled coverage for the two biggest problems Americans face, access to quality private law firms for any and all legal needs, and full protection and restoration from any type of identity theft. According to the U.S. Secret Service identity theft has surpassed the international drug trade as the most profitable crime in the world. The legal plans were designed to address the areas that families encounter the most. Things like traffic court representation to keep auto insurance costs under control, or contract review when refinancing or making purchases, to consumer issues and product liability, estate planning, IRS audit help, and more. As a victim of massive identity theft in 2000 I was first advised to retain counsel. Because I didn't have the services of Pre-Paid at the time that became a $26,000 dollar episode for me. Remember, an identity theft episode is a legal situation.
When we work with employee groups the very first thing we do is to hold a Will Workshop with all of our new clients to get them started on a will along with the advance medical directive and durable POA, for each of them and their partners. I want them to receive a benefit the very first day they have our membership. I encourage them to use their services as often as possible simply because it can be a value benefit but only if they take advantage of what it can do for them. In this current economic crisis our attorney firms are making a real difference for people who are in danger of losing their homes to foreclosure, and along the Gulf Coast thousands of families have been helped in the aftermath of the devastating hurricanes. All of the law firms in our proprietary network also have privacy specialists on staff to directly handle identity theft issues. This fact has not been lost on the fifty sitting Attorneys General who have recognized us as a force for equal justice in America. The cost of these services is far less than a dollar a day for everything combined, and as we want to earn the business of each client monthly we never engage in long-term contracts.
After 37 years of continued growth Pre-Paid Legal Services is the pioneer and leader in this industry. Our position on the NYSE shows continuous growth in a volatile market. At Taylor and Associates we take great pride in delivering more value to our clients throughout the country than we receive in money from them. A benefit that people can use is a valued benefit.
I've spoken about the value we bring to employers in the past, but it does bear repeating that by offering the services of trained identity theft risk specialists and the compliance documentation we provide, there is an additional value to the company. Whether legal issues or identity theft, or both, the value to the employee cannot be calculated in simple dollar savings alone but also in terms of a peace of mind that family issues are being handled by professionals with the clients' best interest in mind. The value to the employer besides what I just mentioned is in the ongoing training and assistance we provide to help with an identity theft program as required by law for most employers. No other firm has all three components in place, identity theft protection services for the employee, comprehensive legal service plans for employees, and a program for the company to reduce its' risk from data breach and the fallout from identity theft episodes. All in all the value of the combination of these programs has a proven 37 year track record with over 35,000 employers in every type of business, local government, and non-profit. Value is at the core of how the plans are devised. Pre-Paid Legal Services has ammassed what I believe is the largest database of actuarial data in existence to bear this out.
Tuesday, May 12, 2009
A Culture of Security
I read a lot of technical papers and discussions on methodology of data security, and the philosophy of a security minded culture. A lot of very intelligent people are diligently looking for better and more efficient ways to move data around an enterprise and still maintain a modicum of security. Data is after all the engine that runs modern business. Whether it is described as proprietary information (IP), or developmental operating infrastructure, or a software product, our service-based society is run on data. This intellectual property stuff if compromised, can mean ruining a companies’ ability to maintain a competitive position.
There is even an industry whose whole purpose is to aggregate, sort, re-sort, and sell data. See axciom , choicepoint. or MIB for good examples of that sort of company. These “specialty database” companies have the additional burden of compiling the personally identifiable information of people who are not their clients but instead comprise the very commodity that the business trades in, data.
In my previous career in engineering we were always developing techniques, specialized machines, or circuit designs that would help not only to propel our industry but also to attract customers to our business in particular. Innovation is essential to any industry. Maintaining the security or even secrecy of those innovations is paramount. In order to do that everyone involved must be clear on the concept. Unfortunately when I talk to people in the IT or IS fields protecting trade secrets is usually the kind of data protection that comes to mind. Now and again I meet IT pros, especially in accounting, financial advisory or mortgage firms, who are aware of the importance of protecting the clients personal files. Technical managers are by in large vaguely aware that personnel information is also at stake but that concept is usually rather abstract to them. They are more focused on the throughput of data, encryption algorithms, and the models that contain sufficient justified loops that will safeguard company data files from inadvertent loss or hacked from outside source, while being highly efficient and serving the enterprise more effectively. When I illustrate a case of an unhappy employee that has walked out of the building with the HR employee records on a flash drive to sell it at the local flea market, eyes will glaze over. That doesn’t compute in a technically focused infrastructure. Short of freezing everyone out of the records access there is no working model that will prevent that from occurring. And that is the point. Information that has value, to anyone, can and will be stolen and misused for personal gain. The solutions cannot be simply technical, but instead have to include employee training and awareness. That is why the recommendations within every federal identity theft prevention law include employee training.
It is also critical that companies understand that just as a loss of intellectual property can cripple a company so can the loss of personal information. In fact the loss of personal information has far reaching consequences that extend beyond the incident, and into the realm of public perception. When a company loses the confidence of the general public whether deserved or not, it becomes harder to maintain customers, attract new ones, operating capital is harder to get, and so forth. People believe that when a business is entrusted with their personal information that the company has a moral responsibility as well as a legal one to make every effort to protect it from thieves or accidental leaks.
Its just as important to trust certain employees as it is to have technical safeguards in place. Any culture of security has to have a balance of common sense, technical procedures, and individual education and training. Treat your employees with respect by educating them on the realities of what identity theft can do to a person. With an average of 10 million U.S. victims annually there is no shortage of real life stories of individual ruin from identity theft. If a business can manage to do that kind of training alone then the employees gain a knowledge to not only protect themselves and their families but also an insight and incentive to safeguard the personal information they handle on a daily basis at work. A business must sensibly bring the employees into the solution for data loss by training and education. An informed and empowered employee can very well be the best asset a company can have in stemming the tide of data losses of any kind within the enterprise. I’m sure your employees know what to do in the event of fire, but do they know what to do if they discover that information has been stolen or compromised? That critical path alone can make the difference in whether an attacker gets away with valuable information from your company or not. Don’t rely on the TV ads promising to “stop identity theft before it happens”, or other wild claims to train your staff. Thats kind of like relying on the teenagers in the neighborhood to teach the children about love and relationships, hardly what you want them to learn. Those ads are misleading and have little to do with the realities of identity theft in the every day world.
There is even an industry whose whole purpose is to aggregate, sort, re-sort, and sell data. See axciom , choicepoint. or MIB for good examples of that sort of company. These “specialty database” companies have the additional burden of compiling the personally identifiable information of people who are not their clients but instead comprise the very commodity that the business trades in, data.
In my previous career in engineering we were always developing techniques, specialized machines, or circuit designs that would help not only to propel our industry but also to attract customers to our business in particular. Innovation is essential to any industry. Maintaining the security or even secrecy of those innovations is paramount. In order to do that everyone involved must be clear on the concept. Unfortunately when I talk to people in the IT or IS fields protecting trade secrets is usually the kind of data protection that comes to mind. Now and again I meet IT pros, especially in accounting, financial advisory or mortgage firms, who are aware of the importance of protecting the clients personal files. Technical managers are by in large vaguely aware that personnel information is also at stake but that concept is usually rather abstract to them. They are more focused on the throughput of data, encryption algorithms, and the models that contain sufficient justified loops that will safeguard company data files from inadvertent loss or hacked from outside source, while being highly efficient and serving the enterprise more effectively. When I illustrate a case of an unhappy employee that has walked out of the building with the HR employee records on a flash drive to sell it at the local flea market, eyes will glaze over. That doesn’t compute in a technically focused infrastructure. Short of freezing everyone out of the records access there is no working model that will prevent that from occurring. And that is the point. Information that has value, to anyone, can and will be stolen and misused for personal gain. The solutions cannot be simply technical, but instead have to include employee training and awareness. That is why the recommendations within every federal identity theft prevention law include employee training.
It is also critical that companies understand that just as a loss of intellectual property can cripple a company so can the loss of personal information. In fact the loss of personal information has far reaching consequences that extend beyond the incident, and into the realm of public perception. When a company loses the confidence of the general public whether deserved or not, it becomes harder to maintain customers, attract new ones, operating capital is harder to get, and so forth. People believe that when a business is entrusted with their personal information that the company has a moral responsibility as well as a legal one to make every effort to protect it from thieves or accidental leaks.
Its just as important to trust certain employees as it is to have technical safeguards in place. Any culture of security has to have a balance of common sense, technical procedures, and individual education and training. Treat your employees with respect by educating them on the realities of what identity theft can do to a person. With an average of 10 million U.S. victims annually there is no shortage of real life stories of individual ruin from identity theft. If a business can manage to do that kind of training alone then the employees gain a knowledge to not only protect themselves and their families but also an insight and incentive to safeguard the personal information they handle on a daily basis at work. A business must sensibly bring the employees into the solution for data loss by training and education. An informed and empowered employee can very well be the best asset a company can have in stemming the tide of data losses of any kind within the enterprise. I’m sure your employees know what to do in the event of fire, but do they know what to do if they discover that information has been stolen or compromised? That critical path alone can make the difference in whether an attacker gets away with valuable information from your company or not. Don’t rely on the TV ads promising to “stop identity theft before it happens”, or other wild claims to train your staff. Thats kind of like relying on the teenagers in the neighborhood to teach the children about love and relationships, hardly what you want them to learn. Those ads are misleading and have little to do with the realities of identity theft in the every day world.
Monday, May 11, 2009
Data Leak Reveals Massive Security Problems
As I have said many times in this column I rarely write about specific instances of data theft or hacking into large servers at big organizations. The reason is simple, these incidents are so ubiquitous that they lose their impact. Recently U.C. Berkeley revealed that they have been hacked for a number of months to the tune of about 160,000 records. As stunning a revelation as that is I’m not going to comment on that at length. If you want to learn more about that go to http://www.mercurynews.com/.
What I think is more relevant to businesses today is this story.
NetworkWorld brings us inside the data leakage audit of a Boston-based pharmaceutical firm. During the 15-day review, auditors examined outbound e-mail, FTP and Web communications, revealing 11,000 potential leaks, more than 700 critical information leaks and violations of Payment Card Industry and other security standards. Among the "worst leaks:" confidential zip files and attachments sent by e-mail to an outside vendor; unencrypted e-mailing of a clinical study to an outside vendor; the mailing of employee compensation data to an outside company. "We thought we were in good shape..." said the company's CIO. "This just goes to show you can do all that and it's just not enough."
It is this kind of thing that business owners and executives need to read regarding identity theft compliance issues. I have never visited a business regardless of the industry they serve that does not need improvements in the way they handle sensitive documents, or personally indentifiable information of employees or customers. Even the best among companies who believe they are doing everything possible are at increased risk. As long as data has value it will be stolen or used for illicit purposes. Illegal data sale and identity theft are two very profitable kinds of crime with little chance of prosecution. I’ve mentioned before that the U.S. Secret Service, the agency charged with investigating identity theft crimes has gone on record saying that identity theft has surpassed the international drug trade as the most profitable crime in the world.
Every business no matter how large or small needs to accept that risk exists and initiate an identity theft compliance program appropriate to their business. It will only serve to increase the security of information in the company, and to lower the risk of a data leak or worse, identity theft resulting from personal information taken from the company.
What I think is more relevant to businesses today is this story.
NetworkWorld brings us inside the data leakage audit of a Boston-based pharmaceutical firm. During the 15-day review, auditors examined outbound e-mail, FTP and Web communications, revealing 11,000 potential leaks, more than 700 critical information leaks and violations of Payment Card Industry and other security standards. Among the "worst leaks:" confidential zip files and attachments sent by e-mail to an outside vendor; unencrypted e-mailing of a clinical study to an outside vendor; the mailing of employee compensation data to an outside company. "We thought we were in good shape..." said the company's CIO. "This just goes to show you can do all that and it's just not enough."
It is this kind of thing that business owners and executives need to read regarding identity theft compliance issues. I have never visited a business regardless of the industry they serve that does not need improvements in the way they handle sensitive documents, or personally indentifiable information of employees or customers. Even the best among companies who believe they are doing everything possible are at increased risk. As long as data has value it will be stolen or used for illicit purposes. Illegal data sale and identity theft are two very profitable kinds of crime with little chance of prosecution. I’ve mentioned before that the U.S. Secret Service, the agency charged with investigating identity theft crimes has gone on record saying that identity theft has surpassed the international drug trade as the most profitable crime in the world.
Every business no matter how large or small needs to accept that risk exists and initiate an identity theft compliance program appropriate to their business. It will only serve to increase the security of information in the company, and to lower the risk of a data leak or worse, identity theft resulting from personal information taken from the company.
Friday, May 8, 2009
State Secrets for Sale?
Just in case you might think that data theft is something that happens to a few hapless individuals who are lax with their Social Security number read this.
The latest results in a five-years-running study might prompt some to review data destruction policies. University researchers in the U.K., Australia, and the U.S. purchased 300 drives from eBay and other retailers, finding that 34 percent of disk drives still contained confidential data. Banking details, blueprints, patient records, employee data, embassy logs and details on a ground-to-air missile defense system were among the data left behind. Study leads at the University of Glamorgan in Wales say that over the past five years the volume of drives containing sensitive data has fallen, but the volume of data exposed has increased.
Full Story
In my efforts to assist businesses with their identity theft prevention programs one of the areas that we try to cover is the disposal of hard drives. This article illustrates how important this is. Whenever replacing drives or exchanging computers make certain that drives are disabled. The sure fire way to do that is to break the disk or drive a nail through it. Under certain circumstances the data on a wiped disk drive can be recovered. Flash (solid state) drives should be physically destroyed when they are taken from service.
Another issue in the workplace is photocopiers. A copy machine can store thousands of documents in its memory. Since most businesses lease commercial copiers it is essential that the machines' drives be wiped clean before returning it to the supplier. The service technician for the leasing company knows how to format the copier drives, and should do that prior to removing the machine from the clients' office.
The latest results in a five-years-running study might prompt some to review data destruction policies. University researchers in the U.K., Australia, and the U.S. purchased 300 drives from eBay and other retailers, finding that 34 percent of disk drives still contained confidential data. Banking details, blueprints, patient records, employee data, embassy logs and details on a ground-to-air missile defense system were among the data left behind. Study leads at the University of Glamorgan in Wales say that over the past five years the volume of drives containing sensitive data has fallen, but the volume of data exposed has increased.
Full Story
In my efforts to assist businesses with their identity theft prevention programs one of the areas that we try to cover is the disposal of hard drives. This article illustrates how important this is. Whenever replacing drives or exchanging computers make certain that drives are disabled. The sure fire way to do that is to break the disk or drive a nail through it. Under certain circumstances the data on a wiped disk drive can be recovered. Flash (solid state) drives should be physically destroyed when they are taken from service.
Another issue in the workplace is photocopiers. A copy machine can store thousands of documents in its memory. Since most businesses lease commercial copiers it is essential that the machines' drives be wiped clean before returning it to the supplier. The service technician for the leasing company knows how to format the copier drives, and should do that prior to removing the machine from the clients' office.
Thursday, May 7, 2009
Ongoing Issues at the FTC
Here are some issues the FTC currently has on the table with regard to data security and privacy.
Posted Tuesday, May 05, 2009 - Staff infoZine1.
1. The Federal Trade Commission testified on the Commission’s efforts to promote better security for sensitive consumer information and to prevent the inadvertent sharing of consumers’ personal or sensitive data over Peer-to-Peer Internet file-sharing networks. As part of these efforts, the agency also announced that it had reached an agreement with one of the largest privately held lenders in the United States to resolve charges that the company violated federal law by failing to provide reasonable security for consumers’ sensitive information.
2. In testimony before the House Energy and Commerce Committee Subcommittee on Commerce, Trade and Consumer Protection, Acting Director of the Bureau of Consumer Protection Eileen Harrington said the agency strongly supports the goals of H.R. 2221, the Data Accountability and Trust Act, which would require companies to put reasonable data security policies and procedures in place, and to notify consumers when there has been a data security breach that affects them. The legislation also would give the Commission the authority to obtain civil penalties for violations.“A critical element of privacy is data security. If companies do not protect the sensitive consumer information that they collect and store, that information could fall into the wrong hands, resulting in fraud and other harm, and consumers could lose confidence in the marketplace,” the testimony stated.
3. The Commission made two further recommendations regarding the data security legislation: It suggested that the legislation be extended to cover data stored on paper, as well as electronic data. It also recommended that certain provisions imposing obligations on information brokers – companies whose business is to collect and sell information about individuals who are not their customers – be targeted specifically to address harms consumers may face when brokers sell information about them, to the extent that such harms are not already addressed by federal law. These provisions should not displace existing legal protections.The FTC currently enforces several laws that restrict the disclosure of consumer information and require companies to ensure the security and integrity of the data in certain contexts: the Fair Credit Reporting Act restricts disclosure of consumer credit reports except for specified permissible purposes; the Gramm-Leach-Bliley Act imposes privacy and security obligations on financial institutions; and the FTC Act prohibits unfair or deceptive acts or practices in or affecting commerce.
4. Using its authority under these laws, the testimony noted, the Commission has brought 26 law enforcement actions since 2001 against companies that allegedly failed to maintain reasonable procedures to protect consumers’ personal information, including a case the agency has just settled against James B. Nutter & Company. The company is based in Missouri and makes and services residential mortgage loans around the country. It collects information from loan applicants, including their Social Security numbers, financial information, and employment and credit histories. The Commission’s complaint alleges that, beginning in 2004, JBN engaged in a number of practices that taken together failed to provide reasonable and appropriate security for sensitive consumer information, in violation of the FTC’s Safeguards Rule. In addition, the complaint alleges that the company violated the FTC’s Privacy Rule by failing to provide privacy notices and, later, providing notices that were inaccurate. To settle these charges, JBN has agreed to a proposed order that would require it to establish and maintain a comprehensive data security program covering consumers’ personal information, and to hire an independent auditor to assess its security procedures every two years for 10 years, and to certify that these procedures comply with the proposed order. The proposed order also bars JBN from violating the agency’s Safeguards and Privacy Rules.The Commission previously has filed data security cases against retailers TJX, CVS Caremark and DSW Shoe Warehouse, and the data brokers ChoicePoint and Reed Elsevier, Inc., which operates Lexis Nexis and Seisint, Inc. The FTC also promotes better data security practices through extensive consumer and business education, the testimony stated. On the policymaking front, the FTC recently proposed a rule that would require that consumers be notified when the security of their health information is breached. In addition, the FTC is examining privacy issues associated with behavioral advertising and the use of personal health records and cloud computing networks.
5. The testimony also details the Commission’s activities with regard to inadvertent file sharing on P2P networks. Although P2P technologies hold potential benefits for computer users and businesses, they also can raise the risk that sensitive information will be made available over P2P networks, either through inadvertent sharing or through malware. The testimony noted that the agency has brought cases related to P2P file sharing, has helped P2P software developers devise voluntary best practices to help consumers prevent inadvertent file sharing, and continues to monitor efforts by companies to comply with these practices. The Commission also has held a workshop on P2P, issued a report, and alerted consumers to the risk of inadvertent file sharing. The testimony stated that the Commission also is supportive of H.R.1319, the Informed P2P User Act, legislation that would set a minimum standard for P2P software companies to follow in notifying consumers about what files a P2P program will share, and in obtaining consent from consumers before the files are made available. The FTC will publish an announcement regarding the agreement in the Federal Register shortly. The agreement will be subject to public comment for 30 days, beginning today and continuing through June 8, 2009, after which the Commission will decide whether to make it final. To file a public comment, please click on the following hyperlink:
http://www.ftc.gov/os/2009/05/0723108publiccomment.pdf and follow the instructions at that site.
We are seeing, among other things from the existing laws and the new bills being introduced by Congress, a new direction in privacy and data security legislation. The convergence of these discussions suggests that a common set of compliance and consumer notification regulations are nearer than previously thought. There are laws that focus on financial data, medical data, usage of Social Security numbers, credit cards and so forth. Until now each of these is based on a different set of data. As the new Red Flags Rule points out there is no real significance in the type of data as long as the data has a value to criminals and those who do not seek to protect but exploit the data. This kind of thinking is creating the unification of regulatory practices proposed by new bills such as HR. 2221.
Theft or loss of sensitive personal information, or the exploitation of sensitive information without regard to individual privacy cannot be tolerated in any form. Neither can failing to notify individuals who might be at increased risk. The responsibility to safeguard sensitive personal information is squarely on the shoulders of industry and government agencies that use and store the information. It is obvious that industry will not police itself as seems to also be true in our current economic crisis.
It is therefore inevitable given that reality that the regulating authority will step in and create a set of guidelines to compel industry to comply. I would urge every business and local government authority to pay close attention to these discussions above and realize that identity theft and data theft are with us, perhaps permanently, and will require diligence on everyones part, just as we do in other areas of modern life..
Posted Tuesday, May 05, 2009 - Staff infoZine1.
1. The Federal Trade Commission testified on the Commission’s efforts to promote better security for sensitive consumer information and to prevent the inadvertent sharing of consumers’ personal or sensitive data over Peer-to-Peer Internet file-sharing networks. As part of these efforts, the agency also announced that it had reached an agreement with one of the largest privately held lenders in the United States to resolve charges that the company violated federal law by failing to provide reasonable security for consumers’ sensitive information.
2. In testimony before the House Energy and Commerce Committee Subcommittee on Commerce, Trade and Consumer Protection, Acting Director of the Bureau of Consumer Protection Eileen Harrington said the agency strongly supports the goals of H.R. 2221, the Data Accountability and Trust Act, which would require companies to put reasonable data security policies and procedures in place, and to notify consumers when there has been a data security breach that affects them. The legislation also would give the Commission the authority to obtain civil penalties for violations.“A critical element of privacy is data security. If companies do not protect the sensitive consumer information that they collect and store, that information could fall into the wrong hands, resulting in fraud and other harm, and consumers could lose confidence in the marketplace,” the testimony stated.
3. The Commission made two further recommendations regarding the data security legislation: It suggested that the legislation be extended to cover data stored on paper, as well as electronic data. It also recommended that certain provisions imposing obligations on information brokers – companies whose business is to collect and sell information about individuals who are not their customers – be targeted specifically to address harms consumers may face when brokers sell information about them, to the extent that such harms are not already addressed by federal law. These provisions should not displace existing legal protections.The FTC currently enforces several laws that restrict the disclosure of consumer information and require companies to ensure the security and integrity of the data in certain contexts: the Fair Credit Reporting Act restricts disclosure of consumer credit reports except for specified permissible purposes; the Gramm-Leach-Bliley Act imposes privacy and security obligations on financial institutions; and the FTC Act prohibits unfair or deceptive acts or practices in or affecting commerce.
4. Using its authority under these laws, the testimony noted, the Commission has brought 26 law enforcement actions since 2001 against companies that allegedly failed to maintain reasonable procedures to protect consumers’ personal information, including a case the agency has just settled against James B. Nutter & Company. The company is based in Missouri and makes and services residential mortgage loans around the country. It collects information from loan applicants, including their Social Security numbers, financial information, and employment and credit histories. The Commission’s complaint alleges that, beginning in 2004, JBN engaged in a number of practices that taken together failed to provide reasonable and appropriate security for sensitive consumer information, in violation of the FTC’s Safeguards Rule. In addition, the complaint alleges that the company violated the FTC’s Privacy Rule by failing to provide privacy notices and, later, providing notices that were inaccurate. To settle these charges, JBN has agreed to a proposed order that would require it to establish and maintain a comprehensive data security program covering consumers’ personal information, and to hire an independent auditor to assess its security procedures every two years for 10 years, and to certify that these procedures comply with the proposed order. The proposed order also bars JBN from violating the agency’s Safeguards and Privacy Rules.The Commission previously has filed data security cases against retailers TJX, CVS Caremark and DSW Shoe Warehouse, and the data brokers ChoicePoint and Reed Elsevier, Inc., which operates Lexis Nexis and Seisint, Inc. The FTC also promotes better data security practices through extensive consumer and business education, the testimony stated. On the policymaking front, the FTC recently proposed a rule that would require that consumers be notified when the security of their health information is breached. In addition, the FTC is examining privacy issues associated with behavioral advertising and the use of personal health records and cloud computing networks.
5. The testimony also details the Commission’s activities with regard to inadvertent file sharing on P2P networks. Although P2P technologies hold potential benefits for computer users and businesses, they also can raise the risk that sensitive information will be made available over P2P networks, either through inadvertent sharing or through malware. The testimony noted that the agency has brought cases related to P2P file sharing, has helped P2P software developers devise voluntary best practices to help consumers prevent inadvertent file sharing, and continues to monitor efforts by companies to comply with these practices. The Commission also has held a workshop on P2P, issued a report, and alerted consumers to the risk of inadvertent file sharing. The testimony stated that the Commission also is supportive of H.R.1319, the Informed P2P User Act, legislation that would set a minimum standard for P2P software companies to follow in notifying consumers about what files a P2P program will share, and in obtaining consent from consumers before the files are made available. The FTC will publish an announcement regarding the agreement in the Federal Register shortly. The agreement will be subject to public comment for 30 days, beginning today and continuing through June 8, 2009, after which the Commission will decide whether to make it final. To file a public comment, please click on the following hyperlink:
http://www.ftc.gov/os/2009/05/0723108publiccomment.pdf and follow the instructions at that site.
We are seeing, among other things from the existing laws and the new bills being introduced by Congress, a new direction in privacy and data security legislation. The convergence of these discussions suggests that a common set of compliance and consumer notification regulations are nearer than previously thought. There are laws that focus on financial data, medical data, usage of Social Security numbers, credit cards and so forth. Until now each of these is based on a different set of data. As the new Red Flags Rule points out there is no real significance in the type of data as long as the data has a value to criminals and those who do not seek to protect but exploit the data. This kind of thinking is creating the unification of regulatory practices proposed by new bills such as HR. 2221.
Theft or loss of sensitive personal information, or the exploitation of sensitive information without regard to individual privacy cannot be tolerated in any form. Neither can failing to notify individuals who might be at increased risk. The responsibility to safeguard sensitive personal information is squarely on the shoulders of industry and government agencies that use and store the information. It is obvious that industry will not police itself as seems to also be true in our current economic crisis.
It is therefore inevitable given that reality that the regulating authority will step in and create a set of guidelines to compel industry to comply. I would urge every business and local government authority to pay close attention to these discussions above and realize that identity theft and data theft are with us, perhaps permanently, and will require diligence on everyones part, just as we do in other areas of modern life..
Subscribe to:
Posts (Atom)
