Techno-Legal Motivation
|
|
|
- Joseph Kelly
- 10 years ago
- Views:
Transcription
1 SEcure Cloud computing for CRitical Infrastructure IT Techno-Legal Motivation Ass. iur. Silvia Balaban 24/11/2015 AIT Austrian Institute of Technology ETRA Investigación y Desarrollo Fraunhofer Institute for Experimental Software Engineering IESE Karlsruhe Institute of Technology NEC Europe Lancaster University Mirasys Hellenic Telecommunications Organization OTE Ayuntamiento de Valencia Amaris
2 Introduction - Objective What are the legal requirements in cloud computing cases? How can the technical properties of cloud computing comply with the legal requirements? Why?: techno-legal assessment from the very beginning in order to foster the conformance of the system with regulatory constraints ( Compliance by Design ) SECCRIT Consortium 2
3 Introduction Law Fields Evidence Law Data Protection Law Disclose facts in order to win a lawsuit P Protection of the informational selfdetermination, which can be infringed by handling personal data P Disclose for Proofs optimisation Data Minimization SECCRIT Consortium 3
4 What are the legal requirements in cloud computing cases? SECCRIT Consortium 4
5 Evidence Law SECCRIT Consortium 5
6 Current Situation Evidence Law o First Case: A cloud user (A) has a contract with a cloud provider (B), that one commits a breach of duty and the cloud user has a damage. The cloud user wants to get his damage compensated, so he sues the cloud provider. Cloud User Cloud Provider o Second Case: The cloud user has a contract with a client and requires for the fulfillment of the contract a cloud-based solution. He has for this a contract with the cloud provider. That one commits a breach of duty and it is the client of the cloud user who has a damage. Client sues the cloud user. Client Cloud User Cloud Provider SECCRIT Consortium 6
7 Evaluating the first Case Contract Fault Default Damage Cloud USER Document Legal inspection/expert evidence/witness/ document Legal inspection/expert evidence/witness/ document Cloud PROVIDER Document/ Witness/Exp ert Evidence SECCRIT Consortium 7
8 Current Situation Evidence Law Plaintiff Defendant Contract, fault, damage, causal link between damage and fault default
9 Evaluating the first Case Cloud User: Contradict non-default of provider? o Legal inspection Own perception difficult as past incident o Witness Only in sphere of the provider, employee of the provider o Document All documents in sphere of the provider, no insight view o Expert evidence Difficult to retrace what caused the fault Only assess documents of provider NOT NEUTRAL Cloud user loses lawsuit lack of useable proofs SECCRIT Consortium 9
10 Evaluating the Second Case Client: o documents, legal inspection, witness proof Cloud user: o o prove that he did not act negligent prove that provider did not act negligent What caused the damage? Cloud user, made passwords accessible? o o Proving situation of first case wasn t provider, still cloud user needs to disprove own possible negligent behavior Prove of existence of damage proves fault SECCRIT Consortium 10
11 Evaluating the Second Use Case For proving that it was not the cloud user: o Witness: needs to testify about negative facts o Document cannot prove all possible non acting/acting situations o Expert evidence: difficult to retrace negligent behavior Cloud user s own default remains unclear: cloud user loses lawsuit Provider s fault: Cloud user loses lawsuit o Third party notice for second lawsuit in order to gain a title against provider SECCRIT Consortium 11
12 Evidence Law Challenges Usual evidence in court presumably not suitable in cloud scenarios because of multiplicity of acting parties and technical complexity Cloud user has no inside view can hardly prove default Cloud user has no access to required evidence Cloud user s legal position is weak! SECCRIT Consortium 12
13 Data Protection Law SECCRIT Consortium 13
14 Current situation - Data Protection Law Protection of the informational self-determination, which can be infringed by handling personal Data Subject personal data: information relating to an identified or identifiable natural person (data subject) Controller determines the purposes and means of the processing of personal data Processor processes personal data on behalf of the controller Processing: collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction SECCRIT Consortium 14
15 Current Situation Data Protection Law Data subject has access rights, information rights etc. Only against cloud user (processing on behalf of the controller) Cloud provider and cloud user are counting as one unit, provider is only processor SECCRIT Consortium 15
16 Current Situation Data Protection Law Data subject has rights which user needs to fulfill Cloud user has to control cloud provider merely done by certification Is based on trusting the cloud provider How to solve fulfillment of data subjects right by user if no inside view is given Lack of transparency, lack of control SECCRIT Consortium 16
17 How can the technical properties of cloud computing comply with the legal requirements? SECCRIT Consortium 17
18 Cloud-specific Givens leading to legal problems: Black Box Nature: Data processing is not visible! Evidence Law Data Protection Law SECCRIT Consortium 18
19 Fulfilling the legal requirements Anomaly Detection Techniques and Tools Policy Decision and Enforcement Tools Establish best practices for secure cloud service implementations Model Driven Cloud Security Guidelines Policy Specification Methodology and Tool Risk Assessment and Management Methodology Understand cloud behavior in the face of challenges Cloud Resilience Management Framework Legal Guidance on Data Protection and Evidence Understand and manage risk associated with cloud environments Tools for Audit Trails and Root Cause Analysis Demo 1: Storage and Processing of Sensitive Data Demonstration of output in real-world application scenarios Demo 2: Hosting Critical Urban Mobility Services Cloud Assurance Profile and Evaluation Method SECCRIT Consortium 19
20 SECCRIT Outputs SECCRIT Consortium 20
21 Summary SECCRIT Consortium 21
22 SEcure Cloud computing for CRitical Infrastructure IT Contact Ass. iur. Silvia Balaban KIT, Center for Applied Legal Studies AIT Austrian Institute of Technology ETRA Investigación y Desarrollo Fraunhofer Institute for Experimental Software Engineering IESE Karlsruhe Institute of Technology NEC Europe Lancaster University Mirasys Hellenic Telecommunications Organization OTE Ayuntamiento de Valencia Amaris
Cloud Inspector A Cooperative Tool to Increase Trust in Cloud Computing
SEcure computing for CRitical IT Inspector A Cooperative Tool to Increase Trust in Computing Roland Bless, Matthias Flittner, Robert Bauer Karlsruhe Institute of Technology (KIT) {bless, flittner, robert.bauer}@kit.edu
Secure Cloud Computing for Critical Infrastructures
SEcure Cloud computing for CRitical Infrastructure IT Secure Cloud Computing for Critical Infrastructures Aleksandar Hudic and Christian Wagner AIT Austrian Institute of Technology AIT Austrian Institute
High Assurance in Multi-Layer Cloud Infrastructures
SEcure Cloud computing for CRitical Infrastructure IT High Assurance in Multi-Layer Cloud Infrastructures PhD Research Agenda[1] Austrian Institute of Technology (AIT) / Technical Univsersity of Vienna
How can security requirements of critical Infrastructure IT shape Cloud Computing research?
SEcure Clud cmputing fr CRitical Infrastructure IT Hw can security requirements f critical Infrastructure IT shape Clud Cmputing research? Dr. Markus Tauber [email protected] Austrian Institute f
Data protection policy
Data protection policy Introduction 1 This document is the data protection policy for the Nursing and Midwifery Council (NMC). 2 The Data Protection Act 1998 (DPA) governs the processing of personal data
How To Write A Secure Cloud Computing For Critical Infrastructure
SEcure Clud cmputing fr CRitical Infrastructure IT Methds and Technlgies fr Secure Clud Cmputing fr Critical InfrastructureIT Dr Markus Tauber SECCRIT Crdinatr AIT Austrian Institute f Technlgy AIT Austrian
CLOUD COMPUTING FOR ehealth DATA PROTECTION ISSUES
CLOUD COMPUTING FOR ehealth DATA PROTECTION ISSUES GLOBAL FORUM 2009 ICT & The Future of the Internet - Monday, October 19 th 2009 [email protected] Introduction & Structure ENISA Working Group
Data controllers and data processors: what the difference is and what the governance implications are
ICO lo : what the difference is and what the governance implications are Data Protection Act Contents Introduction... 3 Overview... 3 Section 1 - What is the difference between a data controller and a
Data Processing Agreement for Oracle Cloud Services
Data Processing Agreement for Oracle Cloud Services Version December 1, 2013 1. Scope and order of precedence This is an agreement concerning the Processing of Personal Data as part of Oracle s Cloud Services
Council Policy. Records & Information Management
Council Policy Records & Information Management COUNCIL POLICY RECORDS AND INFORMATION MANAGEMENT Policy Number: GOV-13 Responsible Department(s): Information Systems Relevant Delegations: None Other Relevant
Processor Binding Corporate Rules (BCRs), for intra-group transfers of personal data to non EEA countries
Processor Binding Corporate Rules (BCRs), for intra-group transfers of personal data to non EEA countries Sopra HR Software as a Data Processor Sopra HR Software, 2014 / Ref. : 20141120-101114-m 1/32 1.
GUIDE TO THE ISLE OF MAN DATA PROTECTION ACT. CONTENTS PREFACE 1 1. Background 2 2. Data Protections Principles 3 3. Notification Requirements 4
GUIDE TO THE ISLE OF MAN DATA PROTECTION ACT CONTENTS PREFACE 1 1. Background 2 2. Data Protections Principles 3 3. Notification Requirements 4 PREFACE The following provides general guidance on data protection
ON MUTUAL COOPERATION AND THE EXCHANGE OF INFORMATION RELATED TO THE OVERSIGHT OF AUDITORS
Mr. Ryutaro Hatanaka Commissioner Financial Services Agency Government of Japan 3-2-1 Kasumigaseki Chiyoda-ku, Tokyo Japan 100-8967 Dr. Kunio Chiyoda Chairman Certified Public Accountants and Auditing
Cloud Software Services for Schools
Cloud Software Services for Schools Supplier self-certification statements with service and support commitments Supplier name Address Contact name Contact email Contact telephone Parent Teacher Online
Data Protection Act 1998. Guidance on the use of cloud computing
Data Protection Act 1998 Guidance on the use of cloud computing Contents Overview... 2 Introduction... 2 What is cloud computing?... 3 Definitions... 3 Deployment models... 4 Service models... 5 Layered
NPSA GENERAL PROVISIONS
NPSA GENERAL PROVISIONS 1. Independent Contractor. A. It is understood and agreed that CONTRACTOR (including CONTRACTOR s employees) is an independent contractor and that no relationship of employer-employee
Third Party Litigation Funding
OVERVIEW Third party litigation funding (TPLF) is the practice where an outside party, with no direct interest in the claim, pays for the cost of a lawsuit in exchange for a portion or percentage of any
How To Understand The Data Protection Act
DATA PROTECTION ACT 2002 The Basics Purpose of the Act Balance the rights of an individual with an organisation s legitimate need to process personal data Promote openness and transparency Establish and
Products Liability: Putting a Product on the U.S. Market. Natalia R. Medley Crowell & Moring LLP 14 November 2012
Products Liability: Putting a Product on the U.S. Market Natalia R. Medley Crowell & Moring LLP 14 November 2012 Overview Regulation of Products» Federal agencies» State laws Product Liability Lawsuits»
Spoliation of Evidence. Prepared for:
Spoliation of Evidence Prepared for: Spoliation Nationwide anti-spoliation trend Cases can be thrown out of court Insurers can be denied subrogation claims An insured who destroys evidence of a claim can
Guidelines on Data Protection. Draft. Version 3.1. Published by
Guidelines on Data Protection Draft Version 3.1 Published by National Information Technology Development Agency (NITDA) September 2013 Table of Contents Section One... 2 1.1 Preamble... 2 1.2 Authority...
Clause 1. Definitions and Interpretation
[Standard data protection [agreement/clauses] for the transfer of Personal Data from the University of Edinburgh (as Data Controller) to a Data Processor within the European Economic Area ] In this Agreement:-
FIRST DATA CORPORATION PROCESSOR DATA PROTECTION STANDARDS
FIRST DATA CORPORATION PROCESSOR DATA PROTECTION STANDARDS As a world leader in electronic commerce and payment services, First Data Corporation and its subsidiaries ( First Data entity or entities ),
HIPAA BUSINESS ASSOCIATE AGREEMENT
HIPAA BUSINESS ASSOCIATE AGREEMENT This HIPAA Business Associate Agreement ( Agreement ) is by and between ( Covered Entity ) and Xelex Digital, LLC ( Business Associate ), and is effective as of. WHEREAS,
DOCUMENT RETENTION STRATEGIES FOR HEALTHCARE ORGANIZATIONS
Overview. DOCUMENT RETENTION STRATEGIES FOR HEALTHCARE ORGANIZATIONS A comprehensive and consistently applied document retention policy is necessary to reduce the risk of being charged with spoliation
The potential legal consequences of a personal data breach
The potential legal consequences of a personal data breach Tue Goldschmieding, Partner 16 April 2015 The potential legal consequences of a personal data breach 15 April 2015 Contents 1. Definitions 2.
Exhibit 2. Business Associate Addendum
Exhibit 2 Business Associate Addendum This Business Associate Addendum ( Addendum ) governs the use and disclosure of Protected Health Information by EOHHS when functioning as a Business Associate in performing
Cloud Software Services for Schools
Cloud Software Services for Schools Supplier self-certification statements with service and support commitments Please insert supplier details below Supplier name Address Isuz Ltd. trading as Schoolcomms
ECSA EuroCloud Star Audit Data Privacy Audit Guide
ECSA EuroCloud Star Audit Data Privacy Audit Guide Page 1 of 15 Table of contents Introduction... 3 ECSA Data Privacy Rules... 4 Governing Law... 6 Sub processing... 6 A. TOMs: Cloud Service... 7 TOMs:
HERTSMERE BOROUGH COUNCIL
HERTSMERE BOROUGH COUNCIL DATA PROTECTION POLICY October 2007 1 1. Introduction Hertsmere Borough Council ( the Council ) is fully committed to compliance with the requirements of the Data Protection Act
Data Protection Policy
Data Protection Policy September 2015 Contents 1. Scope 2. Purpose 3. Data protection roles 4. Staff training and guidance 5. About the Data Protection Act 1998 6. Policy 7. The Information Commissioner's
Information Security Policy September 2009 Newman University IT Services. Information Security Policy
Contents 1. Statement 1.1 Introduction 1.2 Objectives 1.3 Scope and Policy Structure 1.4 Risk Assessment and Management 1.5 Responsibilities for Information Security 2. Compliance 3. HR Security 3.1 Terms
The Effect of Product Safety Regulatory Compliance
PRODUCT LIABILITY Product Liability Litigation The Effect of Product Safety Regulatory Compliance By Kenneth Ross Product liability litigation and product safety regulatory activities in the U.S. and elsewhere
Scotland s Commissioner for Children and Young People Records Management Policy
Scotland s Commissioner for Children and Young People Records Management Policy 1 RECORDS MANAGEMENT POLICY OVERVIEW 2 Policy Statement 2 Scope 2 Relevant Legislation and Regulations 2 Policy Objectives
Appendix 11 - Swiss Data Protection Act
GLEIF- LOU Restricted Appendix 11 - Swiss Data Protection Act GLEIF Revision Version: 1.0 2015-09-23 Master Copy page 2 of 11 Applicable Provisions of the Swiss Data Protection Act (DPA) including the
Corporate ICT & Data Management. Data Protection Policy
90 Corporate ICT & Data Management Data Protection Policy Classification: Unclassified Date Created: January 2012 Date Reviewed January Version: 2.0 Author: Owner: Data Protection Policy V2 1 Version Control
How To Protect Your Data In European Law
Corporate Data Protection Code of Conduct for the Protection of the Individual s Right to Privacy in the Handling of Personal Data within the Deutsche Telekom Group 2010 / 04 We make ICT strategies work
Solutions for Health Insurance Portability and Accountability Act (HIPAA) Compliance
White Paper Solutions for Health Insurance Portability and Accountability Act (HIPAA) Compliance Troy Herrera Sr. Field Solutions Manager Juniper Networks, Inc. 1194 North Mathilda Avenue Sunnyvale, CA
CREATIVE SOLUTIONS IN HEALTHCARE, INC. Privacy Policy
CREATIVE SOLUTIONS IN HEALTHCARE, INC. Privacy Policy Amended as of February 12, 2010 on the authority of the HIPAA Privacy Officer for Creative Solutions in Healthcare, Inc. TABLE OF CONTENTS ARTICLE
INDEPENDENT CONTRACTOR AGREEMENT
INDEPENDENT CONTRACTOR AGREEMENT This Independent Contractor Agreement ("Agreement") is made and effective this day of, 20. BETWEEN: (the "Independent Contractor"), a company organized and existing under
Article 29 Working Party Issues Opinion on Cloud Computing
Client Alert Global Regulatory Enforcement If you have questions or would like additional information on the material covered in this Alert, please contact one of the authors: Cynthia O Donoghue Partner,
Practical Overview on responsibilities of Data Protection Officers. Security measures
Practical Overview on responsibilities of Data Protection Officers Security measures Manuel Villaseca Spanish Data Protection Agency [email protected] Security measures Agenda: The rol of DPO on security measures
Information Security Team
Title Document number Add document Document status number Draft Owner Approver(s) CISO Information Security Team Version Version history Version date 0.01-0.05 Initial drafts of handbook 26 Oct 2015 Preface
Personal Data Act (1998:204);
Personal Data Act (1998:204); issued 29 April 1998. Be it enacted as follows. General provisions Purpose of this Act Section 1 The purpose of this Act is to protect people against the violation of their
We use such personal information collected through this Site for the purposes of:
PRIVACY POLICY Your privacy is important to Us. We treat it, and any information that you give to Us, with as much care as possible. Please read the following policy to understand what We do with your
Using AWS in the context of Australian Privacy Considerations October 2015
Using AWS in the context of Australian Privacy Considerations October 2015 (Please consult https://aws.amazon.com/compliance/aws-whitepapers/for the latest version of this paper) Page 1 of 13 Overview
Professional Solutions Insurance Company. Business Associate Agreement re HIPAA Rules
Professional Solutions Insurance Company Business Associate Agreement re HIPAA Rules I. Purpose of Agreement This Agreement reflects Professional Solutions Insurance Company s agreement to comply with
RAYSAFE S1 SECURITY WHITEPAPER VERSION B. RaySafe S1 SECURITY WHITEPAPER
RaySafe S1 SECURITY WHITEPAPER Contents 1. INTRODUCTION 2 ARCHITECTURE OVERVIEW 2.1 Structure 3 SECURITY ASPECTS 3.1 Security Aspects for RaySafe S1 Data Collector 3.2 Security Aspects for RaySafe S1 cloud-based
Right to Financial Privacy Act
Background The Right to Financial Privacy Act of 1978 was enacted to provide the financial records of financial institution customers a reasonable amount of privacy from federal government scrutiny. The
RULE 39 OFFER TO SETTLE
RULE 39 OFFER TO SETTLE Definitions (1) In this rule: Where available "defendant" includes "respondent"; "double costs" means double the fees allowed under Rule 60(2) and includes the disbursements allowed
Cloud security architecture
ericsson White paper Uen 284 23-3244 January 2015 Cloud security architecture from process to deployment The Trust Engine concept and logical cloud security architecture presented in this paper provide
Smart Open Services for European Patients Open ehealth initiative for a European large scale pilot of patient summary and electronic prescription
Smart Open Services for European Patients Open ehealth initiative for a European large scale pilot of patient summary and electronic prescription Deliverable: Work Package Document WP3.7 D.3.7.2. FINAL
Electronic Document and Record Compliance for the Life Sciences
Electronic Document and Record Compliance for the Life Sciences Kiran Thakrar, SoluSoft Inc. SoluSoft, Inc. 300 Willow Street South North Andover, MA 01845 Website: www.solu-soft.com Email: [email protected]
New HIPAA regulations require action. Are you in compliance?
New HIPAA regulations require action. Are you in compliance? Mary Harrison, JD Tami Simon, JD May 22, 2013 Discussion topics Introduction Remembering the HIPAA Basics HIPAA Privacy Rules HIPAA Security
Information Security Policies. Version 6.1
Information Security Policies Version 6.1 Information Security Policies Contents: 1. Information Security page 3 2. Business Continuity page 5 3. Compliance page 6 4. Outsourcing and Third Party Access
Align Technology. Data Protection Binding Corporate Rules Processor Policy. 2014 Align Technology, Inc. All rights reserved.
Align Technology Data Protection Binding Corporate Rules Processor Policy Confidential Contents INTRODUCTION TO THIS POLICY 3 PART I: BACKGROUND AND ACTIONS 4 PART II: PROCESSOR OBLIGATIONS 6 PART III:
Multi-Jurisdictional Study: Cloud Computing Legal Requirements. Julien Debussche Associate January 2015
Multi-Jurisdictional Study: Cloud Computing Legal Requirements Julien Debussche Associate January 2015 Content 1. General Legal Framework 2. Data Protection Legal Framework 3. Security Requirements 4.
White Paper Security. Data Protection and Security in School Management Systems
White Paper Security Data Protection and Security in School Management Systems This paper clarifies the roles and responsibilities of those dealing with the data that is central to school management systems.
INFORMATION TECHNOLOGY SECURITY STANDARDS
INFORMATION TECHNOLOGY SECURITY STANDARDS Version 2.0 December 2013 Table of Contents 1 OVERVIEW 3 2 SCOPE 4 3 STRUCTURE 5 4 ASSET MANAGEMENT 6 5 HUMAN RESOURCES SECURITY 7 6 PHYSICAL AND ENVIRONMENTAL
MAQUET SAS GENERAL TERMS AND CONDITIONS OF PURCHASE
MAQUET SAS GENERAL TERMS AND CONDITIONS OF PURCHASE (Version July 2014) 1. DEFINITIONS «Conditions» means these General Terms and Conditions of Purchase. «Products» means products and / or services such
on the transfer of personal data from the European Union
on the transfer of personal data from the European Union BCRsseptembre 2008.doc 1 TABLE OF CONTENTS I. PRELIMINARY REMARKS 3 II. DEFINITIONS 3 III. DELEGATED DATA PROTECTION MANAGER 4 IV. MICHELIN GROUP
Personal Injury Litigation
Personal Injury Litigation The Anatomy of a New York Personal Injury Lawsuit An ebook by Stuart DiMartini, Esq. 1325 Sixth Avenue, 27 th Floor New York, NY 10019 212-5181532 dimartinilaw.com Introduction
Sample Business Associate Agreement Provisions
Sample Business Associate Agreement Provisions Words or phrases contained in brackets are intended as either optional language or as instructions to the users of these sample provisions. Definitions Catch-all
Application Programming Interface (API) Application (app) - The API app is the connector between epages and the developers service.
Developer Program 0. Preamble epages is the owner and vendor of the online shop software epages which enables merchants to run their online shop in the cloud. epages provides a developer program for third
Office of the Data Protection Commissioner of The Bahamas. Data Protection (Privacy of Personal Information) Act, 2003. A Guide for Data Controllers
Office of the Data Protection Commissioner of The Bahamas Data Protection (Privacy of Personal Information) Act, 2003 A Guide for Data Controllers 1 Acknowledgement Some of the information contained in
BROKER/AGENT INFORMATION PAGE RETS IDX
FRESNO ASSOCIATION OF REALTORS IDX / RETS Compliance 6720 N West Ave. Fresno, CA 93711 (559) 490-6400 ~ [email protected] BROKER/AGENT INFORMATION PAGE RETS IDX IN WITNESS WHEREOF, the parties hereto
Information Governance Policy
Information Governance Policy Version: Revised: Consultation: Ratified by: 1.0 Information Governance Committee Governance Committee Date ratified: 19 March 2008 Name of originator/author: David McGrath
HIPAA CRITICAL AREAS TECHNICAL SECURITY FOCUS FOR CLOUD DEPLOYMENT
HIPAA CRITICAL AREAS TECHNICAL SECURITY FOCUS FOR CLOUD DEPLOYMENT A Review List This paper was put together with Security in mind, ISO, and HIPAA, for guidance as you move into a cloud deployment Dr.
High Security Online Backup. A Cyphertite White Paper February, 2013. Cloud-Based Backup Storage Threat Models
A Cyphertite White Paper February, 2013 Cloud-Based Backup Storage Threat Models PG. 1 Definition of Terms Secrets Passphrase: The secrets passphrase is the passphrase used to decrypt the 2 encrypted 256-bit
STATE OF NEVADA DEPARTMENT OF HEALTH AND HUMAN SERVICES BUSINESS ASSOCIATE ADDENDUM
STATE OF NEVADA DEPARTMENT OF HEALTH AND HUMAN SERVICES BUSINESS ASSOCIATE ADDENDUM BETWEEN The Division of Health Care Financing and Policy Herein after referred to as the Covered Entity and (Enter Business
ACCESS TO MEDICAL RECORDS. By Felicia Jolaoye Blavo & Co Solicitors Ltd.
ACCESS TO MEDICAL RECORDS. Dorset Healthcare NHS Foundation Trust v MH (2009) : A full disclosure of all relevant material should generally be given and should not present a problem in the vast majority
Best Practices for PCI DSS V3.0 Network Security Compliance
Best Practices for PCI DSS V3.0 Network Security Compliance January 2015 www.tufin.com Table of Contents Preparing for PCI DSS V3.0 Audit... 3 Protecting Cardholder Data with PCI DSS... 3 Complying with
PCI Compliance for Cloud Applications
What Is It? The Payment Card Industry Data Security Standard (PCIDSS), in particular v3.0, aims to reduce credit card fraud by minimizing the risks associated with the transmission, processing, and storage
INDEPENDENT CONTRACTOR AGREEMENT
INDEPENDENT CONTRACTOR AGREEMENT This Agreement, made this day of, between, Florida Rock Stars Inc. hereinafter referred to as "Company", located at 205 N Flagler Ave, Homestead FL 33030 and hereinafter
HIPSSA Project. Support for Harmonization of the ICT Policies in Sub-Sahara Africa, Second Mission -Namibia
HIPSSA Project Support for Harmonization of the ICT Policies in Sub-Sahara Africa, Second Mission -Namibia PRESENTATION OF THE DRAFT DATA PROTECTION POLICY FOR NAMIBIA Pria Chetty, ITU International Legal
CLOUD COMPUTING FOR SMALL- AND MEDIUM-SIZED ENTERPRISES:
CLOUD COMPUTING FOR SMALL- AND MEDIUM-SIZED ENTERPRISES: Privacy Responsibilities and Considerations Cloud computing is the delivery of computing services over the Internet, and it offers many potential
C-DAC Medical Informatics Software Development Kit End User License Agreement
C-DAC Medical Informatics Software Development Kit End User License Agreement BY DOWNLOADING AND INSTALLING, COPYING OR OTHERWISE USING THE CENTRE FOR DEVELOPMENT OF ADVANCED COMPUTING ( C-DAC ) MEDICAL
Privileged Identity Management
Privileged Identity Management Take Control of Your Administrative Credentials www.liebsoft.com [email protected] 310-550-8575 800-829-6263 Philip Lieberman, President & CEO [email protected] 2012 by
BUSINESS ASSOCIATE AGREEMENT
THIS IS A TEMPLATE ONLY. CERTAIN STATES MAY NOT PERMIT THE TYPES OF ACTIVITIES ALLOWED HEREUNDER RELATING TO PROTECTED HEALTH INFORMATION. THUS THIS AGREEMENT MAY NEED TO BE MODIFIED IN ORDER TO COMPLY
PERSONAL INJURIES ASSESSMENT BOARD DATA PROTECTION CODE OF PRACTICE
PERSONAL INJURIES ASSESSMENT BOARD DATA PROTECTION CODE OF PRACTICE ADOPTED ON 9 th January 2008 TABLE OF CONTENTS Page No. 1 Introduction...3 2 Glossary...3 3 Types of Personal Data held by Us...3 4 Obligations
INFORMATION GOVERNANCE POLICY
INFORMATION GOVERNANCE POLICY Issued by: Senior Information Risk Owner Policy Classification: Policy No: POLIG001 Information Governance Issue No: 1 Date Issued: 18/11/2013 Page No: 1 of 16 Review Date:
MMA SAMPLE FORM *REVIEW CAREFULLY & ADAPT TO YOUR PRACTICE*
This is only sample language. The language should be changed to accurately reflect business arrangements between a covered entity and business associate or business associate and subcontractor. In addition,
HIPAA BUSINESS ASSOCIATE AGREEMENT
HIPAA BUSINESS ASSOCIATE AGREEMENT THIS BUSINESS ASSOCIATE AGREEMENT (hereinafter Agreement ) is between COVERED ENTITY NAME (hereinafter Covered Entity ) and BUSINESS ASSOCIATE NAME (hereinafter Business
Cloud Computing and Privacy Laws! 17.7. 22.7. 2011 Prof. Dr. Thomas Fetzer, LL.M. Technische Universität Dresden Law School
DEUTSCH-FRANZÖSISCHE SOMMERUNIVERSITÄT! FÜR NACHWUCHSWISSENSCHAFTLER 2011! CLOUD COMPUTING : HERAUSFORDERUNGEN UND MÖGLICHKEITEN UNIVERSITÉ DʼÉTÉ FRANCO-ALLEMANDE POUR JEUNES CHERCHEURS 2011! CLOUD COMPUTING
READING SCHOOL DISTRICT
No. 831 SECTION: OPERATIONS READING SCHOOL DISTRICT TITLE: WHISTLEBLOWER ADOPTED: April 23, 2008 REVISED: 831. WHISTLEBLOWER 1. Purpose The Reading School District is committed to facilitating open and
Bridget Rankin Principal Pharmacist, Medicines Information Guy s & St. Thomas NHS Foundation Trust April 2015
Bridget Rankin Principal Pharmacist, Medicines Information Guy s & St. Thomas NHS Foundation Trust April 2015 Aim of the Session Identify legal and ethical problems that may be encountered when providing