March 31, Re: Government Big Data (FR Doc ) Dear Ms. Wong:

Size: px
Start display at page:

Download "March 31, 2014. Re: Government Big Data (FR Doc. 2014-04660) Dear Ms. Wong:"

Transcription

1 Microsoft Corporation Tel One Microsoft Way Fax Redmond, WA March 31, 2014 Ms. Nicole Wong Big Data Study Office of Science and Technology Policy Eisenhower Executive Office Building 1650 Pennsylvania Ave. NW. Washington, DC Re: Government Big Data (FR Doc ) Dear Ms. Wong: Thank you for the opportunity to submit comments in response to the Office of Science and Technology Policy s Request for Information regarding big data. Microsoft applauds the Administration for initiating a comprehensive review of big data and its public policy implications and for seeking broad input through the RFI and the various public events. We are responding primarily to the first and third questions posed by the RFI. Big data holds tremendous promise for society. Like many other developments enabled by technology, however, big data raises important public policy questions. We believe that government policy ought to be directed at promoting the learning that can be gained by analysis of big data while ensuring that privacy is not sacrificed in the process. The benefits enabled by analysis of huge datasets will not be possible if data is locked up in government or private silos. Therefore, we believe that government ought to consider carefully how best to ensure that, in general, data is broadly available to enable big data analysis. Some of this data will relate to people. To address that, government should strengthen but also adapt privacy law to enable the collection and use of large datasets while preserving privacy. This will no doubt entail tradeoffs on which reasonable people may have widely varying views. In determining how best to address privacy concerns, we believe government should draw upon a full range of tools not only law, but also technology, articulated best practices and technical standards. We address these points below. The Promise of Big Data Advances in technology have led to the digitization of massive amounts of information. We re increasingly surrounded by sensors (in our smartphones, tablets, cars and even common appliances), all Microsoft Corporation is an equal opportunity employer.

2 constantly recording data. Vast amounts of data are generated in other ways across the private and public sectors. As the costs of computing and storage have dropped, it has become increasingly possible to collect, retain, aggregate and analyze all this data. Sophisticated analytical techniques enable researchers to detect trends and correlations among disparate phenomena and thereby make important predictions. The key to unlocking the promise of big data is to enable the collection and broad availability of large volumes of data. Unlike random sampling, which was the foundation of statistical analysis in the 20 th century, big data largely relies upon the collection of as much information as possible pulled from a variety of sources to create new, combined datasets. The collection of data may occur before anyone even realizes what insights may later be drawn from it. Using all of the data available related to a particular phenomenon collected from various datasets over time facilitates detecting patterns and improves the quality of prediction. A few examples drawn from work done at Microsoft Research illustrate the point. More than ten years ago Microsoft researchers demonstrated the power of big data in natural language processing through their work to improve a grammar checker for Microsoft Word. 1 They began by pulling words the data for their work from a variety of sources, such as news articles, scientific abstracts, government transcripts and literature. They trained their grammar checker on increasingly large datasets drawn from these sources, and found that its accuracy greatly improved as the training dataset grew. For example, one of the grammar algorithms was only 75% accurate in predicting grammar problems when trained with a corpus of a half million words, but 95% accurate when trained with a corpus of a billion words. More recently, Microsoft researchers were able to assist doctors aiming to understand HIV mutation by applying analytical methods first developed for an entirely different purpose fighting spam. HIV is hard to address because it is constantly mutating to avoid attack by the human immune system. spammers program their spam to constantly mutate too to avoid filters. By applying methods initially developed to analyze spam mutations, doctors could better understand how different immune systems respond to the mutations of the HIV virus. While data about spam was helpful in researching HIV, search queries on Bing proved useful for other medical research to discover potentially dangerous drug interactions. Microsoft Research worked with researchers at Stanford University on an analysis that identified side effects when a patient takes Paxil, a widely used antidepressant, together with Pravachol, a leading cholesterol-reducing drug. 2 Using Bing search engine logs, the researchers determined that people who searched on the names of both of those drugs had a much higher likelihood of also searching for diabetes-related side effects (such as 1 Michele Banko and Eric Brill, Scaling to Very Very Large Corpora for Natural Language Disambiguation, Proceedings of the Annual Meeting of the Association for Computational Linguistics, (2001). 2 Ryen White, Nicholas Tatonetti, Nigam Shah, et al. Web-scale Pharmacovigilance: Listening to Signals from the Crowd, J Am Med Inform Assoc, doi: /amiajnl (2013). 2

3 headache or fatigue) than a person who searched only for one of the drugs. This suggested a dangerous interaction between the two drugs that could result in diabetic blood sugar levels. Government Should Promote the Broad Availability of Big Data Government can play multiple roles in ensuring that society realizes the benefits of big data while other important values are protected. Government is obviously an important source of data, about taxes, education, labor, defense, energy consumption, weather, health, communications, transportation, entitlement programs and more. It is a steward of that data as well. Access to data such as this will be important if new insights are to be gained and innovation promoted across disciplines as varied as health, security and economics. Government should establish policies with a view toward making data generally available, but limited as appropriate to address other important societal values. Information that essentially belongs to society as a whole, such as data describing the physical or economic world in which we live, ought to be made generally available in an efficient manner. Where data relates to individuals, government should employ a risk-based approach to assess the benefits of data sharing against harms to privacy, taking into account de-identification approaches and other techniques that may help to reduce privacy risks. In its role as policymaker, the government should be cognizant of its duty to promote the Progress of Science and useful Arts (the constitutional basis for copyright) when considering the application of copyright law to large datasets. Large datasets and the aggregation of smaller pieces of data encourage uses that advance the progress of science and research, and computational uses of such data do not impinge upon the dataset owner s reasonable expectations. Such uses are generally allowed today because U.S. law does not provide inherent copyright protection for databases, and such a use would likely be considered permissible fair use in any event. In considering further developments in copyright law, government should strive to maintain approaches such as these that enable third parties to make use of large datasets in ways that are transformative and socially beneficial. As an emissary to other governments, the U.S. government has a role to play in encouraging data to flow across borders while ensuring that privacy is respected. This will require the U.S. government to work closely with governments around the world to ensure that privacy regimes do not pose obstacles to the cross-border flow of data but rather appropriately protect the rights of people. Similarly, the U.S. government should work with other governments to promote copyright laws that foster access to data for all kinds of uses. Government Should Strengthen Privacy Regulation and Adapt It for Big Data Some large datasets will relate to people their activities, interests, health and the like. Given the likely ubiquity of sensors in the years to come and the increasing digitization of so many human activities, there is a real risk that that data about people could be misused. We believe that the promise of big data will not be realized unless approaches are established to address privacy and civil liberties concerns. 3

4 Privacy regulation in the United States is a complex (yet incomplete) patchwork of federal and state rules that apply to particular industry sectors, particular types of data or particular data uses. While these rules are generally based on the Fair Information Practice Principles, there has been a heavy emphasis on the principles of notice and consent at the time of data collection. Today, however, the notice and consent paradigm has begun to show significant signs of strain under the weight of big data. We believe the notice and consent paradigm, and privacy regulation as a whole, should be strengthened, but also adapted to a big data world, in order to address this. Today s heavy reliance on notice and consent places most of the burden of privacy protection on individuals. This is a problem. People are confronted with lengthy, detailed and often complex privacy statements from nearly every retailer, online service provider and other organization with which they interact. (In providing these long statements, organizations are aiming to comply with current law.) In theory, people would read these statements and then make informed choices on the basis of them. In practice, people often fail to do so, as they would be overwhelmed if they tried. 3 Instead, they quickly discard paper privacy statements and click through online statements to agree with the terms of privacy notices without reading the terms, much less trying to understand them. The law on the books is satisfied, but this is weak privacy protection. There is a second problem: Even as the existing notice and consent paradigm may fail to provide real protection for people, it may serve to preclude beneficial uses of data that would present little privacy risk. Big data analysis often depends upon using datasets, often in combination with others, in ways that were not contemplated when the data was originally collected. If the original privacy notices did not foresee a beneficial use, the data may not be available for big data analysis. To address all this, we believe that government should look at ways to focus use of notice and consent in those areas where decisions really can be informed and meaningful, and where privacy concerns are significant. Some data uses are widely expected or understood, provide high potential societal benefit, or create a low risk of harm. For example, when people purchase an item over the Internet, they understand that the retailer will use the mailing address they provide in order to ship the item to them. Bloating privacy notices with detail about such uses distracts from disclosures that are more important. Other data uses may entail a high risk of privacy harm and little societal benefit. It might be appropriate to generally preclude such uses, rather than allow them as long as notice is nominally provided in some multi-page legal document. For example, merely providing notice should not enable firms to use big data to discriminate against vulnerable communities in ways that would not be allowed in other circumstances. 3 For example, it has been estimated that, on average, every American Internet user would have to spend 244 hours every year to read all the privacy statements he or she encounters. See Aleecia M. McDonald and Lorrie Faith Cranor, The Cost of Reading Privacy Policies, 4 ISJLP 543 (2008). 4

5 In between these two cases are a wide range of potential data uses where reasonable people may not expect particular data uses, or may find particular uses objectionable. This is where it is important that people be provided with meaningful notice and an opportunity to consent, or not, to uses of data about them. This approach could be complemented by adapting privacy regulation to take greater account of a broader range of Fair Information Practice Principles. Where notice and consent are unwarranted or impractical (as for data collected by small sensors), other protections should be called into play. These may include data security; maintenance of the confidentiality, integrity and availability of the data; data minimization through the use of de-identification techniques and mechanisms for transparency (beyond consumer notices) and other means of creating accountability for all data uses. Privacy regulation could also be strengthened through the adoption of a more consistent and comprehensive approach to privacy law in the United States one that reflects the broader and balanced approach to the Fair Information Practice Principles described above. Microsoft has long supported adoption of an omnibus, baseline federal privacy law. We believe this is the right approach because the increasingly complex patchwork of state and federal laws has resulted in an overlapping, inconsistent and incomplete approach to protecting privacy. This approach is confusing from the perspective of consumers, and unnecessarily burdensome for organizations. The sectoral approach to privacy regulation that we have today may be even more problematic in the context of big data. As noted above, the value of big data is often realized when data is combined and analyzed in new ways. Yet such combinations may be precluded by differing privacy regimes applying to data first collected in varying sectors. A baseline federal privacy law could help ensure that all companies in the big data ecosystem are applying a clear set of responsible data practices, while also enabling the societal value of big data to be more easily realized. Government Should Explore a Variety of Ways to Protect Privacy in a World of Big Data The challenge of unlocking the value of big data while protecting the privacy of those whose data is included requires a multifaceted solution. The government should look to technology, best practices, law and standards to help address this. Technology. Data privacy has traditionally been concerned with the collection, use and disclosure of data that identifies individuals. Privacy frameworks have generally divided data into one of two categories: data that does not identify individuals or data that does, with the assumption that most data is in one category or the other. We will likely need to abandon this binary model. In a world of big data, data that used to be considered non-identifiable, such as the colors of cars, their makes and models, and the times of day when they are on the road, might be used to identify people, especially when combined with other information about where people live and work. While perfect anonymization of big data sets may not be mathematically possible, a variety of techniques hold promise to greatly reduce the practical risk of privacy harm. As in other areas of public policy, government should consider the likelihood and severity of potential risks, and weigh them against other societal benefits. 5

6 It may be best to treat identifiability of data on a continuum. Some data is highly identifiable to anyone who sees it, and other data is nearly anonymous and requires significant computing power to reidentify, with gradations between the two extremes. Government should promote research on defining and advancing pseudonymization and de-identification techniques, which would help to address privacy concerns while enabling big data analysis. Better definitions of these concepts would help society know what promises can be made at different levels of de-identification. That would have two benefits: it would avoid overpromising what de-identification can achieve while encouraging the use of deidentification for what it does achieve. This research should build on recent work, such as work on k- anonymity and on understanding how easily big data can be re-identified using other sources of information. 4 One helpful technique that should be explored further is called differential privacy. Differential privacy does not rely on removing information from a database or changing it, but rather limits access to the underlying data and provides results to queries of the data that include random but small levels of inaccuracy, or distortion. 5 If the level of distortion is set correctly, the datasets can be usefully exploited without revealing information that could be used to re-identify individuals. Government should explore greater use of cryptographic technologies as well. De-identification often involves cryptographically hashing information that directly identifies individuals, such as account numbers. More aggressive uses of cryptography may become practical over time. For example, current research is exploring how to use encrypted data sets to answer questions about the underlying data even though the data itself cannot be recovered, and some of the technologies are promising. 6 Further research may expand the uses of this research into wider application. Many promising techniques for de-identification, encryption and differential privacy are still only in the research stage and further work to commercialize them should be encouraged. By recognizing the potential for misuse of big data and the risks of various levels of de-identification, policymakers could help society quantify the value that these technologies offer. That, in turn, would likely encourage industry investments in those potentially useful technologies. Best Practices. Technologies such as those described above should be supplemented by best practices, in government and the private sector, regarding the use of those technologies. Such best practices would help to guard against attacks on the system or other attempts to circumvent privacy protection. For example, encryption is only as good as the practices put in place to safeguard the security of 4 For more information about k-anonymity, see, Latanya Sweeney. k-anonymity: a model for protecting privacy, International Journal on Uncertainty, Fuzziness and Knowledge-based Systems, 10 (5), (2002), and subsequent research. 5 See, e.g., Cynthia Dwork, Differential Privacy, 33rd International Colloquium on Automata, Languages and Programming, part II (2006). 6 For example, secure multi-party computation as described by Yehuda Lindell and Benny Pinkas, Privacy Preserving Data Mining, Journal of Cryptology, 15(3): (2002) and Yehuda Lindell and Benny Pinkas, Secure Multiparty Computation for Privacy-Preserving Data Mining, Journal of Privacy and Confidentiality, 1(1):59-98 (2009). Another example is structured encryption being developed by the MetaCrypt project at 6

7 decryption keys. Pseudonyms can be compromised if they are independently mapped to identifiers, such as through look-up tables. Best practices should be standardized and accompanied by robust audit mechanisms. Auditable standards for information security already exist and provide a way for organizations to document their policies that can be understood and verified by third parties. Audits should focus on the organizational controls that organizations put in place. For example, access by users of a dataset to other information that can re-identify individuals in the first dataset should be controlled and logged. Technology has a role to play in standardizing and enforcing these policies, including by associating or tagging policy requirements directly to datasets. Law. Some technological solutions should be backed up by legal requirements. This is important because in many cases people may not know the identities of all the organizations that have access to data about them, much less effective notice of the privacy policies of those organizations. Uniform legal rules could help address this kind of risk. For example, if appropriate legal rules were established that generally prohibited the re-identification of de-identified data, de-identified data could be shared with greater confidence that privacy would be preserved. Any such rules should, of course, be carefully crafted to avoid locking in technologies now that may need to be changed quickly as knowledge of big data and its privacy implications progresses. Standards. One way to provide technological flexibility is to craft law that relies upon industry technical standards. The Federal Information Security Management Act of 2002 (FISMA) is an example of this approach. To help implement FISMA, the National Institute of Standards and Technology (NIST) issued NIST Special Publication (SP) , which: (1) defines a risk management process; (2) specifies the risks that stakeholders must consider; and (3) provides lists of effective mitigations. The risks in the FISMA context are associated with information security, essentially the risk of loss, corruption or inappropriate disclosure of data. A standard for big data and privacy could adopt a similar approach, where the risks would include the improper re-identification or other illegitimate use of big data datasets (such as for illegal discrimination). A standard for big data and privacy should seek to continuously improve how risks are addressed and to adapt to new risks, as FISMA and NIST SP have done. Such a standard should describe a process of assessing risk, taking measures to reduce risk, assessing the effectiveness of the measures, and then returning to reassess risk. Finally, a successful standard should require any organization that follows it to document how it does so and to submit to third-party validation. It may make sense for NIST to be responsible for the development of any such standard. NIST has considerable experience serving in this role in other contexts. If NIST were to undertake such an effort, it should canvass a broad set of stakeholders, from the public and private sectors, to identify the risks that any successful big data and privacy standard should address. 7

8 Conclusion Microsoft appreciates the opportunity to comment on this RFI. We hope our comments will prove useful as the Administration continues its study of this important topic. Yours sincerely, David A. Heiner Vice President & Deputy General Counsel, Legal and Corporate Affairs Microsoft Corporation 8

Comments of the World Privacy Forum To: Office of Science and Technology Policy Re: Big Data Request for Information. Via email to bigdata@ostp.

Comments of the World Privacy Forum To: Office of Science and Technology Policy Re: Big Data Request for Information. Via email to bigdata@ostp. 3108 Fifth Avenue Suite B San Diego, CA 92103 Comments of the World Privacy Forum To: Office of Science and Technology Policy Re: Big Data Request for Information Via email to bigdata@ostp.gov Big Data

More information

Submission to the National Telecommunications and Information Administration (NTIA), U.S. Department of Commerce

Submission to the National Telecommunications and Information Administration (NTIA), U.S. Department of Commerce Submission to the National Telecommunications and Information Administration (NTIA), U.S. Department of Commerce Docket No. 140514424 4424 01 RIN 0660 XC010 Comments of the Information Technology Industry

More information

Privacy: Legal Aspects of Big Data and Information Security

Privacy: Legal Aspects of Big Data and Information Security Privacy: Legal Aspects of Big Data and Information Security Presentation at the 2 nd National Open Access Workshop 21-22 October, 2013 Izmir, Turkey John N. Gathegi University of South Florida, Tampa,

More information

Re: Request for Comment: Big Data and Consumer Privacy in the Internet Economy

Re: Request for Comment: Big Data and Consumer Privacy in the Internet Economy Microsoft Corporation Tel 425 882 8080 One Microsoft Way Fax 425 936 7329 Redmond, WA 98052-6399 http://www.microsoft.com/ August 5, 2014 Mr. John Morris National Telecommunications and Information Administration

More information

Re: Big Data: A Tool for Inclusion or Exclusion? Workshop Project No. P145406

Re: Big Data: A Tool for Inclusion or Exclusion? Workshop Project No. P145406 October 30, 2014 Federal Trade Commission Office of the Secretary Room H 113 (Annex X) 600 Pennsylvania Avenue NW Washington, DC 20580 Re: Big Data: A Tool for Inclusion or Exclusion? Workshop Project

More information

Top Ten Security and Privacy Challenges for Big Data and Smartgrids. Arnab Roy Fujitsu Laboratories of America

Top Ten Security and Privacy Challenges for Big Data and Smartgrids. Arnab Roy Fujitsu Laboratories of America 1 Top Ten Security and Privacy Challenges for Big Data and Smartgrids Arnab Roy Fujitsu Laboratories of America 2 User Roles and Security Concerns [SKCP11] Users and Security Concerns [SKCP10] Utilities:

More information

February 17, 2011. Federal Trade Commission 600 Pennsylvania Avenue, NW Washington, DC 20580

February 17, 2011. Federal Trade Commission 600 Pennsylvania Avenue, NW Washington, DC 20580 February 17, 2011 Federal Trade Commission 600 Pennsylvania Avenue, NW Washington, DC 20580 Re: A Preliminary FTC Staff Report on Protecting Consumer Privacy in an Era of Rapid Change: A Proposed Framework

More information

C H A MB E R O F C O M ME R C E O F T H E U N IT E D S T A T E S OF A M E R IC A

C H A MB E R O F C O M ME R C E O F T H E U N IT E D S T A T E S OF A M E R IC A C H A MB E R O F C O M ME R C E O F T H E U N IT E D S T A T E S OF A M E R IC A W I L L I A M L. K O V A C S S E N I O R V I C E P R E S I D E N T E N V I R O N M E N T, T E C H N O L O G Y & R E G U

More information

Office of Inspector General

Office of Inspector General DEPARTMENT OF HOMELAND SECURITY Office of Inspector General Security Weaknesses Increase Risks to Critical United States Secret Service Database (Redacted) Notice: The Department of Homeland Security,

More information

C H A MB E R O F C O M ME R C E O F T H E U N IT E D S T A T E S OF A M E R IC A

C H A MB E R O F C O M ME R C E O F T H E U N IT E D S T A T E S OF A M E R IC A C H A MB E R O F C O M ME R C E O F T H E U N IT E D S T A T E S OF A M E R IC A W I L L I A M L. K O V A C S S E N I O R V I C E P R E S I D E N T E N V I R O N M E N T, T E C H N O L O G Y & R E G U

More information

DATA MINING - 1DL360

DATA MINING - 1DL360 DATA MINING - 1DL360 Fall 2013" An introductory class in data mining http://www.it.uu.se/edu/course/homepage/infoutv/per1ht13 Kjell Orsborn Uppsala Database Laboratory Department of Information Technology,

More information

Before the Federal Trade Commission Washington, DC SUPPLEMENTAL COMMENTS OF COMPUTER & COMMUNICATIONS INDUSTRY ASSOCIATION

Before the Federal Trade Commission Washington, DC SUPPLEMENTAL COMMENTS OF COMPUTER & COMMUNICATIONS INDUSTRY ASSOCIATION Before the Federal Trade Commission Washington, DC In re Big Data: A Tool for Inclusion or Exclusion? Workshop Project No. P145406 SUPPLEMENTAL COMMENTS OF COMPUTER & COMMUNICATIONS INDUSTRY ASSOCIATION

More information

Synapse Privacy Policy

Synapse Privacy Policy Synapse Privacy Policy Last updated: April 10, 2014 Introduction Sage Bionetworks is driving a systems change in data-intensive healthcare research by enabling a collective approach to information sharing

More information

I. The Proposed Interpretation of Intrusion Software Inappropriately Fails to Exclude Software for Defensive Activities

I. The Proposed Interpretation of Intrusion Software Inappropriately Fails to Exclude Software for Defensive Activities July 20, 2015 Ms. Hillary Hess Director, Regulatory Policy Division Room 2099B Bureau of Industry and Security U.S. Department of Commerce 14th Street & Pennsylvania Ave., N.W. Washington, D.C. 20230 Re:

More information

How Does Big Data Change Your Way of Managing Information?

How Does Big Data Change Your Way of Managing Information? How Does Big Data Change Your Way of Managing Information? A Best-Practices Guide for Data Managers By Erian Laperi, Director Enterprise Data Management and Business Enablement at AT&T How Does Big Data

More information

Accountability: Data Governance for the Evolving Digital Marketplace 1

Accountability: Data Governance for the Evolving Digital Marketplace 1 Accountability: Data Governance for the Evolving Digital Marketplace 1 1 For the past three years, the Centre for Information Policy Leadership at Hunton & Williams LLP has served as secretariat for the

More information

GAO. INFORMATION SECURITY Persistent Weaknesses Highlight Need for Further Improvement

GAO. INFORMATION SECURITY Persistent Weaknesses Highlight Need for Further Improvement GAO For Release on Delivery Expected at time 1:00 p.m. EDT Thursday, April 19, 2007 United States Government Accountability Office Testimony Before the Subcommittee on Emerging Threats, Cybersecurity,

More information

C H A MB E R O F C O M ME R C E O F T H E U N IT E D S T A T E S OF A M E R IC A

C H A MB E R O F C O M ME R C E O F T H E U N IT E D S T A T E S OF A M E R IC A C H A MB E R O F C O M ME R C E O F T H E U N IT E D S T A T E S OF A M E R IC A W I L L I A M L. K O V A C S S E N I O R V I C E P R E S I D E N T E N V I R O N M E N T, T E C H N O L O G Y & R E G U

More information

Re: Big Data Request for Information

Re: Big Data Request for Information March 31, 2014 Attn: Big Data Study Office of Science and Technology Policy Eisenhower Executive Office Building 1650 Pennsylvania Avenue NW Washington, D.C. 20502 Ladies and Gentlemen: Re: Big Data Request

More information

Arnab Roy Fujitsu Laboratories of America and CSA Big Data WG

Arnab Roy Fujitsu Laboratories of America and CSA Big Data WG Arnab Roy Fujitsu Laboratories of America and CSA Big Data WG 1 The Big Data Working Group (BDWG) will be identifying scalable techniques for data-centric security and privacy problems. BDWG s investigation

More information

Dear Honorable Members of the Health information Technology (HIT) Policy Committee:

Dear Honorable Members of the Health information Technology (HIT) Policy Committee: Office of the National Coordinator for Health Information Technology 200 Independence Avenue, S.W. Suite 729D Washington, D.C. 20201 Attention: HIT Policy Committee Meaningful Use Comments RE: DEFINITION

More information

Privacy Challenges in the Internet of Things (IoT) a European Perspective

Privacy Challenges in the Internet of Things (IoT) a European Perspective Privacy Challenges in the Internet of Things (IoT) a European Perspective Alicja Gniewek, PhD Student Interdisciplinary Centre for Security, Reliability and Trust Weicker Building, Université du Luxembourg

More information

NSF Workshop on Big Data Security and Privacy

NSF Workshop on Big Data Security and Privacy NSF Workshop on Big Data Security and Privacy Report Summary Bhavani Thuraisingham The University of Texas at Dallas (UTD) February 19, 2015 Acknowledgement NSF SaTC Program for support Chris Clifton and

More information

Trust 9/10/2015. Why Does Privacy and Security Matter? Who Must Comply with HIPAA Rules? HIPAA Breaches, Security Risk Analysis, and Audits

Trust 9/10/2015. Why Does Privacy and Security Matter? Who Must Comply with HIPAA Rules? HIPAA Breaches, Security Risk Analysis, and Audits HIPAA Breaches, Security Risk Analysis, and Audits Derrick Hill Senior Health IT Advisor Kentucky REC Why Does Privacy and Security Matter? Trust Who Must Comply with HIPAA Rules? Covered Entities (CE)

More information

The Information Commissioner s Office response to HM Treasury s Call for Evidence on Data Sharing and Open Data in Banking

The Information Commissioner s Office response to HM Treasury s Call for Evidence on Data Sharing and Open Data in Banking The Information Commissioner s Office response to HM Treasury s Call for Evidence on Data Sharing and Open Data in Banking The Information Commissioner has responsibility for promoting and enforcing the

More information

January 30, 2015. Dear Dr. De Salvo:

January 30, 2015. Dear Dr. De Salvo: January 30, 2015 Karen DeSalvo, MD, MPH, MSc National Coordinator Office of National Coordinator for Health IT Department of Health and Human Services 200 Independence Ave, SW Washington, DC 20201 Dear

More information

DATA MINING - 1DL105, 1DL025

DATA MINING - 1DL105, 1DL025 DATA MINING - 1DL105, 1DL025 Fall 2009 An introductory class in data mining http://www.it.uu.se/edu/course/homepage/infoutv/ht09 Kjell Orsborn Uppsala Database Laboratory Department of Information Technology,

More information

Arnab Roy Fujitsu Laboratories of America and CSA Big Data WG

Arnab Roy Fujitsu Laboratories of America and CSA Big Data WG Arnab Roy Fujitsu Laboratories of America and CSA Big Data WG 1 Security Analytics Crypto and Privacy Technologies Infrastructure Security 60+ members Framework and Taxonomy Chair - Sree Rajan, Fujitsu

More information

Defining Larger Participants of the International Money Transfer Market Docket No. CFPB-2014-0003/RIN 3170-AA25

Defining Larger Participants of the International Money Transfer Market Docket No. CFPB-2014-0003/RIN 3170-AA25 Robert G. Rowe, III Vice President/Senior Counsel Center for Regulatory Compliance Phone: 202-663-5029 E-mail: rrowe@aba.com April 1, 2014 Monica Jackson Office of the Executive Secretary Bureau of Consumer

More information

Li Xiong, Emory University

Li Xiong, Emory University Healthcare Industry Skills Innovation Award Proposal Hippocratic Database Technology Li Xiong, Emory University I propose to design and develop a course focused on the values and principles of the Hippocratic

More information

City of Boston Department of Innovation and Technology Policy Title: Information Technology Resource Use Policy Effective Date: April 1, 2011

City of Boston Department of Innovation and Technology Policy Title: Information Technology Resource Use Policy Effective Date: April 1, 2011 City of Boston Department of Innovation and Technology Policy Title: Information Technology Resource Use Policy Effective Date: April 1, 2011 Purpose and Intent The City of Boston recognizes the importance

More information

Data Privacy and Biomedicine Syllabus - Page 1 of 6

Data Privacy and Biomedicine Syllabus - Page 1 of 6 Data Privacy and Biomedicine Syllabus - Page 1 of 6 Course: Data Privacy in Biomedicine (BMIF-380 / CS-396) Instructor: Bradley Malin, Ph.D. (b.malin@vanderbilt.edu) Semester: Spring 2015 Time: Mondays

More information

By U.S. Mail and Email: e-ori@dol.gov

By U.S. Mail and Email: e-ori@dol.gov By U.S. Mail and Email: e-ori@dol.gov Office of Regulations and Interpretations Employee Benefits Security Administration Attn: Conflict of Interest Rule, Room N-5655 U.S. Department of Labor 200 Constitution

More information

RE: Information Collection Debt Collection Survey from the Consumer Credit Panel, OMB Control Number: 3170-XXXX, [Docket No: CFPB-2014-0005]

RE: Information Collection Debt Collection Survey from the Consumer Credit Panel, OMB Control Number: 3170-XXXX, [Docket No: CFPB-2014-0005] May 6, 2014 Ashwin Vasan Chief Information Officer Consumer Financial Protection Bureau (Attention: PRA Office) 1700 G St., NW Washington, D.C. 20552 RE: Information Collection Debt Collection Survey from

More information

Appendix I. The City University of New York Policy on Acceptable Use of Computer Resources

Appendix I. The City University of New York Policy on Acceptable Use of Computer Resources Appendix I The City University of New York Policy on Acceptable Use of Computer Resources Introduction CUNY s computer resources are dedicated to the support of the university s mission of education, research

More information

NEW PERSPECTIVES. Professional Fee Coding Audit: The Basics. Learn how to do these invaluable audits page 16

NEW PERSPECTIVES. Professional Fee Coding Audit: The Basics. Learn how to do these invaluable audits page 16 NEW PERSPECTIVES on Healthcare Risk Management, Control and Governance www.ahia.org Journal of the Association of Heathcare Internal Auditors Vol. 32, No. 3, Fall, 2013 Professional Fee Coding Audit: The

More information

Risk management, information security and privacy compliance. new meeting of minds or ships in the night?

Risk management, information security and privacy compliance. new meeting of minds or ships in the night? Risk management, information security and privacy compliance new meeting of minds or ships in the night? Peter Leonard September 2015 page 1 ships in the night + narrowly focussed conversations reasonable

More information

Top Five Ways to Protect Your Network. A MainNerve Whitepaper

Top Five Ways to Protect Your Network. A MainNerve Whitepaper A MainNerve Whitepaper Overview The data security challenges within the business world have never been as challenging as they are today. Not only must organizations providers comply with stringent State

More information

Privacy in the Cloud A Microsoft Perspective

Privacy in the Cloud A Microsoft Perspective A Microsoft Perspective November 2010 The information contained in this document represents the current view of Microsoft Corp. on the issues discussed as of the date of publication. Because Microsoft

More information

A Q&A with the Commissioner: Big Data and Privacy Health Research: Big Data, Health Research Yes! Personal Data No!

A Q&A with the Commissioner: Big Data and Privacy Health Research: Big Data, Health Research Yes! Personal Data No! A Q&A with the Commissioner: Big Data and Privacy Health Research: Big Data, Health Research Yes! Personal Data No! Ann Cavoukian, Ph.D. Information and Privacy Commissioner Ontario, Canada THE AGE OF

More information

Degrees of De-identification of Clinical Research Data

Degrees of De-identification of Clinical Research Data Vol. 7, No. 11, November 2011 Can You Handle the Truth? Degrees of De-identification of Clinical Research Data By Jeanne M. Mattern Two sets of U.S. government regulations govern the protection of personal

More information

Responsible Administrative Unit: Computing, Communications & Information Technologies. Information Technology Appropriate Use Policy

Responsible Administrative Unit: Computing, Communications & Information Technologies. Information Technology Appropriate Use Policy 1.0 BACKGROUND AND PURPOSE Information Technology ( IT ) includes a vast and growing array of computing, electronic and voice communications facilities and services. At the Colorado School of Mines ( Mines

More information

Teradata and Protegrity High-Value Protection for High-Value Data

Teradata and Protegrity High-Value Protection for High-Value Data Teradata and Protegrity High-Value Protection for High-Value Data 03.16 EB7178 DATA SECURITY Table of Contents 2 Data-Centric Security: Providing High-Value Protection for High-Value Data 3 Visibility:

More information

Re: RIN 3235-AL13 - Notice of Proposed Rulemaking: Clearing Agency Standards for Operation and Governance (File Number 57-8-11)

Re: RIN 3235-AL13 - Notice of Proposed Rulemaking: Clearing Agency Standards for Operation and Governance (File Number 57-8-11) April 29, 2011 Elizabeth M. Murphy Secretary Securities and Exchange Commission 100 F St., NE. Washington DC 20549-1090 Re: RIN 3235-AL13 - Notice of Proposed Rulemaking: Clearing Agency Standards for

More information

White Paper. An Overview of the Kalido Data Governance Director Operationalizing Data Governance Programs Through Data Policy Management

White Paper. An Overview of the Kalido Data Governance Director Operationalizing Data Governance Programs Through Data Policy Management White Paper An Overview of the Kalido Data Governance Director Operationalizing Data Governance Programs Through Data Policy Management Managing Data as an Enterprise Asset By setting up a structure of

More information

October 27, 2010. The Honorable John Berry Director Office of Personnel Management 1900 E Street, NW Washington, DC 20415. Dear Director Berry:

October 27, 2010. The Honorable John Berry Director Office of Personnel Management 1900 E Street, NW Washington, DC 20415. Dear Director Berry: October 27, 2010 The Honorable John Berry Director Office of Personnel Management 1900 E Street, NW Washington, DC 20415 Dear Director Berry: We are writing to express our concerns about the Health Claims

More information

PROCESSING CLASSIFIED INFORMATION ON PORTABLE COMPUTERS IN THE DEPARTMENT OF JUSTICE

PROCESSING CLASSIFIED INFORMATION ON PORTABLE COMPUTERS IN THE DEPARTMENT OF JUSTICE PROCESSING CLASSIFIED INFORMATION ON PORTABLE COMPUTERS IN THE DEPARTMENT OF JUSTICE U.S. Department of Justice Office of the Inspector General Audit Division Audit Report 05-32 July 2005 PROCESSING CLASSIFIED

More information

DHS Data Privacy & Integrity Advisory Committee 07 May 2007. Comments of the. DHS Data Privacy & Integrity Advisory Committee

DHS Data Privacy & Integrity Advisory Committee 07 May 2007. Comments of the. DHS Data Privacy & Integrity Advisory Committee DHS Data Privacy & Integrity Advisory Committee 07 May 2007 Comments of the DHS Data Privacy & Integrity Advisory Committee Regarding the Notice of Propose Rulemaking For Implementation of the REAL ID

More information

Privacy Impact Assessment

Privacy Impact Assessment M AY 2, 2013 Privacy Impact Assessment CFPB BUSINESS INTELLIGENCE TOOL Contact Point: Claire Stapleton Chief Privacy Officer 1700 G Street, NW Washington, DC 20552 202-435-7220 claire.stapleton@cfpb.gov

More information

Re: FINRA Regulatory Notice 13-42: FINRA Requests Comments on a Concept Proposal to Develop the Comprehensive Automated Risk Data System

Re: FINRA Regulatory Notice 13-42: FINRA Requests Comments on a Concept Proposal to Develop the Comprehensive Automated Risk Data System Ms. Marcia E. Asquith Office of the Corporate Secretary FINRA 1735 K Street, NW Washington, DC 20006 Re: FINRA Regulatory Notice 13-42: FINRA Requests Comments on a Concept Proposal to Develop the Comprehensive

More information

Information Security in Big Data using Encryption and Decryption

Information Security in Big Data using Encryption and Decryption International Research Journal of Computer Science (IRJCS) ISSN: 2393-9842 Information Security in Big Data using Encryption and Decryption SHASHANK -PG Student II year MCA S.K.Saravanan, Assistant Professor

More information

Request for Comments on Energy and Commerce Digital Health White Paper

Request for Comments on Energy and Commerce Digital Health White Paper 15 October 2014 The Honorable Fred Upton Chairman, Committee on Energy and Commerce 2125 Rayburn House Office Building Washington, D.C. 20515 Request for Comments on Energy and Commerce Digital Health

More information

Office of the Auditor General Performance Audit Report. Statewide Oracle Database Controls Department of Technology, Management, and Budget

Office of the Auditor General Performance Audit Report. Statewide Oracle Database Controls Department of Technology, Management, and Budget Office of the Auditor General Performance Audit Report Statewide Oracle Database Controls Department of Technology, Management, and Budget March 2015 071-0565-14 State of Michigan Auditor General Doug

More information

FACT SHEET: Ransomware and HIPAA

FACT SHEET: Ransomware and HIPAA FACT SHEET: Ransomware and HIPAA A recent U.S. Government interagency report indicates that, on average, there have been 4,000 daily ransomware attacks since early 2016 (a 300% increase over the 1,000

More information

May 18, 2010. Dear Director Verdugo,

May 18, 2010. Dear Director Verdugo, May 18, 2010 Director Georgina Verdugo U.S. Department of Health and Human Services, Office for Civil Rights Attention: HITECH Accounting of Disclosures Hubert H. Humphrey Building, Room 509F 200 Independence

More information

Integrated email archiving: streamlining compliance and discovery through content and business process management

Integrated email archiving: streamlining compliance and discovery through content and business process management Make better decisions, faster March 2008 Integrated email archiving: streamlining compliance and discovery through content and business process management 2 Table of Contents Executive summary.........

More information

Observations on international efforts to develop frameworks to enhance privacy while realising big data s benefits

Observations on international efforts to develop frameworks to enhance privacy while realising big data s benefits Big Data, Key Challenges: Privacy Protection & Cooperation Observations on international efforts to develop frameworks to enhance privacy while realising big data s benefits Seminar arranged by the Office

More information

Adobe Systems Software Ireland Ltd

Adobe Systems Software Ireland Ltd Adobe Systems Software Ireland Ltd Own motion investigation report 13/00007 Timothy Pilgrim, Australian Privacy Commissioner Contents Overview... 2 Background... 3 Relevant provisions of the Privacy Act...

More information

Statement National Strategy for Trusted Identities in Cybersecurity Creating Options for Enhanced Online Security and Privacy

Statement National Strategy for Trusted Identities in Cybersecurity Creating Options for Enhanced Online Security and Privacy Statement National Strategy for Trusted Identities in Cybersecurity Creating Options for Enhanced Online Security and Privacy We thank the administration for this valuable opportunity to engage in a national

More information

Privacy Engineering Objectives and Risk Model - Discussion Deck. Objective-Based Design for Improving Privacy in Information Systems

Privacy Engineering Objectives and Risk Model - Discussion Deck. Objective-Based Design for Improving Privacy in Information Systems Privacy Engineering Objectives and Risk Model - Discussion Deck Objective-Based Design for Improving Privacy in Information Systems Purpose and Scope This discussion deck describes initial draft components

More information

Android Developer Applications

Android Developer Applications Android Developer Applications January 31, 2013 Contact Departmental Privacy Office U.S. Department of the Interior 1849 C Street NW Mail Stop MIB-7456 Washington, DC 20240 202-208-1605 DOI_Privacy@ios.doi.gov

More information

The Social Impact of Open Data

The Social Impact of Open Data United States of America Federal Trade Commission The Social Impact of Open Data Remarks of Maureen K. Ohlhausen 1 Commissioner, Federal Trade Commission Center for Data Innovation The Social Impact of

More information

Enterprise Security Tactical Plan

Enterprise Security Tactical Plan Enterprise Security Tactical Plan Fiscal Years 2011 2012 (July 1, 2010 to June 30, 2012) Prepared By: State Chief Information Security Officer The Information Security Council State of Minnesota Enterprise

More information

Information Protection Framework: Data Security Compliance and Today s Healthcare Industry

Information Protection Framework: Data Security Compliance and Today s Healthcare Industry Information Protection Framework: Data Security Compliance and Today s Healthcare Industry Executive Summary Today s Healthcare industry is facing complex privacy and data security requirements. The movement

More information

Privacy Impact Assessment (PIA) Consular Data Information Transfer System (CDITS) Version 02.00.00. Last Updated: April 15, 2014

Privacy Impact Assessment (PIA) Consular Data Information Transfer System (CDITS) Version 02.00.00. Last Updated: April 15, 2014 United States Department of State (PIA) Consular Data Information Transfer System (CDITS) Version 02.00.00 Last Updated: April 15, 2014 Bureau of Administration 1. Contact Information Department of State

More information

National Identity Exchange Federation (NIEF) Trustmark Signing Certificate Policy. Version 1.1. February 2, 2016

National Identity Exchange Federation (NIEF) Trustmark Signing Certificate Policy. Version 1.1. February 2, 2016 National Identity Exchange Federation (NIEF) Trustmark Signing Certificate Policy Version 1.1 February 2, 2016 Copyright 2016, Georgia Tech Research Institute Table of Contents TABLE OF CONTENTS I 1 INTRODUCTION

More information

MICHIGAN AUDIT REPORT OFFICE OF THE AUDITOR GENERAL. Doug A. Ringler, C.P.A., C.I.A. AUDITOR GENERAL ENTERPRISE DATA WAREHOUSE

MICHIGAN AUDIT REPORT OFFICE OF THE AUDITOR GENERAL. Doug A. Ringler, C.P.A., C.I.A. AUDITOR GENERAL ENTERPRISE DATA WAREHOUSE MICHIGAN OFFICE OF THE AUDITOR GENERAL AUDIT REPORT PERFORMANCE AUDIT OF THE ENTERPRISE DATA WAREHOUSE DEPARTMENT OF TECHNOLOGY, MANAGEMENT, AND BUDGET August 2014 Doug A. Ringler, C.P.A., C.I.A. AUDITOR

More information

CPSC 467b: Cryptography and Computer Security

CPSC 467b: Cryptography and Computer Security CPSC 467b: Cryptography and Computer Security Michael J. Fischer Lecture 1 January 9, 2012 CPSC 467b, Lecture 1 1/22 Course Overview Symmetric Cryptography CPSC 467b, Lecture 1 2/22 Course Overview CPSC

More information

October 22, 2009. 45 CFR PARTS 160 and 164

October 22, 2009. 45 CFR PARTS 160 and 164 October 22, 2009 U.S. Department of Health and Human Services Office for Civil Rights Attention: HITECH Breach Notification Hubert H. Humphrey Building Room 509 F 200 Independence Avenue, SW Washington,

More information

A very short history of networking

A very short history of networking A New vision for network architecture David Clark M.I.T. Laboratory for Computer Science September, 2002 V3.0 Abstract This is a proposal for a long-term program in network research, consistent with the

More information

1.2: DATA SHARING POLICY. PART OF THE OBI GOVERNANCE POLICY Available at: http://www.braininstitute.ca/brain-code-governance. 1.2.

1.2: DATA SHARING POLICY. PART OF THE OBI GOVERNANCE POLICY Available at: http://www.braininstitute.ca/brain-code-governance. 1.2. 1.2: DATA SHARING POLICY PART OF THE OBI GOVERNANCE POLICY Available at: http://www.braininstitute.ca/brain-code-governance 1.2.1 Introduction Consistent with its international counterparts, OBI recognizes

More information

Get Confidence in Mission Security with IV&V Information Assurance

Get Confidence in Mission Security with IV&V Information Assurance Get Confidence in Mission Security with IV&V Information Assurance September 10, 2014 Threat Landscape Regulatory Framework Life-cycles IV&V Rigor and Independence Threat Landscape Continuously evolving

More information

Assessing Risk in Social and Behavioral Sciences

Assessing Risk in Social and Behavioral Sciences Tracy Arwood, MS Clemson University Sangeeta Panicker, PhD American Psychological Association Assessing Risk in Social and Behavioral Sciences Assessing Risk in Social and Behavioral Sciences Content Authors

More information

U.S. Department of Energy Office of Inspector General Office of Audits and Inspections

U.S. Department of Energy Office of Inspector General Office of Audits and Inspections U.S. Department of Energy Office of Inspector General Office of Audits and Inspections Audit Report Management of Los Alamos National Laboratory's Cyber Security Program DOE/IG-0880 February 2013 Department

More information

Cyber Security: Beginners Guide to Firewalls

Cyber Security: Beginners Guide to Firewalls Cyber Security: Beginners Guide to Firewalls A Non-Technical Guide Essential for Business Managers Office Managers Operations Managers This appendix is a supplement to the Cyber Security: Getting Started

More information

CYBERSECURITY TESTING & CERTIFICATION SERVICE TERMS

CYBERSECURITY TESTING & CERTIFICATION SERVICE TERMS CYBERSECURITY TESTING & CERTIFICATION SERVICE TERMS These Cybersecurity Testing and Certification Service Terms ( Service Terms ) shall govern the provision of cybersecurity testing and certification services

More information

List of Promising Concepts EA6: BIG DATA

List of Promising Concepts EA6: BIG DATA List of Promising Concepts EA6: BIG DATA Project acronym Project title Project number 611961 Starting date 01/10/2013 Duration in months 24 Call identifier FP7-ICT-2013-10 CAPITAL security research Agenda

More information

Re: Request for Comments on the Preliminary Cybersecurity Framework

Re: Request for Comments on the Preliminary Cybersecurity Framework Submitted Electronically Patrick Gallagher, Ph.D. Under Secretary of Commerce for Standards and Technology U.S. Department of Commerce 1401 Constitution Avenue, NW Washington, DC 20227 Re: Request for

More information

Towards Unified Data Security Requirements for Human Research

Towards Unified Data Security Requirements for Human Research Towards Unified Data Security Requirements for Human Research Susan Bouregy, Ph.D., CIP Chief HIPAA Privacy Officer Vice Chair, Human Subjects Committee Yale University susan.bouregy@yale.edu March 21,

More information

Diane Honeycutt National Institute of Standards and Technology (NIST) 100 Bureau Drive, Stop 8930 Gaithersburg, MD 20899

Diane Honeycutt National Institute of Standards and Technology (NIST) 100 Bureau Drive, Stop 8930 Gaithersburg, MD 20899 Submitted via email: cyberframework@nist.gov April 8, 2013 Diane Honeycutt National Institute of Standards and Technology (NIST) 100 Bureau Drive, Stop 8930 Gaithersburg, MD 20899 Re: Developing a Framework

More information

BSA GLOBAL CYBERSECURITY FRAMEWORK

BSA GLOBAL CYBERSECURITY FRAMEWORK 2010 BSA GLOBAL CYBERSECURITY FRAMEWORK BSA GLOBAL CYBERSECURITY FRAMEWORK Over the last 20 years, consumers, businesses and governments 1 around the world have moved online to conduct business, and access

More information

Guidance Specifying Technologies and Methodologies DEPARTMENT OF HEALTH AND HUMAN SERVICES

Guidance Specifying Technologies and Methodologies DEPARTMENT OF HEALTH AND HUMAN SERVICES DEPARTMENT OF HEALTH AND HUMAN SERVICES 45 CFR PARTS 160 and 164 Guidance Specifying the Technologies and Methodologies That Render Protected Health Information Unusable, Unreadable, or Indecipherable

More information

References NYS Office of Cyber Security and Critical Infrastructure Coordination Best Practices and Assessment Tools for the Household

References NYS Office of Cyber Security and Critical Infrastructure Coordination Best Practices and Assessment Tools for the Household This appendix is a supplement to the Cyber Security: Getting Started Guide, a non-technical reference essential for business managers, office managers, and operations managers. This appendix is one of

More information

Privacy & data protection in big data: Fact or Fiction?

Privacy & data protection in big data: Fact or Fiction? Privacy & data protection in big data: Fact or Fiction? Athena Bourka ENISA ISACA Athens Conference 24.11.2015 European Union Agency for Network and Information Security Agenda 1 Privacy challenges in

More information

SCHOOL ONLINE SAFETY SELF REVIEW TOOL

SCHOOL ONLINE SAFETY SELF REVIEW TOOL SCHOOL ONLINE SAFETY SELF REVIEW TOOL UPDATED February 2016 The South West Grid for Learning, Belvedere House, Woodwater Park, Pynes Hill, Exeter, EX2 5WS. Tel: 0844 381 4772 Email: esafety@swgfl.org.uk

More information

M E M O R A N D U M. Definitions

M E M O R A N D U M. Definitions M E M O R A N D U M DATE: November 10, 2011 TO: FROM: RE: Krevolin & Horst, LLC HIPAA Obligations of Business Associates In connection with the launch of your hosted application service focused on practice

More information

CODE OF BUSINESS CONDUCT

CODE OF BUSINESS CONDUCT CODE OF BUSINESS CONDUCT AND ETHICS -- A Statement of Company Policy for All Employees -- CONDUCTING BUSINESS WITH INTEGRITY, HONESTY AND ACCOUNTABILITY SKYWORKS WILL NOT RETALIATE AGAINST, NOR WILL IT

More information

Solving for the Future: Addressing Major Societal Challenges Through Innovative Technology and Cloud Computing

Solving for the Future: Addressing Major Societal Challenges Through Innovative Technology and Cloud Computing Solving for the Future: Addressing Major Societal Challenges Through Innovative Technology and Cloud Computing As economic challenges persist in communities, nations, and regions around the world, the

More information

7.0 Information Security Protections The aggregation and analysis of large collections of data and the development

7.0 Information Security Protections The aggregation and analysis of large collections of data and the development 7.0 Information Security Protections The aggregation and analysis of large collections of data and the development of interconnected information systems designed to facilitate information sharing is revolutionizing

More information

OCTOBER 2013 PART 1. Keeping Data in Motion: How HIPAA affects electronic transfer of protected health information

OCTOBER 2013 PART 1. Keeping Data in Motion: How HIPAA affects electronic transfer of protected health information OCTOBER 2013 PART 1 Keeping Data in Motion: How HIPAA affects electronic transfer of protected health information Part 1: How HIPAA affects electronic transfer of protected health information It is difficult

More information

Workshop Series on Open Source Research Methodology in Support of Non-Proliferation

Workshop Series on Open Source Research Methodology in Support of Non-Proliferation The International Centre for Security Analysis The Policy Institute at King s King s College London Workshop Series on Open Source Research Methodology in Support of Non-Proliferation Workshop 1: Exploiting

More information

Privacy and Data Protection

Privacy and Data Protection Hewlett-Packard Company 3000 Hanover Street Palo Alto, CA 94304 hp.com HP Policy Position Privacy and Data Protection Current Global State of Privacy and Data Protection The rapid expansion and pervasiveness

More information

June 19, 2013. The Honorable Richard Cordray Director Consumer Financial Protection Bureau 1700 G Street, NW Washington, DC 20552

June 19, 2013. The Honorable Richard Cordray Director Consumer Financial Protection Bureau 1700 G Street, NW Washington, DC 20552 The Honorable Richard Cordray Director Consumer Financial Protection Bureau 1700 G Street, NW Washington, DC 20552 Dear Director Cordray: I am writing with respect to the increasing number of requests

More information

Information Security Management System for Microsoft s Cloud Infrastructure

Information Security Management System for Microsoft s Cloud Infrastructure Information Security Management System for Microsoft s Cloud Infrastructure Online Services Security and Compliance Executive summary Contents Executive summary 1 Information Security Management System

More information

Healthcare Utilizing Trusted Identity Credentials

Healthcare Utilizing Trusted Identity Credentials Healthcare Utilizing Trusted NextgenID - Headquarters 10226 San Pedro Ave, Suite 100 San Antonio, TX 78216 (210) 530-9991 NextgenID - Washington DC 13454 Sunrise Valley Drive, Suite 430 Herndon, VA 20171

More information

Cyber Security Beginners Guide to Firewalls A Non-Technical Guide

Cyber Security Beginners Guide to Firewalls A Non-Technical Guide Cyber Security Beginners Guide to Firewalls A Non-Technical Guide Essential for Business Managers Office Managers Operations Managers Multi-State Information Sharing and Analysis Center (MS-ISAC) U.S.

More information

Managing internet security

Managing internet security Managing internet security GOOD PRACTICE GUIDE Contents About internet security 2 What are the key components of an internet system? 3 Assessing internet security 4 Internet security check list 5 Further

More information

HIPAA Security. 2 Security Standards: Administrative Safeguards. Security Topics

HIPAA Security. 2 Security Standards: Administrative Safeguards. Security Topics HIPAA Security SERIES Security Topics 1. Security 101 for Covered Entities 5. 2. Security Standards - Organizational, Security Policies Standards & Procedures, - Administrative and Documentation Safeguards

More information

Enhancing Cybersecurity with Big Data: Challenges & Opportunities

Enhancing Cybersecurity with Big Data: Challenges & Opportunities Enhancing Cybersecurity with Big Data: Challenges & Opportunities Independently Conducted by Ponemon Institute LLC Sponsored by Microsoft Corporation November 2014 CONTENTS 2 3 6 9 10 Introduction The

More information