DATA SECURITY: A CRUCIAL TOPIC FOR CORPORATE COUNSEL AND MANAGEMENT

Size: px
Start display at page:

Download "DATA SECURITY: A CRUCIAL TOPIC FOR CORPORATE COUNSEL AND MANAGEMENT"

Transcription

1 Advisor Article DATA SECURITY: A CRUCIAL TOPIC FOR CORPORATE COUNSEL AND MANAGEMENT By James R. Carroll, David S. Clancy and Christopher G. Clark* Skadden, Arps, Slate, Meagher & Flom Customer data security breaches are on the rise, and so too is litigation and enforcement action -- sometimes against the perpetrators (if they can be identified), but also against the companies whose data was compromised. Equally if not more important is the potential damage to a company s reputation and goodwill as a result of a consumer information security breach. Information security breaches can occur in a number of ways, such as through the physical loss of electronic hardware (such as a stolen laptop computer, a Blackberry inadvertently left in a taxicab or a misplaced USB flash drive), through invasive and illegal tactics (such as Internet hacking) or simply as a result of human error (for example, a customer service representative who unsuspectingly discloses consumer information). A company s employees, consultants, and vendors also may improperly access, use or disclose customer information, which can also constitute a security breach under some state and federal laws. The consequences of a data security breach can be severe. In January of this year, the TJX Companies (the parent company of several retail stores including T.J. Maxx and Marshalls) disclosed that computer hackers broke into its computer system and obtained the credit card numbers and other personal information of more than 45 million customers. In the ten months since TJX first disclosed the security breach, more than 30 private lawsuits have been filed, government agencies initiated investigations and the company expended considerable financial resources to investigate, contain, litigate and settle consumer complaints -- upwards of $1.6 billion according to the estimate of one security firm. 1 This incident, among others, demonstrates that data security breaches are an area of significant and steadily-increasing risk for companies.

2 In today s data-driven business world, implementing information security programs to prevent potential data breaches, and having a plan in place to rapidly respond to a potential data intrusion, are essential. This article presents certain high-level recommendations in this area, and should be a useful primer for corporate management and counsel. Nevertheless, in this constantly-changing area there is no substitute for careful examination of each company s unique facts and circumstances with the participation of management, information technology personnel and knowledgeable counsel. Recommendation 1: Understand Existing State and Federal Regulation and How it Impacts your Company As an initial matter, corporate management and counsel must analyze and understand the applicable law, both to assess how it impacts the company s day-to-day operations and to enable the company to respond in a rapid and informed manner in the event of a data security breach. Furthermore, given that the relevant legal landscape is evolving, this analysis should occur on a continuing basis. Over the past few years, Congress has proposed several pieces of federal legislation aimed at addressing this developing issue specifically and comprehensively, but no such federal law has yet been enacted. Until a more comprehensive federal statute is passed (and potentially preempts varying state laws), companies must survey and understand the obligations imposed by several potentially-applicable laws: Federal Legislation. Several industry-specific statutes impose information security standards and notification obligations on covered companies. For example, the Financial Modernization Act of 1999 (the Gramm-Leach-Bliley Act), which applies to financial services firms, the Telecommunications Act of 1996, which applies to telecommunications carriers, and the Health Insurance Portability and Accountability Act of 1996 (HIPAA), which applies to companies operating in the health care industry, establish minimum information security protocols. Similarly, the Fair and Accurate Credit Transactions Act of 2003, which applies to any entity over which the Federal Trade Commission has jurisdiction, imposes standards for the disposal of consumer information and requires the implementation of reasonable measures to protect against unauthorized access to or use of consumer information in connection with the disposal of such information. Consequently, businesses operating in these regulated areas must evaluate existing business practices and the security of their information systems in light of federal standards, as well as understand their obligations in the event of a data breach. State Statutes. More than 35 states have passed some version of a consumer information security statute establishing standards for the maintenance of customer data and/or protocols for notifying consumers when a company believes an information breach has occurred. Complying with the particular requirements of dozens of state statutes, many of which directly conflict, can prove particularly challenging for companies that operate nationwide. For example, Hawaii s statute provides that notice of a security breach shall describe the incident in general terms and the type of personal information subject to unauthorized access (see Haw. Rev. Stat. 487N-2), while the Massachusetts statute expressly provides that the consumer notification shall not include the nature of the breach or the number of Massachusetts residents affected (see Mass. H. No to be codified at Mass. Gen. Laws ch. 93H, 1-8). International Standards. Businesses that operate internationally also may be subject to data security and notification regulations in countries other than the United States. For example, two directives currently governing data security in the European Union impose minimum information security thresholds that require, among other things, the implementation of technological and organizational measures to protect personal data against accidental or unlawful disclosure or access. Although those directives currently do not mandate notification of individual consumers in the event of a data breach, such notification systems have been proposed. In addition to potentially-applicable federal and international standards, the most significant challenge facing many companies is understanding and complying with the different information security and disclosure obligations imposed by varying state statutes.

3 Most state statutes are triggered upon the unauthorized disclosure of an individual s personal information, which is generally defined to be an individual s name in combination with other sensitive information such as a social security number, driver s license number or certain account numbers. Once the statute is triggered, a whole host of notification obligations are imposed, such as direct notification to the affected consumers, alerting state agencies or state police, informing credit reporting bureaus or a combination of all three. Significantly, the form and substance of the consumer notification varies from state to state, with some states permitting telephonic or notification (and others prohibiting it) and some states requiring a brief explanation of the security breach and the company s efforts to restore the integrity of the information system (and others expressly prohibiting such an explanation). The penalties imposed for failing to comply with state notification statutes vary, with some statutes vesting the state attorney general with the power to commence a civil action seeking legal and equitable relief, others creating a private cause of action whereby consumers can obtain a financial recovery for actual damages sustained, and one statute (Florida) that provides for an administrative fine of up to $500,000. In sum, it is necessary to identify and understand the myriad potentially-applicable state, federal and international regulations to evaluate your company s compliance with existing information security standards for data that you maintain, as well as the legal obligations that may be triggered in the event of an information security breach. Recommendation 2: Plan to Prevent a Data Security Breach Companies can significantly reduce the possibility of sustaining the substantial financial, goodwill and other damaging consequences associated with a data security breach by developing and implementing a comprehensive information security plan. An effective data security plan begins with a critical assessment of the information your business collects and maintains, the manner in which that information is stored (both in hard copy and electronically), the length of time the information is retained and the identification of the individuals who have access to the information. A comprehensive information security plan also includes the clear identification of individuals and departments who are accountable for information security, as well as employee training on the prevention, detection and response to attacks, intrusions and other data security breaches. Although the specific information technology needs of each business are unique, general recommendations for information security include installing a firewall to protect personal information (a computer program that prevents computer hackers from accessing your information systems), implementing a routine password cycling procedure and avoiding the use of default system passwords (i.e., setting the password to password ), installing and regularly-updating anti-virus and anti-spyware software and instituting a comprehensive mechanism to track all access to network resources (such as installing network management software). Companies that use paycard services (such as Visa and Mastercard) must also comply with strict policies for protecting consumer information that are incorporated into the PayCard Industry Data Security standard ( PCI DSS ). See PCI Security Standards Council, About the PCI Data Security Standard (PCI DSS), https://www.pcisecuritystandards.org/tech/index.html. The PCI DSS establishes a set of comprehensive requirements for enhancing data security that paycard service users may be required to implement under the terms of their contract with individual paycard providers. Compliance with these industry standards (even if your business is not required to do so) can further ensure that individual personal information is protected and company liability reduced. It is also important for companies to recognize that not all information security breaches are external -- studies suggest that in many cases the breach may be the result of an employee s unauthorized access to sensitive information, misuse by a vendor or contractor or simply human error. For example, the State of Connecticut recently sued a consultant (Accenture) it hired to implement a new computer system following the inadvertent disclosure of several hundred state agency bank account numbers and purchasing cards. 2 Accenture has since released a statement indicating that the information breach was the result of human error and its employees failure to follow the

4 firm s established privacy and data protection policies. Accordingly, companies should (1) implement business need-to-know policies that limit the number of employees who have access to sensitive consumer information, (2) implement and enforce generally-applicable employment policies governing access to and use of information and (3) review vendor and consultant data security standards and limit (or eliminate) those service providers access to sensitive information when possible. Recommendation 3: Design a Plan for Responding to a Data Security Breach Before it Happens Each breach situation will present its own set of facts and challenges, but a company generally should be prepared to follow four basic principles when a data breach occurs. These four principles can be remembered as the Four I s : 1. Investigate. Promptly examine the nature of the breach and assess the number of customers potentially at risk, the type of account information at risk (e.g., account number, magnetic stripe data, cardholder name and address) and the time frame of the information compromised. Determine whether the information was encrypted and, if so, whether the encryption was compromised. Companies also should consider retaining an experienced forensic consultant to assist with investigating the breach. Partnering with a state-of-the-art expert may provide additional benefits in subsequent litigation and in terms of restoring customer confidence. 2. Implement Restorative Measures. As soon as possible, implement appropriate measures to contain the security breach and restore the integrity of the information system. Here again, an expert consultant may be particularly helpful. 3. Inform. Notify consumers, state agencies and consumer reporting bureaus as and when appropriate under applicable state, federal and international notification statutes. Most state statutes require notification in the most expedient time and manner possible and without unreasonable delay ; however, some states require notification within a specified number of days. 3 Additionally, contracts with business partners and bank card service providers, such as Visa and MasterCard, may impose affirmative notification obligations in certain circumstances. Independent of any external notification requirements, companies may well determine that it makes good business sense to promptly notify customers of a potential breach to prevent identity theft and maintain customer confidence. In any notification scenario, companies must be cognizant of the likelihood of significant publicity and press coverage and should consider the potential need for a public relations or crisis management strategy. 4. Identify -- and Incorporate -- Improvements. Evaluate the effectiveness of your company s existing information security systems and response plan, identify areas for improvement and, if necessary, implement new systems and policies. In sum, companies should discuss -- and be prepared to take -- substantial steps in anticipation of a data security breach. Advance preparation for a security breach that involves offices or individuals responsible for information security and coordinating the company s response to a potential breach (information technology, legal counsel, public and media relations and senior management) is essential to managing the risk associated with a company s sensitive consumer information. Conclusion Customer information is essential to the operation of most businesses today, and safeguarding that information has become increasingly challenging. Nevertheless, companies that develop comprehensive information security strategies -- and implement and routinely reevaluate them -- can significantly mitigate the risk of a data security breach (and the financial and goodwill costs associated therewith). If, despite those best efforts, a data breach still occurs, companies that understand the varying state, federal and international legal obligations will be best equipped to respond rapidly and in a manner that restores the integrity of the information system and customer confidence.

5 Ten Key Data Security Strategies While there is no substitute for developing and implementing an information security program specifically tailored to the unique needs of each business, the following ten strategies highlight several core data security strategies. 1. Survey And Understand All Potentially-Applicable Laws. Identify all potentially-applicable state, federal and international laws with the assistance of legal counsel to assess the ways in which those laws may affect your business, both in terms of its existing operational practices and in the event of a data breach. 2. Review And Revise Contracts With Clients, Vendors And Service Providers. Conduct a thorough review of the contractual obligations your company may with clients, vendors and service providers to ensure your compliance with those agreements and to identify potential notification obligations in the event of a data breach. This review also may identify agreements that require modification to ensure service providers appropriately safeguard consumer information your business collects and maintains. 3. Assess The Data Your Company Collects And Retains. Identify the types of customer information your business routinely collects, the manner in which it is stored and maintained, when and how (and if) it is customarily disposed, and assess whether the information is still needed (or should have been collected in the first place). 4. Collect And Retain Less Data. Collect only the information that is essential to your business, and implement a data retention policy that routinely -- and safely -- discards unnecessary consumer data. 5. Encrypt The Data You Keep. Use state-of-the-art encryption technology to protect sensitive consumer information and isolate the encryption key to prevent its disclosure. 6. Limit Employee And Third-Party Access to Sensitive Data. Implement a business need-to-know policy that restricts employee access to sensitive consumer information to reduce the likelihood of unauthorized disclosure and use of customer data. Include contract provisions that restrict the use of customer information and, when possible, limit (or altogether eliminate) the sharing of customer information with vendors and other third-parties. 7. Develop a Response Plan for a Potential Data Breach Before You Need It. Formulate a comprehensive action plan now and identify the individuals responsible for coordinating the company s response to ensure rapid implementation if a data security breach is detected or suspected. 8. Implement An Information Notification Policy. Many state consumer notification statutes provide that disclosure of a potential security breach in a manner consistent with a company s usual information notification policy generally satisfies the state notification requirements. See Del. Code tit. 6, 12B Routinely Test The Integrity of Your Information Systems. Routinely conduct training exercises (announced and unannounced) to identify vulnerabilities in your information security systems and evaluate your company s response to a suspected breach. 10. Periodically Reevaluate Based on Evolving Business Needs. Data security measures, the types of information collected and maintained, and response plans to a data security breach must be continually revised as your business changes. * James R. Carroll and David S. Clancy are litigation partners, and Christopher G. Clark is a litigation associate, at Skadden, Arps, Slate, Meagher & Flom LLP in Boston. The opinions expressed in this Article are those of the authors and not necessarily those of Skadden, Arps or its clients. 1 Data theft to cost TJX 1.6 billion, says vendor, TechWorld, June 11, 2007, 2 Attorney General, Comptroller Sue Accenture Over Loss, Misuse Of Confidential Taxpayer, State Bank Account Information, September 19, 2007,

Introduction to Data Security Breach Preparedness with Model Data Security Breach Preparedness Guide

Introduction to Data Security Breach Preparedness with Model Data Security Breach Preparedness Guide Introduction to Data Security Breach Preparedness with Model Data Security Breach Preparedness Guide by Christopher Wolf Directors, Privacy and Information Management Practice Hogan Lovells US LLP christopher.wolf@hoganlovells.com

More information

SECTION-BY-SECTION ANALYSIS

SECTION-BY-SECTION ANALYSIS INTRODUCED BY CONGRESSMAN RANDY NEUGEBAUER (R-TX) AND CONGRESSMAN JOHN CARNEY (D-DE) SECTION-BY-SECTION ANALYSIS Section 1: Short Title The Data Security Act of 2015. Section 2: Purposes The purposes of

More information

Protecting Personal Information: The Massachusetts Data Security Regulation (201 CMR 17.00)

Protecting Personal Information: The Massachusetts Data Security Regulation (201 CMR 17.00) Protecting Personal Information: The Massachusetts Data Security Regulation (201 CMR 17.00) May 15, 2009 LLP US Information Security Framework Historically industry-specific HIPAA Fair Credit Reporting

More information

CSR Breach Reporting Service Frequently Asked Questions

CSR Breach Reporting Service Frequently Asked Questions CSR Breach Reporting Service Frequently Asked Questions Quick and Complete Reporting is Critical after Data Loss Why do businesses need this service? If organizations don t have this service, what could

More information

IDENTITY THEFT: DATA SECURITY FOR EMPLOYERS. Boston, MA 02110 Richmond, Virginia 23219 Tel. (617) 502.8238 Tel. (804) 783.7579

IDENTITY THEFT: DATA SECURITY FOR EMPLOYERS. Boston, MA 02110 Richmond, Virginia 23219 Tel. (617) 502.8238 Tel. (804) 783.7579 IDENTITY THEFT: DATA SECURITY FOR EMPLOYERS Daniel J. Blake, Esq. Vijay K. Mago, Esq. LeClairRyan, A Professional Corporation LeClairRyan, A Professional Corporation One International Place, Eleventh Floor

More information

Data Privacy and Security: A Primer for Law Firms

Data Privacy and Security: A Primer for Law Firms Data Privacy and Security: A Primer for Law Firms All We Do Is Work. Workplace Law. In four time zones and 46 major locations coast to coast. www.jacksonlewis.com JACKSON LEWIS SERVING THE DIVERSE NEEDS

More information

Issue #5 July 9, 2015

Issue #5 July 9, 2015 Issue #5 July 9, 2015 Breach Response Plans by Lyndsay A. Wasser, CIPP/C, Co-Chair Privacy Privacy breaches can occur despite an organization s best efforts to prevent them. When such incidents arise,

More information

Cybersecurity. Shamoil T. Shipchandler Partner, Bracewell & Giuliani LLP 214.758.1048

Cybersecurity. Shamoil T. Shipchandler Partner, Bracewell & Giuliani LLP 214.758.1048 Cybersecurity Shamoil T. Shipchandler Partner, Bracewell & Giuliani LLP 214.758.1048 Setting expectations Are you susceptible to a data breach? October 7, 2014 Setting expectations Victim Perpetrator

More information

PROFESSIONAL RISK PRIVACY CLAIMS SCENARIOS

PROFESSIONAL RISK PRIVACY CLAIMS SCENARIOS PROFESSIONAL RISK PRIVACY CLAIMS SCENARIOS The following claim scenarios are hypothetical and are offered solely to illustrate the types of situations that may result in claims. Although sorted by industry,

More information

Navigating the New MA Data Security Regulations

Navigating the New MA Data Security Regulations Navigating the New MA Data Security Regulations Robert A. Fisher, Esq. 2009 Foley Hoag LLP. All Rights Reserved. Presentation Title Data Security Law Chapter 93H Enacted after the TJX data breach became

More information

Privacy Law Basics and Best Practices

Privacy Law Basics and Best Practices Privacy Law Basics and Best Practices Information Privacy in a Digital World Stephanie Skaff sskaff@fbm.com What Is Information Privacy? Your name? Your phone number or home address? Your email address?

More information

The Dish on Data and Disks HIPAAPrivacy and Security Breach Developments. Robin B. Campbell Ethan P. Schulman Jennifer S. Romano

The Dish on Data and Disks HIPAAPrivacy and Security Breach Developments. Robin B. Campbell Ethan P. Schulman Jennifer S. Romano The Dish on Data and Disks HIPAAPrivacy and Security Breach Developments Robin B. Campbell Ethan P. Schulman Jennifer S. Romano HIPAAPrivacy and Security Breach Overview of the Laws Developments Incident

More information

Network Security & Privacy Landscape

Network Security & Privacy Landscape Network Security & Privacy Landscape Presented By: Greg Garijanian Senior Underwriter Professional Liability 1 Agenda Network Security Overview -Latest Threats - Exposure Trends - Regulations Case Studies

More information

California s New Hacker Disclosure Law and its Potential Impact on Canadian Businesses

California s New Hacker Disclosure Law and its Potential Impact on Canadian Businesses Reprinted from The Lawyers Weekly, August 15, 2003 California s New Hacker Disclosure Law and its Potential Impact on Canadian Businesses Berkley D. Sells Fasken Martineau DuMoulin LLP A California law

More information

Data security: A growing liability threat

Data security: A growing liability threat Data security: A growing liability threat Data security breaches occur with alarming frequency in today s technology-laden world. Even a comparatively moderate breach can cost a company millions of dollars

More information

DATA PRIVACY ENFORCEMENT EFFORTS BY STATE ATTORNEYS GENERAL

DATA PRIVACY ENFORCEMENT EFFORTS BY STATE ATTORNEYS GENERAL DATA PRIVACY ENFORCEMENT EFFORTS BY STATE ATTORNEYS GENERAL State AGs have been very active in the leadership of data privacy protection initiatives across the country, and have dedicated considerable

More information

Lessons Learned from Recent HIPAA and Big Data Breaches. Briar Andresen Katie Ilten Ann Ladd

Lessons Learned from Recent HIPAA and Big Data Breaches. Briar Andresen Katie Ilten Ann Ladd Lessons Learned from Recent HIPAA and Big Data Breaches Briar Andresen Katie Ilten Ann Ladd Recent health care breaches Breach reports to OCR as of February 2015 1,144 breaches involving 500 or more individual

More information

MIT s Information Security Program for Protecting Personal Information Requiring Notification. (Revision date: 2/26/10)

MIT s Information Security Program for Protecting Personal Information Requiring Notification. (Revision date: 2/26/10) MIT s Information Security Program for Protecting Personal Information Requiring Notification (Revision date: 2/26/10) Table of Contents 1. Program Summary... 3 2. Definitions... 4 2.1 Identity Theft...

More information

Accepting Payment Cards and ecommerce Payments

Accepting Payment Cards and ecommerce Payments Policy V. 4.1.1 Responsible Official: Vice President for Finance and Treasurer Effective Date: September 29, 2010 Accepting Payment Cards and ecommerce Payments Policy Statement The University of Vermont

More information

MASSACHUSETTS IDENTITY THEFT RANKING BY STATE: Rank 23, 66.5 Complaints Per 100,000 Population, 4292 Complaints (2006) Updated January 17, 2009

MASSACHUSETTS IDENTITY THEFT RANKING BY STATE: Rank 23, 66.5 Complaints Per 100,000 Population, 4292 Complaints (2006) Updated January 17, 2009 MASSACHUSETTS IDENTITY THEFT RANKING BY STATE: Rank 23, 66.5 Complaints Per 100,000 Population, 4292 Complaints (2006) Updated January 17, 2009 Current Laws: Identity Crime: A person is guilty of identity

More information

CYBERSECURITY: THREATS, SOLUTIONS AND PROTECTION. Robert N. Young, Director Carruthers & Roth, P.A. Email: rny@crlaw.com Phone: (336) 478-1131

CYBERSECURITY: THREATS, SOLUTIONS AND PROTECTION. Robert N. Young, Director Carruthers & Roth, P.A. Email: rny@crlaw.com Phone: (336) 478-1131 CYBERSECURITY: THREATS, SOLUTIONS AND PROTECTION Robert N. Young, Director Carruthers & Roth, P.A. Email: rny@crlaw.com Phone: (336) 478-1131 TOPICS 1. Threats to your business s data 2. Legal obligations

More information

Massachusetts MA 201 CMR 17.00. Best Practice Guidance on How to Comply

Massachusetts MA 201 CMR 17.00. Best Practice Guidance on How to Comply Massachusetts MA 201 CMR 17.00 Best Practice Guidance on How to Comply Massachusetts MA 201 CMR 17.00 Best Practices for Compliance 1 Overview MA 201 CMR 17.00 has been in the news for the last 18 months.

More information

2005 -- H 6191 SUBSTITUTE A AS AMENDED ======= LC02663/SUB A/2 ======= STATE OF RHODE ISLAND IN GENERAL ASSEMBLY JANUARY SESSION, A.D.

2005 -- H 6191 SUBSTITUTE A AS AMENDED ======= LC02663/SUB A/2 ======= STATE OF RHODE ISLAND IN GENERAL ASSEMBLY JANUARY SESSION, A.D. 00 -- H 11 SUBSTITUTE A AS AMENDED LC0/SUB A/ STATE OF RHODE ISLAND IN GENERAL ASSEMBLY JANUARY SESSION, A.D. 00 A N A C T RELATING TO IDENTITY THEFT PROTECTION Introduced By: Representatives Gemma, Sullivan,

More information

Data Breach Response Basic Principles Under U.S. State and Federal Law. ABA Litigation Section Core Knowledge January 2015 1

Data Breach Response Basic Principles Under U.S. State and Federal Law. ABA Litigation Section Core Knowledge January 2015 1 Data Breach Response Basic Principles Under U.S. State and Federal Law ABA Litigation Section Core Knowledge January 2015 1 I. Introduction Data breaches have become an unfortunate reality for many of

More information

COMPLIANCE ALERT 10-12

COMPLIANCE ALERT 10-12 HAWAII HEALTH SYSTEMS C O R P O R A T I O N "Touching Lives Every Day COMPLIANCE ALERT 10-12 HIPAA Expansion under the American Recovery and Reinvestment Act of 2009 The American Recovery and Reinvestment

More information

Who Should Know This Policy 2 Definitions 2 Contacts 3 Procedures 3 Forms 5 Related Documents 5 Revision History 5 FAQs 5

Who Should Know This Policy 2 Definitions 2 Contacts 3 Procedures 3 Forms 5 Related Documents 5 Revision History 5 FAQs 5 Information Security Policy Type: Administrative Responsible Office: Office of Technology Services Initial Policy Approved: 09/30/2009 Current Revision Approved: 08/10/2015 Policy Statement and Purpose

More information

Cyber and Privacy Risk What Are the Trends? Is Insurance the Answer?

Cyber and Privacy Risk What Are the Trends? Is Insurance the Answer? Minnesota Society for Healthcare Risk Management September 22, 2011 Cyber and Privacy Risk What Are the Trends? Is Insurance the Answer? Melissa Krasnow, Partner, Dorsey & Whitney, and Certified Information

More information

Payment Card Industry Data Security Standard Training. Chris Harper Vice President of Technical Services Secure Enterprise Computing, Inc.

Payment Card Industry Data Security Standard Training. Chris Harper Vice President of Technical Services Secure Enterprise Computing, Inc. Payment Card Industry Data Security Standard Training Chris Harper Vice President of Technical Services Secure Enterprise Computing, Inc. March 27, 2012 Agenda Check-In 9:00-9:30 PCI Intro and History

More information

Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation

Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation View the online version at http://us.practicallaw.com/7-523-1520 Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation MELISSA J. KRASNOW, DORSEY & WHITNEY LLP

More information

Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation

Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation View the online version at http://us.practicallaw.com/7-523-1520 Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation Melissa J. Krasnow, Dorsey & Whitney LLP

More information

SAMPLE TEMPLATE. Massachusetts Written Information Security Plan

SAMPLE TEMPLATE. Massachusetts Written Information Security Plan SAMPLE TEMPLATE Massachusetts Written Information Security Plan Developed by: Jamy B. Madeja, Esq. Erik Rexford 617-227-8410 jmadeja@buchananassociates.com Each business is required by Massachusetts law

More information

Data Security Incident Response Plan. [Insert Organization Name]

Data Security Incident Response Plan. [Insert Organization Name] Data Security Incident Response Plan Dated: [Month] & [Year] [Insert Organization Name] 1 Introduction Purpose This data security incident response plan provides the framework to respond to a security

More information

Data Security: Risks, Compliance and How to be Prepared for a Breach

Data Security: Risks, Compliance and How to be Prepared for a Breach Data Security: Risks, Compliance and How to be Prepared for a Breach Presented by: Sandy B. Garfinkel, Esq. The Data Breach Reality: 2015 AshleyMadison.com (July 2015) Member site facilitating personal

More information

Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation

Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation Written Information Security Programs: Compliance with the Massachusetts Data Security Regulation Melissa J. Krasnow, Dorsey & Whitney LLP A Note discussing written information security programs (WISPs)

More information

ACE Advantage PRIVACY & NETWORK SECURITY

ACE Advantage PRIVACY & NETWORK SECURITY ACE Advantage PRIVACY & NETWORK SECURITY SUPPLEMENTAL APPLICATION COMPLETE THIS APPLICATION ONLY IF REQUESTING COVERAGE FOR PRIVACY LIABILITY AND/OR NETWORK SECURITY LIABILITY COVERAGE. Please submit with

More information

Personal Information Protection Act Information Sheet 11

Personal Information Protection Act Information Sheet 11 Notification of a Security Breach Personal Information Protection Act Information Sheet 11 Introduction Personal information is used by organizations for a variety of purposes: retail and grocery stores

More information

Client Advisory October 2009. Data Security Law MGL Chapter 93H and 201 CMR 17.00

Client Advisory October 2009. Data Security Law MGL Chapter 93H and 201 CMR 17.00 Client Advisory October 2009 Data Security Law MGL Chapter 93H and 201 CMR 17.00 For a discussion of these and other issues, please visit the update on our website at /law. To receive mailings via email,

More information

Data Security Breaches: Learn more about two new regulations and how to help reduce your risks

Data Security Breaches: Learn more about two new regulations and how to help reduce your risks Data Security Breaches: Learn more about two new regulations and how to help reduce your risks By Susan Salpeter, Vice President, Zurich Healthcare Risk Management News stories about data security breaches

More information

Best Practices in Incident Response. SF ISACA April 1 st 2009. Kieran Norton, Senior Manager Deloitte & Touch LLP

Best Practices in Incident Response. SF ISACA April 1 st 2009. Kieran Norton, Senior Manager Deloitte & Touch LLP Best Practices in Incident Response SF ISACA April 1 st 2009 Kieran Norton, Senior Manager Deloitte & Touch LLP Current Landscape What Large scale breaches and losses involving credit card data and PII

More information

DATA BREACH COVERAGE

DATA BREACH COVERAGE THIS ENDORSEMENT CHANGES THE POLICY. PLEASE READ THIS CAREFULLY. DATA BREACH COVERAGE SCHEDULE OF COVERAGE LIMITS Coverage Limits of Insurance Data Breach Coverage $50,000 Legal Expense Coverage $5,000

More information

Data Privacy: What your nonprofit needs to know. Donna Balaguer and Ed Lavergne Washington, D.C. February 5, 2015

Data Privacy: What your nonprofit needs to know. Donna Balaguer and Ed Lavergne Washington, D.C. February 5, 2015 Data Privacy: What your nonprofit needs to know Donna Balaguer and Ed Lavergne Washington, D.C. February 5, 2015 Overview 2 Data privacy versus data security Privacy polices and best practices Data security

More information

Designation of employee(s) in charge of the program; Identifying and assessing risks/threats and evaluating and improving

Designation of employee(s) in charge of the program; Identifying and assessing risks/threats and evaluating and improving PRIVACY & DATA SECURITY LAW JOURNAL MASSACHUSETTS On September 22, 2008, Massachusetts adopted regulations that will require businesses, wherever located, that own, license, store, or maintain information

More information

CONNECTICUT IDENTITY THEFT RANKING BY STATE: Rank 19, 68.8 Complaints Per 100,000 Population, 2409 Complaints (2007) Updated November 28, 2008

CONNECTICUT IDENTITY THEFT RANKING BY STATE: Rank 19, 68.8 Complaints Per 100,000 Population, 2409 Complaints (2007) Updated November 28, 2008 CONNECTICUT IDENTITY THEFT RANKING BY STATE: Rank 19, 68.8 Complaints Per 100,000 Population, 2409 Complaints (2007) Updated November 28, 2008 Current Laws: A person commits identity theft when he intentionally

More information

FINAL May 2005. Guideline on Security Systems for Safeguarding Customer Information

FINAL May 2005. Guideline on Security Systems for Safeguarding Customer Information FINAL May 2005 Guideline on Security Systems for Safeguarding Customer Information Table of Contents 1 Introduction 1 1.1 Purpose of Guideline 1 2 Definitions 2 3 Internal Controls and Procedures 2 3.1

More information

Data Breach and Senior Living Communities May 29, 2015

Data Breach and Senior Living Communities May 29, 2015 Data Breach and Senior Living Communities May 29, 2015 Todays Objectives: 1. Discuss Current Data Breach Trends & Issues 2. Understanding Why The Senior Living Industry May Be A Target 3. Data Breach Costs

More information

Pristine Technology Solutions, Inc.

Pristine Technology Solutions, Inc. Pristine Technology Solutions, Inc. 25 Measures 1. CPOE for Medication Orders 2. Drug Interaction Checks Drug-Drug/Allergy 3. Maintain Problem List 4. Permissible Prescriptions - eprescribing 5. Active

More information

Introduction to PCI DSS

Introduction to PCI DSS Month-Year Introduction to PCI DSS March 2015 Agenda PCI DSS History What is PCI DSS? / PCI DSS Requirements What is Cardholder Data? What does PCI DSS apply to? Payment Ecosystem How is PCI DSS Enforced?

More information

CYBER RISK MANAGEMENT IN THE BOATING INDUSTRY

CYBER RISK MANAGEMENT IN THE BOATING INDUSTRY CYBER RISK MANAGEMENT IN THE BOATING INDUSTRY Carmelo Torraca, Esq. New Jersey Marine Trades Association March 2015 E-commerce has permanently transformed the way business-to-business and business-to-customer

More information

Guidance on data security breach management

Guidance on data security breach management Guidance on data security breach management Organisations which process personal data must take appropriate measures against unauthorised or unlawful processing and against accidental loss, destruction

More information

2011 2012 Aug. Sept. Oct. Nov. Dec. Jan. Feb. March April May-Dec.

2011 2012 Aug. Sept. Oct. Nov. Dec. Jan. Feb. March April May-Dec. The OCR Auditors are coming - Are you next? What to Expect and How to Prepare On June 10, 2011, the U.S. Department of Health and Human Services Office for Civil Rights ( OCR ) awarded KPMG a $9.2 million

More information

Hackers, Slackers & Packers: Preventing Data Loss & Dealing with the Inevitable. Data Breaches Are All Too Common

Hackers, Slackers & Packers: Preventing Data Loss & Dealing with the Inevitable. Data Breaches Are All Too Common Hackers, Slackers & Packers: Preventing Data Loss & Dealing with the Inevitable Steven J. Fox (sjfox@postschell.com) Peter D. Hardy (phardy@postschell.com) Robert Brandfass (BrandfassR@wvuh.com) (Mr. Brandfass

More information

DATA SECURITY BREACH: THE NEW THIRD CERTAINTY OF LIFE

DATA SECURITY BREACH: THE NEW THIRD CERTAINTY OF LIFE DATA SECURITY BREACH: THE NEW THIRD CERTAINTY OF LIFE ACC-Charlotte February 4, 2015 THIS WILL NEVER HAPPEN TO ME! Death, Taxes & Data Breach Not just Home Depot, Target or Sony Do you employ the next

More information

UNIVERSITY OF MAINE SYSTEM STANDARDS FOR SAFEGUARDING INFORMATION ATTACHMENT C

UNIVERSITY OF MAINE SYSTEM STANDARDS FOR SAFEGUARDING INFORMATION ATTACHMENT C UNIVERSITY OF MAINE SYSTEM STANDARDS FOR SAFEGUARDING INFORMATION ATTACHMENT C This Attachment addresses the Contractor s responsibility for safeguarding Compliant Data and Business Sensitive Information

More information

Cyber-insurance: Understanding Your Risks

Cyber-insurance: Understanding Your Risks Cyber-insurance: Understanding Your Risks Cyber-insurance represents a complete paradigm shift. The assessment of real risks becomes a critical part of the analysis. This article will seek to provide some

More information

Information Security Handbook

Information Security Handbook Information Security Handbook Adopted 6/4/14 Page 0 Page 1 1. Introduction... 5 1.1. Executive Summary... 5 1.2. Governance... 5 1.3. Scope and Application... 5 1.4. Biennial Review... 5 2. Definitions...

More information

The Cyber Attack and Hacking Epidemic A Legal and Business Survival Guide

The Cyber Attack and Hacking Epidemic A Legal and Business Survival Guide The Cyber Attack and Hacking Epidemic A Legal and Business Survival Guide Practising Law Institute January 9, 2012 Melissa J. Krasnow, Partner, Dorsey & Whitney LLP, and Certified Information Privacy Professional

More information

Standard: Information Security Incident Management

Standard: Information Security Incident Management Standard: Information Security Incident Management Page 1 Executive Summary California State University Information Security Policy 8075.00 states security incidents involving loss, damage or misuse of

More information

The Matrix Reloaded: Cybersecurity and Data Protection for Employers. Jodi D. Taylor

The Matrix Reloaded: Cybersecurity and Data Protection for Employers. Jodi D. Taylor The Matrix Reloaded: Cybersecurity and Data Protection for Employers Jodi D. Taylor Why Talk About This Now? Landscape is changing Enforcement by federal and state governments on the rise Legislation on

More information

PCI Compliance: Protection Against Data Breaches

PCI Compliance: Protection Against Data Breaches Protection Against Data Breaches Get Started Now: 877.611.6342 to learn more. www.megapath.com The Growing Impact of Data Breaches Since 2005, there have been 4,579 data breaches (disclosed through 2013)

More information

Health Care Information Privacy The HIPAA Regulations What Has Changed and What You Need to Know

Health Care Information Privacy The HIPAA Regulations What Has Changed and What You Need to Know Health Care Information Privacy The HIPAA Regulations What Has Changed and What You Need to Know Note: Information provided to NCRA by Melodi Gates, Associate with Patton Boggs, LLC Privacy and data protection

More information

plantemoran.com What School Personnel Administrators Need to know

plantemoran.com What School Personnel Administrators Need to know plantemoran.com Data Security and Privacy What School Personnel Administrators Need to know Tomorrow s Headline Let s hope not District posts confidential data online (Tech News, May 18, 2007) In one of

More information

CYBER SECURITY SPECIALREPORT

CYBER SECURITY SPECIALREPORT CYBER SECURITY SPECIALREPORT 32 The RMA Journal February 2015 Copyright 2015 by RMA INSURANCE IS AN IMPORTANT TOOL IN CYBER RISK MITIGATION Shutterstock, Inc. The time to prepare for a potential cyber

More information

Mitigating and managing cyber risk: ten issues to consider

Mitigating and managing cyber risk: ten issues to consider Mitigating and managing cyber risk: ten issues to consider The board of directors is responsible for managing and mitigating risk exposure. A recent study conducted by the Ponemon Institute 1 revealed

More information

Legal Ethics in the Information Age: Unique Data Privacy Issues Faced by Law Firms. v2.18.11, rev

Legal Ethics in the Information Age: Unique Data Privacy Issues Faced by Law Firms. v2.18.11, rev Legal Ethics in the Information Age: Unique Data Privacy Issues Faced by Law Firms v2.18.11, rev 1 Presenters Joseph DeMarco, Partner DeVore & DeMarco, LLP Lauren Shy, Assistant General Counsel Fragomen,

More information

(1) regulate the storage, retention, transmission, and security measures for credit card, debit card, and other payment-related data;

(1) regulate the storage, retention, transmission, and security measures for credit card, debit card, and other payment-related data; Legal Updates & News Legal Updates Pending Changes to California s Data Breach Law: New Burdens for Retailers? September 2007 by Christine E. Lyon, William L. Stern Related Practices: Privacy and Data

More information

FORT HAYS STATE UNIVERSITY CREDIT CARD SECURITY POLICY

FORT HAYS STATE UNIVERSITY CREDIT CARD SECURITY POLICY FORT HAYS STATE UNIVERSITY CREDIT CARD SECURITY POLICY Page 1 of 6 Summary The Payment Card Industry Data Security Standard (PCI DSS), a set of comprehensive requirements for enhancing payment account

More information

An Executive Overview of GAPP. Generally Accepted Privacy Principles

An Executive Overview of GAPP. Generally Accepted Privacy Principles An Executive Overview of GAPP Generally Accepted Privacy Principles Current Environment One of today s key business imperatives is maintaining the privacy of your customers personal information. As business

More information

2015 -- S 0134 SUBSTITUTE B ======== LC000486/SUB B/2 ======== S T A T E O F R H O D E I S L A N D

2015 -- S 0134 SUBSTITUTE B ======== LC000486/SUB B/2 ======== S T A T E O F R H O D E I S L A N D 0 -- S 01 SUBSTITUTE B LC000/SUB B/ S T A T E O F R H O D E I S L A N D IN GENERAL ASSEMBLY JANUARY SESSION, A.D. 0 A N A C T RELATING TO CRIMINAL OFFENSES - IDENTITY THEFT PROTECTION Introduced By: Senators

More information

Responding to New Identity Theft Laws

Responding to New Identity Theft Laws Responding to New Identity Theft Laws March 2011 Privacy Expectations Today, there is increasing recognition that an individual has a legitimate interest in controlling the collection, use and disclosure/dissemination

More information

DATA BREACH CHARTS (Current as of December 31, 2015)

DATA BREACH CHARTS (Current as of December 31, 2015) DATA BREACH CHARTS (Current as of December 31, 2015) The charts below provide summary information about data breach notification statutes across the country. California adopted the first data breach notification

More information

PAI Secure Program Guide

PAI Secure Program Guide PAI Secure Program Guide A complete guide to understanding the Payment Card Industry Data Security Requirements and utilizing the PAI Secure Program. Letter From the CEO Welcome to PAI Secure. As you

More information

Page 1. Copyright 2009. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved.

Page 1. Copyright 2009. MFA - Moody, Famiglietti & Andronico, LLP. All Rights Reserved. Page 1 Page 2 Page 3 Agenda Defining the Massachusetts Personal Data Security Law Becoming Compliant Page 4 Massachusetts Privacy Law Defining the Massachusetts Personal Data Security Law - 201 CMR 17.00

More information

Data Security 101. Christopher M. Brubaker. A Lawyer s Guide to Ethical Issues in the Digital Age. cbrubaker@clarkhill.com

Data Security 101. Christopher M. Brubaker. A Lawyer s Guide to Ethical Issues in the Digital Age. cbrubaker@clarkhill.com Data Security 101 A Lawyer s Guide to Ethical Issues in the Digital Age Christopher M. Brubaker cbrubaker@clarkhill.com November 4-5, 2015 Pennsylvania Bar Institute 21 st Annual Business Lawyers Institute

More information

Guidance on data security breach management

Guidance on data security breach management ICO lo Guidance on data security breach management Data Protection Act Contents... 1 Data Protection Act... 1 Overview... 1 Containment and recovery... 2 Assessing the risks... 3 Notification of breaches...

More information

12/4/2013. Regulatory Updates. Eric M. Wright, CPA, CITP. Schneider Downs & Co., Inc. December 5, 2013

12/4/2013. Regulatory Updates. Eric M. Wright, CPA, CITP. Schneider Downs & Co., Inc. December 5, 2013 Regulatory Updates Eric M. Wright, CPA, CITP Schneider Downs & Co., Inc. December 5, 2013 Eric M. Wright, CPA, CITP Eric has been involved with Information Technology with Schneider Downs since 1983. He

More information

HIPAA Security Alert

HIPAA Security Alert Shipman & Goodwin LLP HIPAA Security Alert July 2008 EXECUTIVE GUIDANCE HIPAA SECURITY COMPLIANCE How would your organization s senior management respond to CMS or OIG inquiries about health information

More information

PRINCIPLES ON OUTSOURCING OF FINANCIAL SERVICES FOR MARKET INTERMEDIARIES

PRINCIPLES ON OUTSOURCING OF FINANCIAL SERVICES FOR MARKET INTERMEDIARIES PRINCIPLES ON OUTSOURCING OF FINANCIAL SERVICES FOR MARKET INTERMEDIARIES TECHNICAL COMMITTEE OF THE INTERNATIONAL ORGANIZATION OF SECURITIES COMMISSIONS FEBRUARY 2005 Preamble The IOSCO Technical Committee

More information

FORM OF HIPAA BUSINESS ASSOCIATE AGREEMENT

FORM OF HIPAA BUSINESS ASSOCIATE AGREEMENT FORM OF HIPAA BUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement ( Agreement ) is made and entered into to be effective as of, 20 (the Effective Date ), by and between ( Covered Entity ) and

More information

Data Breach Cost. Risks, costs and mitigation strategies for data breaches

Data Breach Cost. Risks, costs and mitigation strategies for data breaches Data Breach Cost Risks, costs and mitigation strategies for data breaches Tim Stapleton, CIPP/US Deputy Global Head of Professional Liability Zurich General Insurance Data Breaches: Greater frequency,

More information

Securing Your Customer Data Simple Steps, Tips, and Resources

Securing Your Customer Data Simple Steps, Tips, and Resources Securing Your Customer Data This document is intended to provide simple and quick information security steps for small to mid-size merchants that accept credit and/or debit cards as a form of payment for

More information

M E M O R A N D U M. Definitions

M E M O R A N D U M. Definitions M E M O R A N D U M DATE: November 10, 2011 TO: FROM: RE: Krevolin & Horst, LLC HIPAA Obligations of Business Associates In connection with the launch of your hosted application service focused on practice

More information

PCI Compliance for Healthcare

PCI Compliance for Healthcare PCI Compliance for Healthcare Best practices for securing payment card data In just five years, criminal attacks on healthcare organizations are up by a stunning 125%. 1 Why are these data breaches happening?

More information

HIPAA Security Rule Compliance

HIPAA Security Rule Compliance HIPAA Security Rule Compliance Caryn Reiker MAXIS360 HIPAA Security Rule Compliance what is it and why you should be concerned about it Table of Contents About HIPAA... 2 Who Must Comply... 2 The HIPAA

More information

Cyber Liability. AlaHA Annual Meeting 2013

Cyber Liability. AlaHA Annual Meeting 2013 Cyber Liability AlaHA Annual Meeting 2013 Disclaimer We are not providing legal advise. This Presentation is a broad overview of health care cyber loss exposures, the process in the event of loss and coverages

More information

Panel Title: Data Breaches: Industry and Law Enforcement Perspectives on Best Practices

Panel Title: Data Breaches: Industry and Law Enforcement Perspectives on Best Practices Panel Title: Data Breaches: Industry and Law Enforcement Perspectives on Best Practices Over the course of this one hour presentation, panelists will cover the following subject areas, providing answers

More information

A Privacy and Data Security Checklist for All

A Privacy and Data Security Checklist for All July 2015 Many companies know they have to follow privacy and data security rules. Companies in the health care industry know about Health Insurance Portability and Accountability Act (HIPAA). Financial

More information

Privacy Data Loss. Privacy Data Loss. Identity Theft. The Legal Issues

Privacy Data Loss. Privacy Data Loss. Identity Theft. The Legal Issues Doing Business in Oregon Under the Oregon Consumer Identity Theft Protection Act and Related Privacy Risks Privacy Data Loss www.breachblog.com Presented by: Mike Porter March 10, 2009 2 Privacy Data Loss

More information

DATA PROTECTION (JERSEY) LAW 2005 GUIDANCE ON DATA SECURITY BREACH MANAGEMENT

DATA PROTECTION (JERSEY) LAW 2005 GUIDANCE ON DATA SECURITY BREACH MANAGEMENT DATA PROTECTION (JERSEY) LAW 2005 GUIDANCE ON DATA SECURITY BREACH MANAGEMENT GD21 2 DATA PROTECTION (JERSEY) LAW 2005: GUIDANCE ON DATA SECURITY BREACH MANAGEMENT Introduction Organisations which process

More information

Breach Notification Policy

Breach Notification Policy 1. Breach Notification Team. Breach Notification Policy Ferris State University ( Ferris State ), a hybrid entity with health care components, has established a Breach Notification Team, which consists

More information

Sierra College ADMINISTRATIVE PROCEDURE No. AP 3721

Sierra College ADMINISTRATIVE PROCEDURE No. AP 3721 Sierra College ADMINISTRATIVE PROCEDURE No. AP 3721 Electronic Information Security and Data Backup Procedures Date Adopted: 4/13/2012 Date Revised: Date Reviewed: References: Health Insurance Portability

More information

HIPAA Compliance and the Protection of Patient Health Information

HIPAA Compliance and the Protection of Patient Health Information HIPAA Compliance and the Protection of Patient Health Information WHITE PAPER By Swift Systems Inc. April 2015 Swift Systems Inc. 7340 Executive Way, Ste M Frederick MD 21704 1 Contents HIPAA Compliance

More information

Imagine discovering at the end of the day that your wallet is missing. Your driver s license, credit cards

Imagine discovering at the end of the day that your wallet is missing. Your driver s license, credit cards EMPLOYMENT LAW Update Data Security Breaches: Are Your Human Resources Policies Equipped to Avoid and/or Repair the Damage? By Daniel Klein, Esq. INTRODUCTION Imagine discovering at the end of the day

More information

DATA BREACHES: WHEN COMPLIANCE IS NOT ENOUGH

DATA BREACHES: WHEN COMPLIANCE IS NOT ENOUGH DATA BREACHES: WHEN COMPLIANCE IS NOT ENOUGH Andy Watson Grant Thornton LLP. All rights reserved. CYBERSECURITY 2 SURVEY OF CHIEF AUDIT EXECUTIVES (CAEs) GRANT THORNTON'S 2014 CAE SURVEY Data privacy and

More information

HIPAA: Understanding The Omnibus Rule and Keeping Your Business Compliant

HIPAA: Understanding The Omnibus Rule and Keeping Your Business Compliant 1 HIPAA: Understanding The Omnibus Rule and Keeping Your Business Compliant Introduction U.S. healthcare laws intended to protect patient information (Protected Health Information or PHI) and the myriad

More information

Cybersecurity Workshop

Cybersecurity Workshop Cybersecurity Workshop February 10, 2015 E. Andrew Keeney, Esq. Kaufman & Canoles, P.C. E. Andrew Keeney, Esq. Kaufman & Canoles, P.C. 150 West Main Street, Suite 2100 Norfolk, VA 23510 (757) 624-3153

More information

Delaware Cyber Security Workshop September 29, 2015. William R. Denny, Esquire Potter Anderson & Corroon LLP

Delaware Cyber Security Workshop September 29, 2015. William R. Denny, Esquire Potter Anderson & Corroon LLP Changing Legal Landscape in Cybersecurity: Implications for Business Delaware Cyber Security Workshop September 29, 2015 William R. Denny, Esquire Potter Anderson & Corroon LLP Agenda Growing Cyber Threats

More information

Josiah Wilkinson Internal Security Assessor. Nationwide

Josiah Wilkinson Internal Security Assessor. Nationwide Josiah Wilkinson Internal Security Assessor Nationwide Payment Card Industry Overview PCI Governance/Enforcement Agenda PCI Data Security Standard Penalties for Non-Compliance Keys to Compliance Challenges

More information

Trust 9/10/2015. Why Does Privacy and Security Matter? Who Must Comply with HIPAA Rules? HIPAA Breaches, Security Risk Analysis, and Audits

Trust 9/10/2015. Why Does Privacy and Security Matter? Who Must Comply with HIPAA Rules? HIPAA Breaches, Security Risk Analysis, and Audits HIPAA Breaches, Security Risk Analysis, and Audits Derrick Hill Senior Health IT Advisor Kentucky REC Why Does Privacy and Security Matter? Trust Who Must Comply with HIPAA Rules? Covered Entities (CE)

More information

Frequently Asked Questions

Frequently Asked Questions PCI Compliance Frequently Asked Questions Table of Content GENERAL INFORMATION... 2 PAYMENT CARD INDUSTRY DATA SECURITY STANDARD (PCI DSS)...2 Are all merchants and service providers required to comply

More information