UC PRIVACY AND INFORMATION SECURITY STEERING COMMITTEE OCTOBER 25, 2010
|
|
|
- Grace Ford
- 8 years ago
- Views:
Transcription
1 UC PRIVACY AND INFORMATION SECURITY STEERING COMMITTEE OCTOBER 25, 2010
2 Agenda 1:00 pm Welcome Introductions Review of the Committee s Charge A Provisional 18-Month Plan 1:30 Setting the Stage Privacy Issues Impacting UC 2:00 Determining the Path Forward Committee Deliverables Statement of Community Principles and Values Foundational Questions Proposal for :50 Logistics 3:00 Adjourn 2 AGENDA
3 Welcome Introductions Review of the Committee s Charge A Provisional 18-Month Plan 3
4 Review of the Committee s Charge to make recommendations for: an overarching privacy framework that enables UC to meet statutory and regulatory obligations in a manner respectful of individual privacy; specific actions or phases needed to implement this framework as University policy; governance, implementation, and accountability structures across the University with respect to privacy and information security; and a formal ongoing process through which the University can examine and, where necessary, address through policy vehicles, the technical and societal changes that have an impact on University policy and practice in the areas of privacy and information security. 4 WELCOME
5 A Provisional 18-Month Plan Fall 2010 Privacy issues impacting UC UC principles and values of community Foundational questions Winter 2011 Governance and accountability Spring A framework Statement of community principles and values Governance Accountability Policies Summer Break Fall Sustainable review process Implementation process Winter 2012 Recommendations 5 WELCOME
6 Setting the Stage Privacy Issues Impacting UC 6
7 Movie 7 SETTING THE STAGE
8 Privacy Issues Impacting UC Regulatory compliance Serious consequences of failure Financial and operational necessity Increased demand for data sharing Confidential institutional data Faculty and staff between individuals and institutions Technology The expectations of individuals Research and innovation In loco parentis 8 SETTING THE STAGE
9 Regulatory Compliance HIPAA FERPA Patriot Act California Information Practices Act FTC Red Flag Rules GLBA Intellectual Property Protection Federal Privacy Act (SSNs) PCI-DSS (Credit Cards) California Public Records Act Clery Act DOJ IRS E-Discovery Data Mgmt. Plans Mandated By Funding Agencies DMCA CMS Research Misconduct (e.g. human subjects) ADA 9 PRIVACY ISSUES IMPACTING UC EXPECTATIONS OF INSTITUTIONS
10 Regulatory Compliance Best practices for compliance due diligence now sometimes requires preemptive measures rather than reactive corrective action, in contrast to the University s current stance on civil liberty privacy (cf. UC stance on illegal file sharing). 10 PRIVACY ISSUES IMPACTING UC EXPECTATIONS OF INSTITUTIONS
11 Serious Consequences of Failure Data breaches: financial (notification expenses, fines, legal fees, productivity loss), reputational and legislative consequences Virginia Tech tragedy Regulatory investigations (e.g., by Cal/OSHA, OIG, FDA, OCR, ) Suspended research programs Potential loss of Federal financial aid funding (HEOA) 11 PRIVACY ISSUES IMPACTING UC EXPECTATIONS OF INSTITUTIONS
12 Financial and Operational Necessity Regents resolution on administrative efficiency Public transparency and accountability Marketing Development Outsourcing and the ubiquity of free Internet services Complexity and number of University policies related to privacy, information security and records management Incidental personal use PCI banking status to accept credit cards Role of big brother relating to employees (e.g., surveillance cameras) 12 PRIVACY ISSUES IMPACTING UC EXPECTATIONS OF INSTITUTIONS
13 Increasing Demand for Data Sharing Collect more, share more of what s been collected By business, legislators, law enforcement, customers Service provisioning (e.g., atyourservice.ucop.edu) IT security, network management, audit, Health information exchange and networks Tension between California legislature desires for reduced SSN use and increased analysis of student outcomes and accountability (requiring SSNs) California Public Records Act requests USA PATRIOT Act and National Security Letters Open exchange of information and ideas 13 PRIVACY ISSUES IMPACTING UC EXPECTATIONS OF INSTITUTIONS
14 Confidential Institutional Data Institutional data beyond personal information that we may want to protect Infrastructure plans Computer security information Intellectual property Accreditation reviews Campus directories 14 PRIVACY ISSUES IMPACTING UC EXPECTATIONS OF INSTITUTIONS
15 Faculty and Staff: Between Individuals and Institutions Faculty and staff have expectations as individuals, but are also expected to be institutional stewards Authority to access confidential data for work purposes versus for personal purposes (e.g., looking up one s own records or those of family or friends) Clinical faculty are custodians of patient data as physicians, but want more access to data as researchers Social media (e.g., Facebook) friend requests Faculty as patients Blurring of personal and work lives Use of personally owned devices in the workplace Use of institutional resources for (incidental) personal use 15 PRIVACY ISSUES IMPACTING UC EXPECTATIONS OF INSTITUTIONS
16 Technology The net: ubiquitous broadband, free accounts, texting The cloud and outsourcing Mobile devices (smartphones) Emerging technologies (e.g., genetic screening) Civil disobedience in cyberspace Location services (e.g., Foursquare, Loopt and RFID transponders for toll kiosks and automated traffic volume display on billboards) Use of consumer-oriented devices or services in the workplace (e.g., ipads, Skype) 16 PRIVACY ISSUES IMPACTING UC EXPECTATIONS OF INSTITUTIONS
17 Changing and Conflicting Expectations by Individuals I expect: To be able to do routine administrative tasks online (e.g., booking flights, paying bills, ) any time and from anywhere The right people will have access to my personal information (e.g., my doctors, different services from the same campus) That my confidential information will be properly used and protected and that I understand and have a say in what is proper To be safe from on- and off-line threats/crimes Shaped by mainstream media, ubiquitous free net services, information fire hose, Facebook culture, blurring of work and personal lives 17 PRIVACY ISSUES IMPACTING UC EXPECTATIONS OF INSTITUTIONS
18 Research and Innovation Technology research as human subjects research Using network traffic for research Openness open exchange of information and ideas Does privacy stifle innovation? cf. EU Privacy Directive 18 PRIVACY ISSUES IMPACTING UC EXPECTATIONS OF INSTITUTIONS
19 In Loco Parentis Raising student awareness about the potential consequences of their actions How to be smart about using Facebook, etc. Illegal file sharing (DMCA / HEOA) Affirmatively protecting students Making information about students available to credit card companies Availability of information that could embarrass a student in the future Publicly posting names in connection with police activity logs Video of a heated classroom debate 19 PRIVACY ISSUES IMPACTING UC EXPECTATIONS OF INSTITUTIONS
20 Determining the Path Forward Committee Deliverables: Recommendations Foundational Questions Statement of Community Principles and Values Proposal for
21 Committee Deliverables: Recommendations A framework Statement of community principles and values Governance Accountability Policies Sustainable review process Implementation process 21 DETERMINING THE PATH FORWARD
22 Foundational Questions 1. How does the University balance the civil liberty of privacy with its many values and obligations? 2. Do we have a single policy for everyone, or different policies for different communities and/or types of data? 3. Is incidental personal use a right, a privilege or something else? 4. What is the University s level of risk tolerance, especially for regulatory compliance? 5. How does the University determine appropriate ownership of, and access to, data by individuals, campuses, the administration, the Regents and external entities? 22 DETERMINING THE PATH FORWARD
23 Statement of Community Principles and Values How does the University balance the civil liberty of privacy with its many values and obligations? Supervisor cannot read employee s SCENARIO: PRIVACY OF EMPLOYEE Supervisor can read only with employee s consent Privacy protection only as required by law Supervisor obligated to read/review employee s MORE INDIVIDUAL PRIVACY Fosters: Freedom of inquiry and speech, academic freedom An ethical and respectful workplace High employee morale Ability to whistleblow confidentially 23 LESS INDIVIDUAL PRIVACY Fosters: Better regulatory compliance Lower risk of privacy breaches Lower risk of financial, legal and reputational consequences Streamlining of business operations DETERMINING THE PATH FORWARD
24 Proposal for 2010 Working Group develops an initial draft statement of community principles and values 24 DETERMINING THE PATH FORWARD
25 Logistics Additional functional expertise? Communications 25
26 Adjourn universityofcalifornia.edu/privacyinitiative 26
Ethics, Privilege, and Practical Issues in Cloud Computing, Privacy, and Data Protection: HIPAA February 13, 2015
Ethics, Privilege, and Practical Issues in Cloud Computing, Privacy, and Data Protection: HIPAA February 13, 2015 Katherine M. Layman Cozen O Connor 1900 Market Street Philadelphia, PA 19103 (215) 665-2746
Index All entries in the index reference page numbers.
Index All entries in the index reference page numbers. A Audit of organizations, 37-38, Access to personal information 162-163 by individual, 22, 31, 151-154 B assistance by organization, Biometrics, 123-125
Impact of Legal and Regulatory Compliance on Higher Education Information Security Management. Dan Han Virginia Commonwealth University
Impact of Legal and Regulatory Compliance on Higher Education Information Security Management Dan Han Virginia Commonwealth University A little about me Worked in IT for close to 15 years, with 12 years
LEEDS BECKETT UNIVERSITY. Information Security Policy. 1.0 Introduction
LEEDS BECKETT UNIVERSITY Information Security Policy 1.0 Introduction 1.1 Information in all of its forms is crucial to the effective functioning and good governance of our University. We are committed
Compliance in an Outsourced World
Compliance in an Outsourced World HCCA Compliance Institute April 26-29, 29, 2009 Karen D. Wilson Citadel Compliance Group, LLC Dallas, Texas www.citadelcompliance citadelcompliance.com information@citadelcompliance.com
Peer to Peer File Sharing and Copyright Infringement Policy
Peer to Peer File Sharing and Copyright Infringement Policy Overview The abuse of network resources to illegally obtain and distribute media or software, through peer to peer (P2P) networks, or direct
I. U.S. Government Privacy Laws
I. U.S. Government Privacy Laws A. Privacy Definitions and Principles a. Privacy Definitions i. Privacy and personally identifiable information (PII) b. Privacy Basics Definition of PII 1. Office of Management
UNIVERSITY OF CALIFORNIA, SANTA BARBARA
UNIVERSITY OF CALIFORNIA, SANTA BARBARA UCSB BERKELEY DAVIS IRVINE LOS ANGELES MERCED RIVERSIDE SAN DIEGO SAN FRANCISCO SANTA BARBARA SANTA CRUZ February 28, 2013 Office of the Executive Vice Chancellor
And The Question Is: What are the Key AMC Compliance Focus Areas in the Current Regulatory Environment?
And The Question Is: What are the Key AMC Compliance Focus Areas in the Current Regulatory Environment? Panel Members: Joan Podleski, Duke University Luanna Putney, University of California Kristen West,
IT Vendor Due Diligence. Jennifer McGill CIA, CISA, CGEIT IT Audit Director Carolinas HealthCare System December 9, 2014
IT Vendor Due Diligence Jennifer McGill CIA, CISA, CGEIT IT Audit Director Carolinas HealthCare System December 9, 2014 Carolinas HealthCare System (CHS) Second largest not-for-profit healthcare system
CODE OF ETHICS AND BUSINESS CONDUCT
CODE OF ETHICS AND BUSINESS CONDUCT Date of Issue: 22 January 2015 Version number: 2 LUXFER HOLDINGS PLC Code of Ethics and Business Conduct Luxfer Holdings PLC is committed to conducting its business
Understanding HIPAA Privacy and Security Helping Your Practice Select a HIPAA- Compliant IT Provider A White Paper by CMIT Solutions
Understanding HIPAA Privacy and Security Helping Your Practice Select a HIPAA- Compliant IT Provider A White Paper by CMIT Solutions Table of Contents Understanding HIPAA Privacy and Security... 1 What
IT Security & Compliance Risk Assessment Capabilities
ATIBA Governance, Risk and Compliance ATIBA provides information security and risk management consulting services for the Banking, Financial Services, Insurance, Healthcare, Manufacturing, Government,
SUMMARY OF POSITION ROLE/RESPONSIBILITIES:
SUMMARY OF POSITION ROLE/RESPONSIBILITIES: Reporting to the Senior Vice President for Administration, this position is responsible for ensuring that the University of Florida, in its entirety, is compliant
Information Security Plan May 24, 2011
Information Security Plan May 24, 2011 REVISION CONTROL Document Title: Author: HSU Information Security Plan John McBrearty Revision History Revision Date Revised By Summary of Revisions Sections Revised
Virginia Commonwealth University Information Security Standard
Virginia Commonwealth University Information Security Standard Title: Scope: Data Classification Standard This document provides the classification requirements for all data generated, processed, stored,
Inhouse Masterclass: Data Developments - Cyber Security & the Right to be Forgotten. MHC.ie
Inhouse Masterclass: Data Developments - Cyber Security & the Right to be Forgotten MHC.ie Rewriting the Past Oisin Tobin otobin@mhc.ie Agenda 1. Background 2. Findings and impact: a) Jurisdiction b) A
The Importance of Privacy & Data Security in a Changing World
Cyber, PrivaCy & Data SeCurity 360 www.mpplaw.com about our PraCtiCe Data is the lifeblood of our global economy. Collected, stored and transmitted, digital data not only imparts great opportunities, but
INFORMATION TECHNOLOGY RISK MANAGEMENT PLAN
10/25/2012 TECHNOLOGY SERVICES INFORMATION TECHNOLOGY RISK MANAGEMENT PLAN Procedure Name: LIT Risk Management Information Technology Plan ver 2.31.docx Risk Management Plan Issue Date: TBD Procedure Owner:
ADMINISTRATORS SERIES PRIVACY AND SECURITY AT UF. Cheryl Granto Information Security Manager, UFIT Information Security
ADMINISTRATORS SERIES PRIVACY AND SECURITY AT UF Susan Blair Chief Privacy Officer Cheryl Granto Information Security Manager, UFIT Information Security RULES OF THE ROAD Information Highway Danger Zones
Research Support Council (RSC) - What Data is Sensitive and How
Research Support Council (RSC) - What Data is Sensitive and How Do We Keep it Private? John L. Baines, AD IT Policy & Compliance Tuesday, May 14, 2013 9:00 am 9:30 am Witherspoon Student Center John_Baines@ncsu.edu
Information Security Policy and Handbook Overview. ITSS Information Security June 2015
Information Security Policy and Handbook Overview ITSS Information Security June 2015 Information Security Policy Control Hierarchy System and Campus Information Security Policies UNT System Information
Marist College. Information Security Policy
Marist College Information Security Policy February 2005 INTRODUCTION... 3 PURPOSE OF INFORMATION SECURITY POLICY... 3 INFORMATION SECURITY - DEFINITION... 4 APPLICABILITY... 4 ROLES AND RESPONSIBILITIES...
Our Commitment to Information Security
Our Commitment to Information Security What is HIPPA? Health Insurance Portability and Accountability Act 1996 The HIPAA Privacy regulations require health care providers and organizations, as well as
Best Practices for DLP Implementation in Healthcare Organizations
Best Practices for DLP Implementation in Healthcare Organizations Healthcare organizations should follow 4 key stages when deploying data loss prevention solutions: 1) Understand Regulations and Technology
Acceptable Use of Information Technology
Acceptable Use of Information Technology No.: 3501 Category: Information Technology Services Approving Body: Leadership Team Executive Division: Learning and Technology Services Department Responsible:
EXAMINATION OUTLINE FOR PRIVATE INVESTIGATORS
EXAMINATION OUTLINE FOR PRIVATE INVESTIGATORS 2014 I. Ethics (18%) This area assesses the candidate s ability to comply with ethical standards of private investigators regarding privacy rights, confidentiality,
Law & Ethics, Policies & Guidelines, and Security Awareness
Law & Ethics, Policies & Guidelines, and Security Awareness Modifications by Prof. Dong Xuan and Adam C. Champion Principles of Information Security, 5th Edition 1 Learning Objectives Upon completion of
Prepared by: The Office of Corporate Compliance & HIPAA Administration
Gwinnett Health System s Annual Education 2014 Corporate Compliance: Our Commitment to Excellence Prepared by: The Office of Corporate Compliance & HIPAA Administration Objectives After completing this
Stephen Hess. Jim Livingston. Program Name. IAM Executive Sponsors. Identity & Access Management Program Charter Dated 3 Jun 15
Program Name Identity and Access Management (IAM) Implementation IAM Executive Sponsors Jim Livingston Stephen Hess 1 P age Project Scope Project Description The goal of this project is to implement an
DATA AND USER ACCESS POLICIES
Contents UNIVERSITY OF CHICAGO ALUMNI & DEVELOPMENT DATABASE (GRIFFIN) DATA AND USER ACCESS POLICIES Approved by the Griffin Steering Committee 2/1/07 What is Griffin? Griffin Policies & Procedures Your
Benefits of Social Media
Jennifer Mensik, PhD, MBA, RN Nancy Spector, PhD, RN Benefits of Social Media Expedites communication among staff Ready reference Enhances professional and personal development ANA House of Delegates Action
Cloud Service Agreements: Avoiding the Pitfalls of the Cloud as a Commodity. Amy Mushahwar, Esq.
Cloud Service Agreements: Avoiding the Pitfalls of the Cloud as a Commodity Amy Mushahwar, Esq. What s New? Not That Much. Some have their heads in the cloud we prefer to stay down in the weeds and know
VICTOR VALLEY COMMUNITY COLLEGE DISTRICT ADMINISTRATIVE PROCEDURE. Computer Use - Computer and Electronic Communication Systems.
VICTOR VALLEY COMMUNITY COLLEGE DISTRICT ADMINISTRATIVE PROCEDURE GENERAL INSTITUTION Chapter 3 Computer Use - Computer and Electronic Communication Systems AP 3720(a) Contents 1.0 Introduction...1 2.0
Ubiquity of Email Security Compliance and Content Management
CIBC Global Services Ubiquity of Email Security Compliance and Content Management Stephen Dodd Director Enterprise Accounts dodd@echoworx.com 416-226-8616 404-551-3077 2006, Echoworx Corporation Agenda
Implementing Information Security Policies and Standards. A Real Life Example
Implementing Information Security Policies and Standards A Real Life Example Bruce W. Edwards Manager Audit and Assurance - TAS What we will review 1. Understand InfoSec, why should we? 2. Assess Your
Partner / E-Discovery Team Chair. Craig Roy Director of IT & E-Litigation Services
E-Discovery Business Readiness Drew Sorrell, Esq. Partner / E-Discovery Team Chair Craig Roy Director of IT & E-Litigation Services What is Business Readiness in terms of E-Discovery? Risk Adjusted Management
APPROVED BY: DATE: NUMBER: PAGE: 1 of 9
1 of 9 PURPOSE: To define standards for appropriate and secure use of MCG Health electronic systems, specifically e-mail systems, Internet access, phones (static or mobile; including voice mail) wireless
Human Resources & E-Discovery Law: New Challenges in Museum Admi
Human Resources & E-Discovery Law: New Challenges in Museum Admi Timothy Chester Timothy J. Chester & Associates Daniel Estrada D.C. Estrada Star Swift, JD, MLIR Grand Valley State University Every story
How To Help Your Business With Data Security And Privacy
DATA SECURITY AND PRIVACY WORKING TOGETHER, OUR TEAM PROVIDES INSIGHTFUL COUNSEL AND A DEPTH OF SPECIALIZED EXPERIENCE. Overview: S ince well before companies entered the age of Big Data, Benesch attorneys
Identity Theft Prevention Committee Updates and Discussions: 3/15. Team,
Identity Theft Prevention Committee Updates and Discussions: 3/15 Team, We will be meeting on Monday, March 19 th to move forward with the Identity Theft Prevention Program. Please bring the packet that
Rowan University Data Governance Policy
Rowan University Data Governance Policy Effective: January 2014 Table of Contents 1. Introduction... 3 2. Regulations, Statutes, and Policies... 4 3. Policy Scope... 4 4. Governance Roles... 6 4.1. Data
BHF Southern African Conference
BHF Southern African Conference Navigating the complexities of the new legislative framework Peter Hill, Director: IT Governance Network TOPICS TO BE COVERED The practical implementation of the PPI Act
HIPAA Privacy and Security and Research
ICTS Brown Bag Seminar Successful Completion: Participants must complete an evaluation form to receive a certificate of completion Contact Hours: 1 contact hours is available to those who meet the successful
Cloud Security Introduction and Overview
Introduction and Overview Klaus Gribi Senior Security Consultant klaus.gribi@swisscom.com May 6, 2015 Agenda 2 1. Cloud Security Cloud Evolution, Service and Deployment models Overview and the Notorious
HOW TO HANDLE A WHISTLEBLOWER REPORT IN THE EU
HOW TO HANDLE A WHISTLEBLOWER REPORT IN THE EU 10 April 2014 Monica Salgado Advogada registered with the Portuguese Ordem dos Advogados Registered European Lawyer with the SRA Kirsti Laird Solicitor, (qualified
HIPAA In The Workplace. What Every Employee Should Know and Remember
HIPAA In The Workplace What Every Employee Should Know and Remember What is HIPAA? The Health Insurance Portability and Accountability Act of 1996 Portable Accountable Rules for Privacy Rules for Security
Information Management Compliance and Data protection.
Information Management Compliance and Data protection. Technology, Media & Telecommunications Information is the life blood of every business. Yet how you use that information is increasingly regulated.
Operational Risk Management Policy
Operational Risk Management Policy Operational Risk Definition A bank, including a development bank, is influenced by the developments of the external environment in which it is called to operate, as well
Agenda. Privacy & Healthcare IOM Quality Chasm. Healthcare Privacy and Security Landscape in 2012-2013
Healthcare Privacy and Security Landscape in 2012-2013 Cliff Baker, Managing Partner - Meditology Services Agenda Privacy and Security in Healthcare - It s more than just data What s making privacy and
Information Technology
Information Technology Information Technology Session Structure Board of director actions Significant and emerging IT risks Practical questions Resources Compensating Controls at the Directorate Level
SATURDAY, FEBRUARY 28, 2015 CLE 10 (Ethics) 9:30 a.m. 10:30 a.m. Moving to the Cloud - Identifying & Managing Legal, Ethical and Compliance Risks
SATURDAY, FEBRUARY 28, 2015 CLE 10 (Ethics) 9:30 a.m. 10:30 a.m. Moving to the Cloud - Identifying & Managing Legal, Ethical and Compliance Risks Moving to the Cloud - Identifying & Managing Legal, Ethical
Information Security Guideline: Cloud Computing Services. Information Security and Privacy Committee Draft version 8/1/2012
Information Security Guideline: Cloud Computing Services Information Security and Privacy Committee Draft version 8/1/2012 Table of Contents Introduction... 1 Purpose... 2 Scope... 2 Risks and Concerns
Information Resources Security Guidelines
Information Resources Security Guidelines 1. General These guidelines, under the authority of South Texas College Policy #4712- Information Resources Security, set forth the framework for a comprehensive
FTP-Stream Data Sheet
FTP-Stream Data Sheet Problem FTP-Stream solves four demanding business challenges: Global distribution of files any size. File transfer to / from China which is notoriously challenging. Document control
Library Guide: HIPAA
Library Guide: HIPAA Page 2 Table of Contents Overview...2 Course Descriptions: Privacy and Security Library: Business Practices to Protect Personal Health Information (HIPAA05)... 3 HIPAA: General Awareness
Ø Externally Hosted Computing Services Appropriate Use Guidelines Ø Matrix for Appropriate Use
Ø Externally Hosted Cputing Services Ø Matrix for Appropriate Use 3/31/2015 1 Externally Hosted Cputing Services This overview is intended to provide information for faculty, staff and students about the
Who Should Know This Policy 2 Definitions 2 Contacts 3 Procedures 3 Forms 5 Related Documents 5 Revision History 5 FAQs 5
Information Security Policy Type: Administrative Responsible Office: Office of Technology Services Initial Policy Approved: 09/30/2009 Current Revision Approved: 08/10/2015 Policy Statement and Purpose
Legal Ethics in the Information Age: Unique Data Privacy Issues Faced by Law Firms. v2.18.11, rev
Legal Ethics in the Information Age: Unique Data Privacy Issues Faced by Law Firms v2.18.11, rev 1 Presenters Joseph DeMarco, Partner DeVore & DeMarco, LLP Lauren Shy, Assistant General Counsel Fragomen,
Forthcoming EU Data Protection Law
Forthcoming EU Data Protection Law How Oracle can Help Patrick McLaughlin Security Architect & Oracle Fellow EMEA Technology Solutions 22 October 2015, Riga Copyright 2014 Oracle and/or its affiliates.
1100001 111PII0IP01 11100101011 0PCI10PHI0 0111101100 11011111. Addressing Data Governance Requirements in a Dispersed Data Environment
Executive Brief Addressing Data Governance Requirements in a Dispersed Data Environment 1100001 111PII0IP01 11100101011 0PCI10PHI0 0111101100 11011111 Lorem ipsum ganus metronique elit quesal norit parique
What Does Today s ITSM Leader Need To Know About The Cloud?
What Does Today s ITSM Leader Need To Know About The Cloud? Troy DuMoulin Vice President, Professional Services, Pink Elephant tdumoulin@pinkelephantcom 1 st Annual IT Service Management Leadership Forum
Mental Health Resources, Inc. Mental Health Resources, Inc. Corporate Compliance Plan Corporate Compliance Plan
Mental Health Resources, Inc. Mental Health Resources, Inc. Corporate Compliance Plan Corporate Compliance Plan Adopted: January 2, 2007 Revised by Board of Directors on September 4, 2007 Revised and Amended
Meeting the HIPAA Training and Business Associate Requirements Questions and Answers, with HIPAA Security Expert Mike Semel
Meeting the HIPAA Training and Business Associate Requirements Questions and Answers, with HIPAA Security Expert Mike Semel Questions Answers 1 Is a Business Associate (BA) responsible for assuming a Covered
Managing data security and privacy risk of third-party vendors
Managing data security and privacy risk of third-party vendors The use of third-party vendors for key business functions is here to stay. Routine sharing of critical information assets, including protected
Forensic Audit Building a World Class Program
Forensic Audit Building a World Class Program PAUL E. ZIKMUND DIRECTOR GLOBAL INTEGRITY AND FORENSIC AUDIT 1 2012 ACFE ANNUAL FRAUD CONFERENCE ORLANDO, FL Why the Need for Forensic Audit Program In response
GAIN CLARITY CRITICAL ISSUES. Your Data in the Cloud : Benefits & Risks GAIN CONTROL. berrydunn.com
GAIN CLARITY CRITICAL ISSUES Your Data in the Cloud : Benefits & Risks berrydunn.com AGENDA Defining Cloud Services Benefits and Risks Core Requirements Myths about Clouds Is Your Data in the Cloud Secure?
Standards of Ethical Conduct
Standards of Ethical Conduct Purpose Pursuit of the University of California mission of teaching, research and public service requires a shared commitment to the core values of the University as well as
ESI Incident Response Procedures 1
ESI Incident Response Procedures 1 Core Document Approval Date, USNH Legal Counsel: 2/12/2010 Core Document Approval Date, UNH CIO: Pending Objectives 1. Understand which policies, procedures and laws
Bossier Parish Community College
Bossier Parish Community College Department of Cyber Information Technology Welcome to the Program! Network Security & Networking Tracks Code of Conduct This marks the beginning of your journey through
Vendor Management Challenge Doing More with Less
Vendor Management Challenge Doing More with Less Megan Hertzler Assistant General Counsel Director of Data Privacy Xcel Energy Boris Segalis Partner InfoLawGroup LLP Session ID: GRC-402 Insert presenter
Compliance Program and HIPAA Training For First Tier, Downstream and Related Entities
Compliance Program and HIPAA Training For First Tier, Downstream and Related Entities 09/2011 Training Goals In this training you will gain an understanding of: Our Compliance Program elements Pertinent
7Seven Things You Need to Know About Long-Term Document Storage and Compliance
7Seven Things You Need to Know About Long-Term Document Storage and Compliance Who Is Westbrook? Westbrook Technologies, based in Branford on the Connecticut coastline, is an innovative software company
Information Protection Framework: Data Security Compliance and Today s Healthcare Industry
Information Protection Framework: Data Security Compliance and Today s Healthcare Industry Executive Summary Today s Healthcare industry is facing complex privacy and data security requirements. The movement
DSU Identity Theft Prevention Policy No. DSU 802.7.001
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 IDENTITY THEFT PREVENTION DSU Policy No. 802.7.001 SOURCE: Fair and Accurate
How To Ensure Financial Compliance
Evolving from Financial Compliance to Next Generation GRC Gary Prince Principal Solution Specialist - GRC Agenda Business Challenges Oracle s Leadership in Governance, Risk and Compliance Solution Overview
COMPUTER USE POLICY. 1.0 Purpose and Summary
COMPUTER USE POLICY 1.0 Purpose and Summary 1. This document provides guidelines for appropriate use of the wide variety of computing and network resources at Methodist University. It is not an all-inclusive
HIPAA Violations Incur Multi-Million Dollar Penalties
HIPAA Violations Incur Multi-Million Dollar Penalties Whitepaper HIPAA Violations Incur Multi-Million Dollar Penalties Have you noticed how many expensive Health Insurance Portability and Accountability
Cybersecurity for Nonprofits: How to Protect Your Organization's Data While Still Fulfilling Your Mission. June 25, 2015
Cybersecurity for Nonprofits: How to Protect Your Organization's Data While Still Fulfilling Your Mission June 25, 2015 1 Your Panelists Kenneth L. Chernof Partner, Litigation, Arnold & Porter LLP Nicholas
Sensitive Data Management: Current Trends in HIPAA and HITRUST
Sensitive Data Management: Current Trends in HIPAA and HITRUST Presented by, Cal Slemp Managing Director, New York, NY June 12, 2012 Speaker Presenter Topic Objective Cal Slemp Managing Director, New York
Balancing Security Investment Against Today's Threat Environment
Balancing Security Investment Against Today's Threat Environment Niel Pandya Data Security, Senior Manager, Oracle ASEAN The following is intended to outline our general product direction.
UNIVERSITY COMPLIANCE PLAN
UNIVERSITY COMPLIANCE PLAN Objectives of the Compliance Program The University Compliance Program provides a proactive program that ensures full compliance with all applicable policies, procedures, laws
INFORMATION TECHNOLOGY SECURITY STANDARDS
INFORMATION TECHNOLOGY SECURITY STANDARDS Version 2.0 December 2013 Table of Contents 1 OVERVIEW 3 2 SCOPE 4 3 STRUCTURE 5 4 ASSET MANAGEMENT 6 5 HUMAN RESOURCES SECURITY 7 6 PHYSICAL AND ENVIRONMENTAL
Cloud Computing: Contracting and Compliance Issues for In-House Counsel
International In-house Counsel Journal Vol. 6, No. 23, Spring 2013, 1 Cloud Computing: Contracting and Compliance Issues for In-House Counsel SHAHAB AHMED Director Legal and Corporate Affairs, Microsoft,
Establishing An Effective Corporate Compliance Program Joan Feldman, Esq. Vincenzo Carannante, Esq. William Roberts, Esq.
Establishing An Effective Corporate Compliance Program Joan Feldman, Esq. Vincenzo Carannante, Esq. William Roberts, Esq. November 11, 2014 Shipman & Goodwin LLP 2014. All rights reserved. HARTFORD STAMFORD
White Paper: The Seven Elements of an Effective Compliance and Ethics Program
White Paper: The Seven Elements of an Effective Compliance and Ethics Program Executive Summary Recently, the United States Sentencing Commission voted to modify the Federal Sentencing Guidelines, including
Privacy and Data Breach Issues
15-013 Privacy and Data Breach Issues Konstantin Dino Tsibouris Founding Principal Tsibouris & Associates Columbus, Ohio Kirk Herath Associate General Counsel Nationwide Insurance Columbus, Ohio Table
HIPAA/HITECH Privacy and Security for Long Term Care. Association of Jewish Aging Services 1
HIPAA/HITECH Privacy and Security for Long Term Care 1 John DiMaggio Chief Executive Officer, Blue Orange Compliance Cliff Mull Partner, Benesch, Healthcare Practice Group About the Presenters John DiMaggio,
AUDIT COMMITTEE BEST PRACTICES CHECKLIST
AUDIT COMMITTEE BEST PRACTICES CHECKLIST General 1. Members have the appropriate predefined qualifications to meet the objectives of the audit committee s charter, including appropriate financial literacy.
HIPAA/HITECH: Conditional Access Management for Business Performance. Mark Seward, Director Security and Compliance Solutions Marketing
HIPAA/HITECH: Conditional Access Management for Business Performance Mark Seward, Director Security and Compliance Solutions Marketing Agenda HIPAA compliance problems (a review for most) EHR access issues
Identity Management: Securing Information in the HIPAA Environment
Identity Management: Securing Information in the HIPAA Environment Mark Dixon Chief Identity Officer North American Software Line of Business Sun Microsystems 1 Agenda Challenges we Face Identity and Access
How To Use A College Computer System Safely
Claremont Graduate University and The Claremont Colleges Policy Regarding Appropriate Use of Campus Computing and Network Resources An overall guiding mission of The Claremont Colleges is education in
INFORMATION TECHNOLOGY DATA MANAGEMENT PROCEDURES AND GOVERNANCE STRUCTURE BALL STATE UNIVERSITY OFFICE OF INFORMATION SECURITY SERVICES
INFORMATION TECHNOLOGY DATA MANAGEMENT PROCEDURES AND GOVERNANCE STRUCTURE BALL STATE UNIVERSITY OFFICE OF INFORMATION SECURITY SERVICES 1. INTRODUCTION If you are responsible for maintaining or using
HIPAA TRAINING. A training course for Shiawassee County Community Mental Health Authority Employees
HIPAA TRAINING A training course for Shiawassee County Community Mental Health Authority Employees WHAT IS HIPAA? HIPAA is an acronym that stands for Health Insurance Portability and Accountability Act.
What s New in Access, Privacy and Health Care. Brian Beamish Commissioner. Ontario Connections May 21, 2015
What s New in Access, Privacy and Health Care Brian Beamish Commissioner Ontario Connections May 21, 2015 The Three Acts The IPC ensures compliance with: o Freedom of Information and Protection of Privacy
UNIVERSITY OF CALIFORNIA, MERCED Red Flag and Security Incident Reporting Policy
UNIVERSITY OF CALIFORNIA, MERCED Red Flag and Security Incident Reporting Policy RESPONSIBLE OFFICIAL : Executive Vice Chancellor/Provost RESPONSIBLE OFFICIAL : Business & Financial Services EFFECTIVE
Institutional Data Governance Policy
Institutional Data Governance Policy Policy Statement Institutional Data is a strategic asset of the University. As such, it is important that it be managed according to sound data governance procedures.