Archive for March, 2008

This Is Business Continuity Awareness Week!

Sunday, March 30th, 2008

Business Continuity Awareness Week (BCAW) is March 31st – April 4; at least it is in the UK and throughout Europe.
Business Continuity Awareness Week in Australia is the week from Monday, April 28th – Friday, May 2nd.


Employee Fined $13,096 for Drunken Hacking

Friday, March 28th, 2008

Dan Swanson sent me this news story (thanks Dan!), which gave me a chuckle…
Employee Fined $13,000 for Drunken Hacking
A rather interesting part of his judgment:


Who Had The Brilliant Idea To Outsource U.S. Passports?

Thursday, March 27th, 2008

Okay, after the recent passport files snooping debacle I found today’s news story, “Outsourcing passports ‘profound liability’” very ironic and concerning.
Not only for the reported huge waste of taxpayers’ dollars, but also for the security risks…


The Benefits of a Privacy Ombudsman

Wednesday, March 26th, 2008

The folks from Cutter just notified me that an excerpt from a recent article I wrote, “Learning from a Privacy Ombudsman: A Case Study to Establish a Healthcare Services Ombudsman,” will soon be featured in the “Quote of the Day” section of the Cutter Web site.
Here’s the excerpt…


Yet Another Stolen Laptop With Clear Text Patient PII

Tuesday, March 25th, 2008

Yet another in a long procession of laptop thefs, “Stolen laptop contains personal info of 2,500 patients“.
Here are the first few paragraphs…


Passport Breach: Poor Security Practices Lead To Privacy Breaches

Sunday, March 23rd, 2008

The breach of the presidential candidates’ passport files were widely reported over the past few days, such as here and here, not to mention the many postings referencing it as “passport-gate” throughout the blogosphere and the political implications. However, based upon what I’ve been reading it looks more like the result of a poor, inadequate and vulnerable information security program.
There are many information security and privacy issues involved with this incident. It would make a great case study to use at a joint meeting with your information security, privacy and compliance folks. Some of the questions to include in your discussion could include…


The Emperors’ New Clothes Lack Privacy

Friday, March 21st, 2008

Over the past few weeks I’ve talked to several privacy officers and information security officers about how things are going with their initiatives, funding, and so on. Many from the financial industry, but otherwise a wide range of businesses from small to large. There has been a common theme during these discussions…


Useful Data Protection (Privacy) Law Sites

Wednesday, March 19th, 2008

This morning I took a little time to update my long listing of world-wide data protection (privacy) laws.
Here are some of them you may find helpful:


HIPAA *HAS* Impacted Healthcare Providers…Despite Lack Of Enforcement

Monday, March 17th, 2008

I have written many times about how the U.S Department of Health and Human Services (HHS) has severely weakened the planned privacy and security goals of the Health Insurance Portability and Accountability Act (HIPAA) to require healthcare covered entities (CEs) to implement strong safeguards for the protected health information (PHI) with which they’ve been entrusted. And I still believe that.
However, after reading a another report today I realized something…


Spitzer Downfall Spotlights Surveillance In Mainstream

Saturday, March 15th, 2008

In case you haven’t heard, now ex-New York-governor Elliot Spitzer recently was found to be the frequent customer of a “high end call girl service” for the past couple of years.
How was he caught? Through an electronic path he left making payments for his philandering flings.