Posts Tagged ‘risk’

Why You Should Use a Right to Audit Clause

Thursday, January 24th, 2013

A Tale of Two Viewpoints

When I was responsible for information security and privacy at a large financial and healthcare organization throughout the 1990’s I had literally hundreds of business partner organizations to which we outsourced various types of activities that required some type of access to our client and customer information. Add to that several hundred agents and, scarier still because they were not exclusively selling our products, brokers, and you can probably imagine the angst I felt when thinking about the ways in which all those other organizations were putting our information at risk.  The contracts with them had a very brief requirement to “provide appropriate security controls” for the information, but that did not alleviate my worries. But, since at that time there were no data protection regulations in effect, the lawyers said this simple clause was enough.  And then one of the outsourced entities had an incident resulting from lack of controls which allowed a hacker to enter our network.  (more…)

You Need to Actually Do What Your Policies Say!

Friday, December 21st, 2012

This week I spoke with a small (~25 employees) organization (a business associate providing services to healthcare providers) that contacted me looking for help; they had purchased a whiz-bang “HIPAA compliance GRC” solution that included with everything else information security policies, but they couldn’t make any sense of the policies they were given or how they related to the rest of the expensive GRC tool.  Grrr!! There are (more…)

Work Area Reviews are Necessary for Effective Risk Management

Monday, December 17th, 2012

There have been a lot online posts and talk lately about risk management and the “proper” or “acceptable” way to do risk assessments. It seems that the overwhelming talk, though, is only about the right and wrong way to do a risk assessment whenever considering a risk management program. Certainly, using the best risk assessment method to fit your business environment is very important; one size, and one method, does not fit all! However, there are so many more activities necessary within a risk management program than just occasionally doing a risk assessment.  Regulatory agencies are (more…)

Are You Faking It?

Thursday, November 29th, 2012

Are you faking it online? Or faking it at work?  While faking it certainly has its benefits in both places, I want to touch upon a couple of concerns I have with using fake identities. (more…)

Implementing a Data De-Identification Framework

Wednesday, November 21st, 2012

Growing numbers of organizations are trying to figure out the benefits of anonymizing, or as HIPAA (the only regulation that provides specific legal requirements for such actions) puts it “de-identifying,” personal information. Healthcare organizations see benefits for improving healthcare. Their business associates (BAs) see benefits in the ways in which they can minimize the controls around such data. Of course marketing organizations salivate at the prospects of doing advanced analysis with such data to discover new trends and marketing possibilities.  The government wants to use it for investigations. Historians want to use it for, yes, marking historical events. And the list (more…)

ISMS Certification Does Not Equal Regulatory Compliance

Wednesday, October 31st, 2012

Last week I got the following question:

“By becoming ISO 27001 certified does that automatically mean we comply with HIPAA and HITECH requirements?  Are there any requirements of HIPAA/HITECH that are not required to meet ISO 27001 standards?”

This is not the first time I’ve gotten this question, and others similar. As new technology businesses, cloud services and other businesses are popping up to provide services to large regulated organizations, start-ups are increasingly looking for a way to differentiate themselves from their competitors, and also prove that they have not only effective security controls in place, but that they also (more…)

Repost From Social Media to Lose Customers and Friends Fast

Monday, October 22nd, 2012

Last week one of my Facebook friends started a “friends only” discussion on his wall. It was a very interesting discussion, and one of his friends took the discussion, pretty much verbatim, and posted within a “public” (as in meant for the world to see) popular blog site. So the information on the Facebook page, where around 250 – 300 people could see the posts were now in a location where the bazillion (possibly a bit fewer) blog readers could see all the posts and the full names of those who made them. This is not the first time a situation like this has occurred.  A lot of the information posted on people’s social media pages are really tempting to take and use as examples, or for business activities such as for marketing and promotions. However, doing so could get you into some personal and/or legal hot water.  As organizations and individuals consider taking information they find on social media sites, they need to consider the reasons why doing so may not be a good idea after all.

Reason #1: It will (more…)

Don’t Let School Break Be A Privacy Break-In!

Friday, June 3rd, 2011

A couple of days ago I published my monthly Privacy Professor Tips message, “Summer Break-in.”  I provide these tips free to anyone who wants to sign up for it on my web site and fills out one of the boxes that says, (more…)

Random Thoughts: The Relationship Between Risk And Awareness

Thursday, January 8th, 2009

The following concept, taken from the January 12, 2009 issue of Time (page 56), can also be applied to information security incidents and privacy breaches…

(more…)

Random Thoughts: The Relationship Between Risk And Awareness

Thursday, January 8th, 2009

The following concept, taken from the January 12, 2009 issue of Time (page 56), can also be applied to information security incidents and privacy breaches…

(more…)