Archive for July, 2009
Friday, July 31st, 2009
This week one of my tweeps asked me the following: “What’s your interpretation of encryption obligations for PHI data-at-rest under HITECH? Many parties are sweating this now.” Great question!
(more…)
Tags:awareness and training, breach law, breach notification, breach response, HIPAA, HITECH Act, Information Security, IT compliance, IT training, patient privacy, personally identifiable information, PII, policies and procedures, privacy training, security training
Posted in Laws & Regulations, Privacy and Compliance | No Comments »
Wednesday, July 29th, 2009
Continuing along the discussion of the HITECH Act this week, I want to consider a couple of questions I recently discussed with a CISO at a healthcare insurer about when breach notification is necessary…
(more…)
Posted in Uncategorized | No Comments »
Monday, July 27th, 2009
This week I want to take a closer look at some of the issues and requirements within the HITECH Act, which dramatically expands the reach and requirements under the U.S. Health Insurance Portability and Accountability Act (HIPAA)…
(more…)
Tags:awareness and training, breach law, breach response, HIPAA, HITECH Act, Information Security, IT compliance, IT training, personally identifiable information, PII, policies and procedures, privacy training, security training
Posted in Laws & Regulations, Privacy and Compliance | No Comments »
Wednesday, July 22nd, 2009
On July 9, 2009 the Missouri governor signed House Bill No. 62 into law, and it included section 407.1500, which is the requirement for giving privacy breach notice.
Since I’m focusing this week on encryption laws, I want to take a moment and point out the horrible way in which encryption is defined within this new Missouri law..
(more…)
Tags:awareness and training, breach law, breach response, enryption, HIPAA, Information Security, IT compliance, IT training, Missouri, personally identifiable information, PII, policies and procedures, privacy training, security training
Posted in Laws & Regulations, Privacy and Compliance | 1 Comment »
Monday, July 20th, 2009
This week I want to take a look at encryption laws. Only a few short years ago no law or regulation really had explicit encryption requirements. HIPAA, passed in 1996 with effective compliance deadline requirements in 2003 (Privacy Rule) and 2005 (Security Rule) included withint the Security Rule that encryption was “addressable” based upon the results of risk assessment.
However, encryption became a more hotly debated topic with the more recent Massachusetts and Nevada laws that explicitly require organizations to encrypt personally identifiable information (PII). Now the question of whether or not the Massachusetts law will indeed be enforced upon the current compliance date of January 1, 2010 is once more in the news…
(more…)
Tags:awareness and training, breach law, breach response, enryption, HIPAA, Information Security, IT compliance, IT training, Morrissey, personally identifiable information, PII, policies and procedures, privacy training, security training
Posted in Information Security, Laws & Regulations, Privacy and Compliance | No Comments »
Thursday, July 16th, 2009
There is much debate about what specific types of items should be considered as personally identifiable information (PII). A common topic of debate is; if information can be found publicly does that mean it is not PII?
(more…)
Tags:awareness and training, HIPAA, HITECH Act, Information Security, IT compliance, IT training, personally identifiable information, PII, policies and procedures, privacy training, security training
Posted in Laws & Regulations, Privacy and Compliance | No Comments »
Wednesday, July 15th, 2009
I want to continue my look at the concept of personally identifiable information (PII), and what types of items, in particular, are considered as such…
(more…)
Tags:awareness and training, de-identification, HIPAA, Information Security, IT compliance, IT training, personally identifiable information, PII, policies and procedures, privacy training, security training
Posted in Information Security, Privacy and Compliance | No Comments »
Monday, July 13th, 2009
This week I want to look at the concept of personally identifiable information (PII), and what types of items, in particular, are considered as such…
(more…)
Tags:awareness and training, HIPAA, Information Security, IT compliance, IT training, personally identifiable information, PII, policies and procedures, privacy training, security training
Posted in Laws & Regulations, Privacy and Compliance | No Comments »
Friday, July 10th, 2009
I’ve had some very interesting discussions about the CMU SSN study throughout the week, and, before moving on to other topics next week, I wanted to wrap up the week and discussion with some final thoughts on the CMU SSN topic..
(more…)
Tags:awareness and training, Carnegie Mellon, CMU, Information Security, IT compliance, IT training, policies and procedures, privacy training, risk management, security training, social engineering, social security number, SSN
Posted in Information Security, Privacy and Compliance | No Comments »
Wednesday, July 8th, 2009
Following the release of the CMU SNN report on Monday, I’ve had some very interesting discussions with privacy and information security folks, and I’ve been pretty amazed at some of the reactions to the study.
I also posted about this to one of the GRC mailing lists I participate in, and I got some questions asking me for my thoughts about some specific issues. I wanted to share those thoughts here as well…
(more…)
Tags:awareness and training, Carnegie Mellon, CMU, Information Security, IT compliance, IT training, policies and procedures, privacy training, risk management, security training, social engineering, social security number, SSN
Posted in Information Security, Privacy and Compliance | No Comments »
