Sending Cleartext IM and Email Is *NOT* Secure Even If Your Doc Says It Is…Part 1

November 19th, 2007

I got some interesting comments and questions, and lots of good direct feedback, about my blog post on sending cleartext patient information last week, “HIPAA: Beware Doctors Who Claim They Don’t Have To Follow Safeguard and Privacy Requirements” so I wanted to take this opportunity to discuss the topic a little more.

Read the rest of this entry »

Personnel Privacy, New I-9 Forms, Removal of SSN Requirements and IT Involvement

November 18th, 2007

Early this year I did a data flow analysis for I-9 compliance, and I blogged a few months ago about I-9 related issues in “New Tennessee Law Prohibits Using Federal Individual Taxpayer ID as Proof of Immigration Status.”
I-9 compliance issues impact many areas of an organization. However, within most organizations many areas, such as IT and information security, are not aware of the I-9 compliance issues and unknowingly put the company at noncompliance jeopardy. Compliance with any law or regulation that involves personally identifiable information (PII) usually require the involvement of legal, IT and information security areas.

Read the rest of this entry »

Personnel Privacy, New I-9 Forms, Removal of SSN Requirements and IT Involvement

November 18th, 2007

Early this year I did a data flow analysis for I-9 compliance, and I blogged a few months ago about I-9 related issues in “New Tennessee Law Prohibits Using Federal Individual Taxpayer ID as Proof of Immigration Status.”
I-9 compliance issues impact many areas of an organization. However, within most organizations many areas, such as IT and information security, are not aware of the I-9 compliance issues and unknowingly put the company at noncompliance jeopardy. Compliance with any law or regulation that involves personally identifiable information (PII) usually require the involvement of legal, IT and information security areas.

Read the rest of this entry »

Bill Gates Is Creating Road Hazards Across America

November 17th, 2007

Last night on the drive into town to my 8-year-old son’s basketball practice we were on a heavily trafficked city interstate around 5:15pm…rush hour and happy hour drivers were everywhere with bumber-to-bumper vehicles across 4 lanes. I was sitting in the passenger side, and I saw a large truck in front of us. As we pulled alongside I saw “Microsoft” boldly painted on the truck cargo area.

Read the rest of this entry »

A Lesson In IT Backup Media Management From Francis Ford Coppola

November 16th, 2007

As I was reading this week’s issue of Time magazine I found a backup lesson given by Francis Ford Coppola!

Read the rest of this entry »

HIPAA: Beware Doctors Who Claim They Don’t Have To Follow Safeguard and Privacy Requirements

November 15th, 2007

My good friend Alec recently made me aware of a very interesting blog post made by a physician (thanks Alec!) that is frankly quite troubling.

Read the rest of this entry »

U.S. Federal Teleworking Report Reminds Us that Teleworking Saves Time and Resources, But Must Be Done With Safeguards In Place

November 14th, 2007

On November 6 there was a an interesting hearing held by the U.S. Subcommittee on Federal Workforce, Postal Service, and the District of Columbia about teleworking in the federal agencies.
Considering large numbers of privacy breaches occurring within government agences involving mobile computing devices and storage devices, this caught my eye.

Read the rest of this entry »

The Deputy Director of National Intelligence Does Not Understand Key Concepts Of Privacy

November 12th, 2007

I found a report yesterday, “Intelligence deputy to America: Rethink privacy” quite interesting. The impact on privacy…the actual definition, not the definition Donald Kerr, the principal deputy director of national intelligence, thinks it should be…would not only be a huge step backward for the country, but it would also increase the threats to personally identifiable information (PII) exponentially.

Read the rest of this entry »

French Supreme Court Decision Points Out Importance Of Using Monitoring Notices Wherever In The World You Have Personnel

November 11th, 2007

I just read about a French Supreme Court decision made on October 10 (you can see a Google English rough translation of it here) that is significant to organizations who have employees in France, or anywhere worldwide for that matter, and the organization’s employee monitoring practices.

Read the rest of this entry »

FTC Continues Active Compliance Enforcement: Applies $7.7 Million In Fines To 6 Do-Not-Call Violators

November 10th, 2007

This week the FTC once again demonstrated that they aggressively enforce compliance with those regulations for which they have responsibility.
In their press release, “FTC Announces Law Enforcement Crackdown on Do Not Call Violators” they detail their recent actions against six organizations for non-compliance with the Do Not Call (DNC) registry requirements. The involved settlements totaled close to $7.7 million in civil penalties. In addition to the following, actions against Global Mortgage Funding are pending.
Here is an overview of the non-compliance activities and associated fines/penalties:

Read the rest of this entry »