I’ve been noticing lately more and more organizations sanctioning their employees for not following information security policies. I first blogged about it recently on September 24 about a hospital actively enforcing sanctions for HIPAA violations, then again on October 10 about another hospital sanctioning employees for noncompliance, then again on October 11, and then again just yesterday.
Sanctions For Ohio Breach: Lost Vacation Time, Terminations, and a “Resignation”
October 14th, 2007The Ohio Department of Administrative Services (DAS) has determined that the appropriate sanction for inadequate security practices by the Ohio Department of Administrative Services’ Administrative Knowledge System (OAKS) ERP project system team leader, that resulted in the theft of an un-encrypted backup tape containing the personally identifiable information (PII) of 1.3 million individuals, is the loss of 40 hours of vacation time.
HIPAA, The Insider Threat & Prison Time
October 11th, 2007It seems there are more and more stories related to patient privacy and HIPAA popping up lately. Today another story caught my eye related to them.
Another Hospital Suspends Staff For Violating HIPAA Requirements
October 10th, 2007A couple of weeks ago I blogged about the Ivinson Memorial Hospital applying sanctions to their staff for violating HIPAA requirements.
They have set a good example…another hospital has also applied sanctions…suspending 27 of their staff members for violating HIPAA requirements.
Iowa Universities Provide Examples of Good and Bad Information Security and Privacy
October 10th, 2007In the past week the two largest universities in Iowa provided examples of both great and poor security practices. Let’s see…how about the bad example first?
New Nevada Law Explicitly Requires Organizations to Encrypt PII Sent Through Networks
October 9th, 2007To date there have been several laws that direct organizations in certain industries to consider using encryption as one way to protect data based upon the organization’s considered risks, and laws that make encryption a factor in decisions regarding breach notifications, but until now no laws that I’m aware of explicitly required personally identifiable information (PII) to be encrypted. The state of Nevada has now changed that!
Increase Business Productivity AND Reduce Carbon Dioxide Emissions
October 8th, 2007While participating in a discussion in the Security Catalyst community I posted a message about how much more productive time I have now that I work from my home office as opposed to commuting in to an office building each day. After I finished posting I started thinking about how much more productive most businesses could be if they would establish significant portions of their workforce to work from home.
Something You Should Know: FTC Is Aggressively Going After Companies With Poor Security
October 7th, 2007Of all the U.S. government regulatory oversight agencies, the Federal Trade Commission (FTC) is the most active and aggressive in looking for and applying penalties to organizations that not only are in noncompliance with laws and regulations, but also those who are not in compliance with their own information security and privacy promises; in other words, those that are practicing “unfair and deceptive trade practices.”
Why Would You Trust Microsoft To Store Your Sensitive Health Information?
October 4th, 2007Today Microsoft launched their new web portal, HealthVault to store, for free, “medical histories, immunization and other records from doctors’ offices and hospital visits, including data from devices like heart monitors. It is also tied to a health information search engine the software maker launched last month.”
