As reported by the American Bar Association and PHIprivacy.net, lawyers, accountants, health care providers and others soon may get some clarity as to whether the "red flag" rules apply to them. The United States Senate voted unanimously to pass the Red Flag Program Clarification Act of 2010. Under the Act, according to statements from Sen.
Information Management
Doctors’ Orders Through Your Cell Phone?
“Washington Post” Voxiva “mobile phone”…
Continue Reading Doctors’ Orders Through Your Cell Phone?
Employees Protected from Retaliation When Raising Concerns about HIPAA and Data Security
In March 2010, we reported on a decision by the U.S. District Court for the District of New Jersey that allowed an employee’s retaliation claim to proceed to trial under the New Jersey Conscientious Employee Protection Act (“CEPA”) on the ground that he was engaged in protected whistle blowing activity – voicing concerns regarding his employer’s …
Federal Agencies Tighten Data Security Screws on Federal Contractors
Federal contractors are subject to numerous requirements under federal law and, as we have previously highlighted here, need to keep pace with changes in law and regulation.
Under the Federal Information Security Management Act of 2002 (FISMA) each federal agency is required to develop, document, and implement an agency-wide program to provide information security …
Data Privacy and Security Primer for Law Firms
A UK law firm may find itself subject to significant penalties following reports of a data breach affecting thousands of people. The recent 2010 ABA Annual Meeting in San Francisco devoted two sessions to the topic, specifically dealing with “cloud computing,” and the risks and ethical issues it raises for law firms. As data privacy and security risks…
The Fundamentals of a Risk Assessment
The most frequent question we hear from clients who want to develop or tighten their data privacy and security policies and procedures: Where do we start?
In most cases, the first step for the group charged with this task is to understand the organization’s "information risk." This means, in short, examining what information the company has…
Connecticut Insurance Commissioner Announces Data Breach Notification Mandate
By Joseph J. Lazzarotti on
On August 18, 2010, the Connecticut Insurance Commissioner issued Bulletin IC-25 which mandates that entities within its jurisdiction notify the Department of Insurance of any "information security incident." This post provides a brief summary of this new requirement.
Who must provide the notice?
The Bulletin applies to all licensees and registrants of the Department. This generally means all entities…
California Bill Would Strengthen Existing Breach Notification Law
By Joseph J. Lazzarotti on
Update – On September 29, 2010, Governor Arnold Schwarzenegger for the third time vetoed S.B. 1166.
California led the way in 2002 when it enacted the nation’s first data breach notification law. Last week, the State’s lawmakers sent Governor Arnold Schwarzenegger S.B. 1166 (pdf), which would mandate that data breach notification communications include more detailed…
Federal Law Introduced to Require Credit Monitoring Following Data Breach
By Joseph J. Lazzarotti on
On August 5, 2010, U.S. Senators Mark Pryor (D-AR) and John D. (Jay) Rockefeller IV (D-WV) introduced legislation to require businesses and nonprofit organizations that store consumers’ personal information to put in place strong security features to safeguard sensitive data, alert consumers when this data has been breached, and provide affected individuals with the tools…
Rite Aid Agrees to $1 Million Payment to HHS Concerning Potential HIPAA Privacy Violations
Rite Aid Corporation and its affiliates have agreed to pay $1 million to settle potential violations of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule, the U.S. Department of Health and Human Services (HHS) announced today. At the same time, Rite Aid signed a consent order with the Federal Trade Commission (FTC)…