How secure is your information?
Information security should on the forefront of everyone’s mind in this fast-paced and constantly changing age of technology. Are you doing enough to protect critical information that customers, employees, patients, students, or any other entity entrusts into your care? In today’s world, there are countless voices offering guidance on how to best secure critical information. Below are four security compliance standards that are meant to protect us:
HIPAA – Health Information Privacy and Accountability Act (HIPAA) Privacy Rule provides federal protections for personal health information held by covered entities and gives patients an array of rights with respect to that information. The HIPAA Security Rule specifies a series of administrative, physical, and technical safeguards for covered entities to use to assure the confidentiality, integrity, and availability of electronic protected health information.
GLB – Gramm-Leach-Bliley Act requires financial institutions – companies that offer consumers financial products or services to explain their information-sharing practices to their customers and to safeguard sensitive data.
Red Flag Rule requires “financial institutions” and “creditors” that hold consumer accounts designed to permit multiple payments or transactions — or any other account for which there is a reasonably foreseeable risk of identity theft — to develop and implement an Identity Theft Prevention Program for new and existing accounts.
PCI DSS – Payment Card Industry – Data Security Standards provides a baseline of technical and operational requirements designed to protect cardholder data. PCI DSS applies to all entities involved in payment card processing – including merchants, processors, acquirers, issuers, and service providers, as well as all other entities that store, process or transmit cardholder data.
Despite these standards, most organizations only do a fraction of what they should to properly safe-guard the sensitive information that others have entrusted to their care. While running the core functions of a business, it can be easy to forget how important information security is for the good of the company. These areas of compliance are often seen as additional hurdles that are expensive and time consuming. We often hear excuses such as:
“Our budgets don’t allow for the items that are truly needed to comply”
“Our business is too small. A thief/hacker wouldn’t waste their time on us; they would focus their time and energy on a larger company with a bigger payout”
While there may be some truth to those comments, we see examples every day that contradict them. Information security risks are a reality for all of us whether we are large or small, simple or complex. Information security risks are not just the responsibility of the Information Technology (IT) department. Information security is a responsibility of management and every employee. A good Information security program includes management involvement and oversight, as well as a good employee Information security education program. It doesn’t just cover the IT systems since information can be electronic or physical. This is an area we often lose sight of and expect that IT will handle Information Security.
Just last week we saw examples of both extremes. The first involved a large, publicly traded credit card processor company that had a technology breech potentially putting over 10 million card holders’ information in jeopardy. The second example involved a small regional hospital who had a nurse’s aide taking patient information and using it to apply for credit. The aide is believed to have accessed to up to 200 patients’ information. This incident was not the work of a technology hacker, just a normal employee supposedly doing their job.
While many of the regulatory and guidance areas listed above allow for civil, criminal, or financial penalties for negligence in protecting information, there is likely a greater potential loss to your organization associated with the negative publicity that comes with a breech like those described above. What would it cost your organization to have a negative news story about the harm caused to your constituents due to your negligence? A good reputation is hard to achieve. A negative reputation could be impossible to recover from. Are you being responsible with the information that has been entrusted to your organization?
For more information on Information Security Compliance at your organization, please contact our Director of Technology Consulting, Jason Miller at jmiller@ddaftech.com or (859) 425-7626.