Cybersecurity and the Importance of Data Privacy

Cybersecurity — especially data privacy — is one of the biggest problems facing businesses today. These security problems are compounded because every segment of every industry is affected differently, and each is subject to the risk factors peculiar to that segment. Grouping similar data together based on chosen parameters allows businesses to assess the privacy needs of each data segment they are holding. For example, the protections for public data don’t have to be as stringent as the protections for private data.

Protecting the privacy of the data with which they are entrusted is a universal business goal. The best way to get started is to answer the following questions:

• What types of data does your business have (e.g., credit card information, health information, criminal history, biometrics)?
• Which departments have access to that data?
• Who are your data service providers and what are their credentials?
• Which personnel can access the data?
• What steps has your company taken to protect the data (e.g., encryption, back-up, internal controls)?

Federal and International Regulations

The United States has no federal law protecting data privacy. A number of states, however, are responding: at least 31 states have already established laws regulating the secure destruction or disposal of personal information. At least 12 states — Arkansas, California, Connecticut, Florida, Indiana, Maryland, Massachusetts, Nevada, Oregon, Rhode Island, Texas and Utah — have imposed broader data security requirements. Other states, including New York, are considering legislation.

California is a pioneer on the data privacy front. The California Consumer Privacy Act of 2018, which goes into effect on January 1, 2020, is similar to the General Data Protection Regulation (GDPR). Companies that do business in California will be affected by this legislation.

At least some of the activity at the state level is in response to the European Union’s enactment of the GDPR. Any company doing business in a nation that has adopted the GDPR must comply with its consumer protections regarding data privacy. The GDPR covers many types of data, including the following:

• Personally identifiable data (e.g., names, addresses, date of births, Social Security numbers)
• Web-based data (e.g., user location, IP address, cookies, and RFID tags)
• Health (HIPAA) and genetic data
• Biometric data
• Racial or ethnic data

The bottom line is that U.S. businesses operating in multiple jurisdictions must consider these categories, as well as any other categories pertinent to their industry, as they segment the data they are holding. Understanding the data they hold is essential to instituting the right level of privacy safeguards.

Three Steps to Securing Your Data

Understanding your data is the first step to securing data. The second step requires knowing the relevant laws and regulations your business must comply with.

The third step is to stay alert for any indications of a breach. The sad truth is that many data breaches go on for quite a while before they are discovered. The time lapse between hack and discovery allows hackers to continue accessing vulnerable data. That makes constant monitoring an important aspect of any data security program. Watching for the signs of a breach — such as an unanticipated spike in bandwidth usage — can indicate a problem.

By following these three steps, businesses can be sure they are doing their best to protect the data they and their data service providers hold.

BASICs HIPAA Solution

BASIC’s HIPAA Service saves employers time and helps them better understand HIPAA requirements and activities necessary to maintain compliance.

BASIC’s HIPAA Service Includes:

• BASIC’s web based compliance training for your Privacy & Security Officer(s) and others who come in contact with PHI / IHI,  provides you with four vital HIPAA eLearning courses.
• The attendees will be given an exam at the end of each course to test their knowledge and ensure their understanding of HIPAA compliance.
• Your organization will also receive BASIC’s electronic compliance manual which includes essential HIPAA policies, procedures, employer postings and forms needed to safeguard compliance.

Click here to request a proposal on BASIC’s HIPAA service today!

Copyright 2019