by Felicien | Nov 18, 2019 | Education
Learn from Marriott’s Example: Notification Responsibilities After a Data Breach
Most states, the District of Columbia, the Virgin Islands and Puerto Rico have passed legislation regarding notification of security breaches. Know the laws in your state.
To answer this question, let’s start with the example experienced by Marriot International recently when a breach exposed the social security numbers of the hotel chain’s associates. Then, we’ll look at the federal and state requirements for notifying those impacted by a breach that involved their data.
How Did Marriott International Employees Fall Victim to a Data Breach?
Marriott International told some of its employees that their social security numbers (SSNs) had been exposed to an unknown person. The risk came from a vendor that handled documents for the hotel chain.
On September 4, 2019, Marriott found out that someone access information recorded on those documents, which included subpoenas and court documents. The notification, which came two months after the incident, merely stated that someone may have accessed the records, which is all hotel representatives claim to know. The potential breach impacts over 1,500 Marriott employees. On October 30, the hotel started sending notifications via regular mail for anyone it hadn’t been able to find.
Those impacted will receive free credit monitoring as well as identity theft protection for one year at the company’s expense. Notification and credit monitoring services are part of recent data breach laws, but one must wonder what took Marriot so long to notify the victims.
Why Did Marriott Have a Difficult Time Finding Victims?
Marriott received a list of those impacted, but most had no address. This may be the most significant factor in the delay. And, it’s not an unusual one. Company records breached by hackers may be incomplete in the best of circumstances, and this information was sitting in several external systems.
The unnamed firm said all Marriott employee data was deleted from its system. One of the problems in cases like this is storing data in multiple systems, which increases the risk of theft and data breaches. Marriott no longer partners with the vendor.
What Are Your Company’s Responsibilities in Case of a Data Breach?
The FTC recommends following these steps, some of which are legally required.
Secure your Operations
Move quickly to take whatever steps are needed to secure your systems. Otherwise, your data breach can result in a series of breaches. Mobilize or form a breach response team to shore up your network against further loss.
Fix Vulnerabilities
As part of the fix, you need to anticipate questions that clients, associates and the authorities may have. Put together clear questions and answers to post on your website. Direct communication may ease frustration and concerns, especially if it takes some time to identify those impacted, as in the Marriott cases.
Work with forensic experts to track to determine what records were at risk.
Notification
Most states, the District of Columbia, the Virgin Islands and Puerto Rico have passed legislation regarding notification of security breaches. You must notify the affected parties when personal information is involved. Check the laws in your state as well as the federal laws and consult with your legal team regarding your responsibilities.
by Felicien | Nov 15, 2019 | Education
HIPAA is an everyday stressor in the healthcare industry. A computer-based recordkeeping system can help keep records secure and HIPAA compliant.
For many in the health care industry, compliance with the Health Insurance Portability and Accountability Act (HIPAA) is an everyday stressor that dictates the actions and availability of information. However, HIPAA is necessary to protect the patients’ information and medical records. A violation of HIPAA could lead to lawsuits and large fees, which could cause a business or practice to close their doors.
The Challenge of Human Error
Unfortunately, even the perfect system is prone to human error, especially if you do not have integrated checks and balances that are part of a computer document management software.
Many facilities that are larger in size have already integrated their records into a computer-based record-keeping system. This type of software is especially helpful for the large volume of records that they keep on a daily basis. However, smaller healthcare facilities may want to consider a customized computer-based record-keeping system to stay HIPAA compliant.
Typically, most HIPAA violations happen without employees’ knowledge, or they are due to simple inexperience. Some of the most common HIPAA violations include:
Accessing records for any reason other than to aid in treatment or payment
Not using a secure encryption method for protecting health records
Removing patient information from the facility, either physically or on an unauthorized device
Sharing patient information via a personal email
No control or lack of control of who accesses patient health information
Not removing access of former employees
Digital Solution for Record Keeping
Physical paper documents have a higher chance of being compromised because their very nature requires that you physically secure them. Within HIPAA, health facilities not only have to worry about who has access to patient information but for what reason.
While some electronic solutions can help healthcare facilities step away from paper options, such as a common or shared network drives, these do not provide the security needed to remain HIPAA compliant. HIPAA requires that digital solutions for handling patients’ personal information have almost cutting-edge security tools. Due to the private nature of patients’ information within the system, health facilities’ data is considered a prime target for hackers looking for targets with blackmail or ransomware.
Benefits of Moving to Digital Record-Keeping
Even for small health care facilities, there is a digital document management system that could fit the needs of the business while still being HIPAA compliant. Some of the benefits of digital record keeping are:
Tracking for Audit Purposes – A digital document management system can record everything that happens to a file. The record could include which user has accessed the file, when the file was accessed, if anything has changed since the last time it was accessed, and historical copies of the file.
Control Over File Permissions – The records system administrators can control who has permission to view a file and the features they are available to use once they have access.
Unique Security Options – Administrators can dictate which users have access to patient information. As an example, administrators can add a two-step authentication method to access sensitive patient information.
Privacy and HIPAA compliance can be challenging, but adding the right document management tools can help with the stress and pressure of protecting patients’ information.
by Felicien | Nov 12, 2019 | Education
4 Reasons Not to Hire Printer Companies
Thinking about saving money on your IT services with a printer company? Learn about the pitfalls and dangers of relying on support from companies without expertise.
Hiring a printer company to take care of your IT services can seem like a great solution. You won’t have to consult with multiple vendors or negotiate multiple contracts. A printer company might even offer to take care of all of your IT services for less than what you’re currently spending. However, there are several reasons why you should not trust a printer company as your single vendor for all of your organization’s IT needs. Although you may pay less, that lower price comes with a higher cost – substandard service and support.
The delivery of substandard service and support from printer companies occurs due to the following:
A lack of experience
An inability to understand the true nature and components of IT services
Inadequate resources directed towards developing IT and IT services
Unstable organizations due to conflicts between printing and IT services
Insufficient Experience
By design, printer companies are specialists in troubleshooting and maintaining two items – printers and copiers. While these companies are experts at providing service on these types of devices, branching out into the world of IT services is not something these companies have done in the past. Even though the staff may have basic troubleshooting, sales, and customer service experience under their belts, they may only have limited experience with the complexities of managing networks.
Lack of Understanding
Since printer companies do not have decades of experience with IT services, there is often a skill and knowledge gap. Without an understanding of and experience with more complex computing devices, troubleshooting skills may be limited. Computing devices, servers, and network equipment are more intricate than printers or copiers. In order to configure, deploy, maintain, troubleshoot, and fix this type of equipment, advanced and interdependent knowledge is necessary. It is far easier for printer companies to overlook the source of a problem with network dependent devices and the network itself simply due to a lack of skill.
Inadequate Resources
Since these companies specialize in printers and copiers, it is more difficult to devote internal resources to IT services. This means that there may be little put into research and development, training staff on the skills they need to support IT services, and a lack of support staff designated to managing IT services for clients. In other words, printer companies tend to overpromise and underdeliver when it comes to supporting services and devices outside of printers.
Instability
When printer companies try to branch out into IT services, it can cause internal conflict. Staff that is managing printers and copiers may not be able to keep the company afloat, due to the fact that the company is not reinvesting what it should into its printer expertise. Consequently, both sides of the business begin to suffer, and animosity develops. Leaders within the company may decide to cut out IT services altogether, leaving clients without support.
by Felicien | Nov 11, 2019 | Education
Why Organizations Need to View IT as Central to Success and Profit
Think Your IT Department is Simply There to Make Repairs and Solve Minor Problems? Find Out Why It Should Be the Center of Your Organization’s Long-Term Strategy
Information technology (IT) is more than a critical function. A well-run IT department should be integrated into an organization’s overall strategy. In fact, a comprehensive IT department should be at the center of organizational strategy. Within a firm, IT can include the following:
End-user computing devices
Networks and network infrastructure
Operating systems
Software applications
Data storage
Telecommunications
Internet service
Telephone systems
Using IT As a Strategic Asset
According to leading industry experts, even when leaders are aware of what constitutes the IT department’s purview and assets, there is a tendency to overlook IT’s potential. Yet, technology assets can be leveraged to ensure the organization runs as smoothly as possible. When an IT department and its assets are finely tuned, leaders can focus on identifying opportunities and innovative technical solutions. This includes innovative technical solutions that can be either used by the organization or leveraged by it. Consequently, the IT department and its assets become more cost-effective. With the right type and degree of investment, IT can help turn a profit for the firm.
Centralizing IT
When elevating IT and its assets to the center of organizational strategy, it is crucial to think about three areas. Those areas are:
Income
Growth
Strategic planning
IT can generate income through innovative solutions, but also by streamlining internal costs. This is usually achieved through the automation of processes and by increasing the efficiency of processes. Growth goes hand in hand with innovative solutions and increasing the efficiency of internal processes. By being able to meet client needs and drive market behaviors, an organization can use IT to establish a competitive advantage. Establishing and maintaining a competitive advantage to stimulate long-term growth is an essential part of any strategic plan.
Reasons to Leverage IT
The number one reason why it is important to leverage technology-related assets is due to the industry’s pace. Changes in technological advancements and capabilities happen at lightning-fast speeds. Without proper strategic planning, analysis and leverage of internal IT capabilities, an organization can simply not expect to succeed. IT can not only be a means of survival, but a point of differentiation. Technical expertise and advantage can reduce costs, create markets, better meet client needs, and make the entire organization more efficient. Neglecting IT or viewing the department and its assets as a necessary evil can backfire as others find ways to make technology generate revenue.
by Felicien | Nov 11, 2019 | Education
November 11th is Remembrance Day…
A day where we stand united to honour those who have made the ultimate sacrifice in the line of duty.
And for all they’ve done, we say thank you.
Thank you to those who placed themselves in harrowing situations in the name of protecting our freedom.
However you’re planning on spending the day, remember to take a moment to think about these exceptional men and women.
