What we think is happening isn’t always the case.  According to a recent privacy survey conducted by Jordan Lawrence, the perception versus practice is quite different when addressing key issues in managing sensitive and personally identifiable information.

Over 1,000 corporate counsels, compliance officers, auditors and others were asked about their company’s practices related to identifying and protecting sensitive information.   This will be available at the ACC Annual conference in San Antonio, October 24-27.

Over 63% of the participants responded they either didn’t have or didn’t know if they had completed a personal data inventory.  Of the participants that responded they had completed an inventory of records containing sensitive information, only 40% had an inventory of unstructured content.

Developing an accurate Sensitive Information Inventory that includes personally identifiable data is a baseline step to determining current practices, information usage and sensitive elements associated with each record type.

In order to protect all the sensitive information, an organization must have an inventory of what records contain PII, what media it resides in, who has access to it and how it is maintained and disposed.  Jordan Lawrence’s Privacy Management allows you to create a comprehensive Sensitive Information Inventory that covers all primary sensitive categories and underlying elements.  Covering all the media is critical for the inventory, because risks vary in likelihood and breadth depending on the media.

At the recent IAPP Privacy Academy, Jay Cline, President of Minnesota Privacy Consultants and Jordan Lawrence’s EVP of Business Development, Marty Provin presented to a full house on “Data Inventorying and Policy Frameworks for Privacy Offices with Limited Resources”.  In the session they addressed identifying business processes, developing a sensitive information inventory, assessing privacy risks and developing practical policy frameworks.

An investigation by a TV station discovered that CVS pharmacies disposed of labels from prescription and old prescription bottles containing patient health information in unsecured dumpsters outside of their locations across the country. 

The U.S. Department of Health and Human Services Office of Civil Rights and the Federal Trade Commission charged CVS with failure to implement adequate policies and procedures to reasonably and appropriately safeguard protected health information during the disposal process. 

CVS agreed to a settlement of $2.25 million with the U.S. Department of Health and Human Services.  The FTC now requires CVS to “establish, implement, and maintain a comprehensive information security program”.  CVS will also be required to obtain an independent third-party audit every two years for the next 20 years. 

Jordan Lawrence’s Privacy Management gives you deep insights into where personal and sensitive information resides.  Privacy Management shows how information moves across the enterprise, outside of the organization and how it is being disposed.  Knowing this information may save you $2 million.

The Federal Government has been vigorously enforcing the HIPAA Security Rule.  Recently they released draft guidance regarding the risk analysis requirements in the HIPAA Security Rule. 

The guidelines call for identifying where electronic protected health information is stored, received, maintained or transmitted.  The risk analysis process should be periodically reviewed and updated. 

With GRIP^TM Privacy Management Services creating and maintaining a Personal Data Inventory has never been easier or more accurate.  In just 30 days, an inventory of where all your structured and unstructured data containing all privacy related information can be developed .  GRIP^TM provides detailed datamaps and reports showing what departments, media, applications, vendors and record types that contain personally identifiable information (PII). 

Privacy Management Services leverages automation, benchmarking and best practice standards to automatically identify and highlight areas of immediate concern.

A Hartford, Connecticut woman found more than she bargained for when she stopped and picked up a cabinet that had a “free” sign on it.  She brought it home and inside discovered documents that contained Social Security numbers and names, death benefits, medical records with hospital admissions and medication records of Aetna policy holders.

According to Aetna someone made a “serious human error”.  The fact is that 88% of breaches are caused by insider negligence.  In order to eliminate human error and properly safeguard records containing personally identifiable information (PII) you need to know where those records exist.  To know this, an organization must have an inventory of what records contain PII, what media it resides in, who has access to it and how it is maintained and disposed.  Jordan Lawrence’s Privacy Management allows you to proactively identify where human error and process breakdowns can occur within your organization.

Judge Shira Scheindlin has entered an order amending her recent opinion in Pension Comm. Univ. of Montreal Pension Plan v. Bank of Am. Secs., LLC.  The amended opinion cites negligence for failure to “obtain records from all those employees who had any involvement with the issues raised in the litigations or anticipated litigation, as opposed to just the key players.”

When litigation arises, it is critical for an organization to implement and enforce a hold order notice quickly and accurately to avoid sanctions.  Hold Management Services allows you to filter and search notice recipients by typical attributes like job classification or business area so you can identify all employees who had any involvement.  And you can deliver those hold notices through a secure, closed communication channel for compliance verification every time.

The Massachusetts privacy law, that went into effective March 1, 2010, is not a law that only Massachusetts businesses need to be concerned about, but any company that retains personally identifiable information (PII) about a Massachusetts resident needs to be compliant. 

Requirements to comply with this law include creating an inventory of all paper and electronic records and media that contain PII, perform regular threat assessments to identify risks and vulnerabilities for a breach, and maintain a written security policy.

Most companies struggle with how to develop a data inventory, which is the foundation of any privacy program, as well as the costs associated with the typical approach of using spreadsheets, the man hours and the disruption to the business.  With Privacy Management Services you can create a personal data inventory in 30 days and update and maintain that information with minimal costs.

The number of data breaches involving personally identifiable information (PII) is on the rise.  The majority of these data breaches are caused due to bad business processes rather than by unauthorized access to networks.

In order to protect your personal and sensitive information from exposure due to bad processes you need to know what you have and where it resides.  The first step to identify those “bad processes” is creating and maintaining a personal data inventory.  With Privacy Management Services an inventory can be completed in 30 days giving you insight into what type of records exist, which records contain PII,  what media it resides in, and how it moves across the enterprise.

Having this information enables you to perform regular threat assessments to identify where your risks and vulnerabilities lie so you can develop actionable policies and procedures to mitigate those “breakdowns”.

How many emails do you receive and send in a day?  Now, imagine over a course of a year, or three years, or even five years the number of emails one person in your organization produces or receives. 

According to the Federal Rules of Civil Procedure and state rules, parties are required to produce their electronically stored information during litigation. To avoid the outlandish costs and burden of producing the enormous amounts of electronically stored information companies should take a pre emptive approach to reducing the cost of eDiscovery.

The first step is to reduce the amount of records and emails you have stored.  The best way is to develop and implement document retention policies including an email retention policy.  With Jordan Lawrence’s Information Governance you can assess your records and information management in 30 days and develop actionable retention schedules using our best practice standards.

Every week there is a news story about a data breach.  This week is no different for 9,500 patients enrolled in New Mexico’s Medicaid program.  The breach occurred when a third party vendor’s car was stolen that contained a laptop with their personal information. 

Most data breaches occur not due to malicious hackers but from the” people breakdowns” and bad business processes.  Knowing where your sensitive information resides on and off your network and the processes for managing that information within your organization and your third party vendors is crucial in preventing potentially costly and devastating data breaches.

Jordan Lawrence’s Privacy Management Services identifies where the “people breakdowns” are, where processes fail and what causes failure.