Category Archives: Compliance & Regulation

[Podcast] Attorney Sara Jodka on the GDPR and HR Data, Part II

By Andy Green in Compliance & Regulation • Last Updated: 5/9/2018

In the second part of my interview with Dickinson Wright’s Sara Jodka, we go deeper into some of the consequences of internal employee data. Under the GDPR, companies will likely have to take an additional step before they can process this data: employers will have to perform a Data Protection Impact Assessment (DPIA). As Sara explained in the first podcast, internal employee data is covered by the GDPR — all of the new law’s requirements…

NIST 800-53: Definition and Tips for Compliance

By Jeff Petters in Compliance & Regulation • Last Updated: 5/4/2018

NIST sets the security standards for agencies and contractors – and given the evolving threat landscape, NIST is influencing data security in the private sector as well. It’s structured as a set of security guidelines, designed to prevent major security issues that are making the headlines nearly every day. The National Institute of Standards and Technology – NIST for short – is a non-regulatory agency of the U.S. Commerce Department, tasked with researching and establishing…

[Podcast] Attorney Sara Jodka on the GDPR and Employee HR Data, Part I

By Andy Green in Compliance & Regulation • Last Updated: 5/3/2018

In this first part of my interview with Dickinson Wright attorney Sara Jodka, we start a discussion of how the EU General Data Protection Regulation (GDPR) treats employee data. Surprisingly, this turns out to be a tricky area of the new law. I can sum up my talk with her, which is based heavily on Jodka’s very readable legal article on this overlooked topic, as follows: darnit, employees are people too! It may come as…

Canada’s PIPEDA Breach Notification Regulations Are Finalized!

By Andy Green in Compliance & Regulation • Last Updated: 5/3/2018

While the US — post-Target, post-Sony, post-OPM, post-Equifax — still doesn’t have a national data security law, things are different north of the border. Canada, like the rest of the word, has a broad consumer data security and privacy law, which is known as the Personal Information Protection and Electronic Documents Act (PIPEDA). For nitpickers, there are also overriding data laws at the provincial level — Alberta and British Columbia’s PIPA — that effectively mirror…

Another GDPR Gotcha: HR and Employee Data

By Andy Green in C-Level, Compliance & Regulation • Last Updated: 2/27/2019

Have I mentioned recently that if you’re following the usual data security standards (NIST, CIS Critical Security Controls, PCI DSS, ISO 27001) or common sense infosec principles (PbD), you shouldn’t have to expend much effort to comply with the General Data Protection Regulation (GDPR)? I still stand by this claim. Sure there are some GDPR requirements, such as the 72-hour breach notification, which will require special technology sauce. There’s also plenty of fine print that…

HIPAA Security Rule Explained

By Jeff Petters in Compliance & Regulation • Last Updated: 4/16/2018

The HIPAA Journal estimates that a large data breach ( > 50k records) can cost the organization around $6 million – and that’s before the Office of Civil Rights (OCR) drops their own hammer. Over the last few years, we’ve seen more reports of breaches, an increase of HIPAA investigations, and higher fines across the board – all stemming from violations of the HIPAA security rule. The HIPAA Security Rule sets the minimum standards required…

HIPAA Privacy Rule Explained

By Jeff Petters in Compliance & Regulation • Last Updated: 4/13/2018

It’s an unfortunate (but inevitable) fact of life: Laptops get stolen, and the consequences can be devastating. If those laptops have electronic protected health information (ePHI) on them, they fall under HIPAA regulations and the theft must be reported. Even if the thief doesn’t look at the data, the company can’t prove it: everyone should take precautions to protect themselves against not just fallout from lost data, but from the potential fines that can accrue:…

SHIELD Act Will Update New York State’s Breach Notification Law

By Andy Green in Compliance & Regulation • Last Updated: 4/14/2018

Those of you who have waded through our posts on US state breach notification laws know that there are few very states with rules that reflect our current tech realities. By this I mean there are only a handful that consider personally identifiable information (PII) to include internet-era identifiers, such as email addresses and passwords. And even fewer that would require a notification to state regulators when a ransomware attack occur. Remember the loophole in…

HIPAA Compliance: Guide and Checklist

By Jeff Petters in Compliance & Regulation • Last Updated: 4/13/2018

There are currently 14,930,463 individual records in the United States with an open HIPAA data breach investigation. That’s up to 14 million humans that have had their Protected Health Information (PHI) exposed by hacking, IT incident, theft, loss, or unauthorized access/disclosure. That’s just the unresolved case list. If we add the numbers from the resolved breach notifications, we end up with 162,599,642 records – over half of the current US population. And that’s why we…

[White Paper] Let Varonis Be Your EU GDPR Guide

By Andy Green in Compliance & Regulation • Last Updated: 3/22/2018

Everyone knows that when you travel to a strange new country, you need a guide. Someone to point out the best ways to move around, offer practical tips on local customs, and help you get the most out of your experience. The EU General Data Protection Regulation (GDPR) is a country with its own quirky rules (and steep fines if you don’t do things just right). So may we suggest using Varonis to help you…

Inside Out Security

Information security and IT ops.