Category Archives: Compliance & Regulation

Canada’s PIPEDA Breach Notification Regulations Are Finalized!

Andy Green in Compliance & Regulation • Last Updated: 5/3/2018

While the US — post-Target, post-Sony, post-OPM, post-Equifax — still doesn’t have a national data security law, things are different north of the border. Canada, like the rest of the word, has a broad consumer data security and privacy law, which is known as the Personal Information Protection and Electronic Documents Act (PIPEDA). For nitpickers, there are also overriding data laws at the provincial level — Alberta and British Columbia’s PIPA — that effectively mirror…

Another GDPR Gotcha: HR and Employee Data

Andy Green in Compliance & Regulation • Last Updated: 4/23/2018

Have I mentioned recently that if you’re following the usual data security standards (NIST, CIS Critical Security Controls, PCI DSS, ISO 27001) or common sense infosec principles (PbD), you shouldn’t have to expend much effort to comply with the General Data Protection Regulation (GDPR)? I still stand by this claim. Sure there are some GDPR requirements, such as the 72-hour breach notification, which will require special technology sauce. There’s also plenty of fine print that…

HIPAA Security Rule Explained

Jeff Petters in Compliance & Regulation • Last Updated: 4/16/2018

The HIPAA Journal estimates that a large data breach ( > 50k records) can cost the organization around $6 million – and that’s before the Office of Civil Rights (OCR) drops their own hammer. Over the last few years, we’ve seen more reports of breaches, an increase of HIPAA investigations, and higher fines across the board – all stemming from violations of the HIPAA security rule. The HIPAA Security Rule sets the minimum standards required…

HIPAA Privacy Rule Explained

Jeff Petters in Compliance & Regulation • Last Updated: 4/13/2018

It’s an unfortunate (but inevitable) fact of life: Laptops get stolen, and the consequences can be devastating. If those laptops have electronic protected health information (ePHI) on them, they fall under HIPAA regulations and the theft must be reported. Even if the thief doesn’t look at the data, the company can’t prove it: everyone should take precautions to protect themselves against not just fallout from lost data, but from the potential fines that can accrue:…

SHIELD Act Will Update New York State’s Breach Notification Law

Andy Green in Compliance & Regulation • Last Updated: 4/14/2018

Those of you who have waded through our posts on US state breach notification laws know that there are few very states with rules that reflect our current tech realities. By this I mean there are only a handful that consider personally identifiable information (PII) to include internet-era identifiers, such as email addresses and passwords. And even fewer that would require a notification to state regulators when a ransomware attack occur. Remember the loophole in…

HIPAA Compliance: Guide and Checklist

Jeff Petters in Compliance & Regulation • Last Updated: 4/13/2018

There are currently 14,930,463 individual records in the United States with an open HIPAA data breach investigation. That’s up to 14 million humans that have had their Protected Health Information (PHI) exposed by hacking, IT incident, theft, loss, or unauthorized access/disclosure. That’s just the unresolved case list. If we add the numbers from the resolved breach notifications, we end up with 162,599,642 records – over half of the current US population. And that’s why we…

[White Paper] Let Varonis Be Your EU GDPR Guide

Andy Green in Compliance & Regulation • Last Updated: 3/22/2018

Everyone knows that when you travel to a strange new country, you need a guide. Someone to point out the best ways to move around, offer practical tips on local customs, and help you get the most out of your experience. The EU General Data Protection Regulation (GDPR) is a country with its own quirky rules (and steep fines if you don’t do things just right). So may we suggest using Varonis to help you…

New SEC Guidance on Reporting Data Security Risk

Andy Green in Compliance & Regulation • Last Updated: 7/5/2018

In our recent post on a 2011 SEC cybersecurity guidance, we briefly sketched out what public companies are supposed to be doing in terms of informing investors about risks related to security threats and actual incidents. As it happens, late last month the SEC issued a further guidance on cybersecurity disclosures, which “reinforces and expands” on the older one. Coincidence? Of course! But it’s a sign of the times that we’re all thinking about how…

North Carolina Proposes Tougher Breach Notification Rules

Andy Green in Compliance & Regulation • Last Updated: 3/6/2018

If you’ve been reading our amazing blog content and whitepaper on breach notification laws in the US and worldwide, you know there’s often a hidden loophole in the legalese. The big issue — at least for data security nerds — is whether the data security law considers mere unauthorized access of personally identifiable information (PII) to be worthy of a notification. This was a small legal point until something called ransomware came along. You have…

How to Discover GDPR Data With Varonis

Jeff Petters in Compliance & Regulation, Data Security • Last Updated: 3/22/2018

GDPR goes into effect in less than 85 days – but there’s still time to prepare. The first step in getting ready for the upcoming deadline is to discover and classify your GDPR data. More often than not, we’re seeing that customers have much more GDPR eligible data than they thought they had – or even knew existed. A recent GDPR Readiness Assessment for a mid-sized insurance company revealed some eye-opening results. In the below…

Inside Out Security

Information security and IT ops.