Europe’s data protection rules will undergo their biggest change in two decades when the new General Data Protection Regulation (“GDPR”) goes into effect on May 25, 2018. The GDPR replaces the current Data Protection Directive and imposes uniform data security requirements on all EU members. While the GDPR is “an evolution, not a revolution” for data protection, there are several significant changes for which companies should be prepared.

Continue Reading

The Occupational Safety and Health Administration (OSHA), an organization created by Congress to assure safe and healthful working conditions for working men and woman, declared on Friday, August 25, 2017 that what was believed to be a data breach by the Department of Homeland Security, was incorrect. The false alarm breach was related

The advice we always give to clients regarding privacy policies is: “say what you do and do what you say.” It seems simple, but simplicity can be deceiving. Companies want to reassure consumers that their personal data is safe and secure; however, in today’s world, no one can make fail-safe representations of security. Uber’s recent settlement with the FTC illustrates this problem.

Continue Reading

These days a data security plan should be treated as a top priority for all businesses. In the United States, the law dictates that businesses must secure any non-public third-party data it possesses which makes data security no longer a choice, but rather a legal obligation. Andrew Schlidt, a member of Husch Blackwell’s Data

Yesterday’s post by Sean Tassi on Husch Blackwell’s Higher Education Legal Insights provides colleges and universities with low-tech strategies to guard their data against criminal activity. The information in his post serves as a good reminder to remove unnecessary personal information (“PI”) on forms and documents.

If you have further questions, members of our Data

With the rise of innovations like cloud technology and software-as-a-service, clients are increasingly finding that it makes business sense to outsource computerized services, from payroll processing to the storage of electronic medical records. While doing so often cuts costs, routing (frequently confidential) data through third-party service providers also implicates serious cybersecurity concerns and, in some cases, may increase potential liability. Further, one of the pillars of a commercially reasonable information security program is selecting and retaining service providers capable of maintaining appropriate safeguards. To address these concerns, and to keep data safe, clients should require service providers to furnish them with Service Organization Control (“SOC”) Reports, particularly SOC 2 Reports.

SOC Reports were developed by the American Institute of CPAs (AICPA) to provide information about the robustness and quality of a service provider’s internal controls over certain types of data. There are three types of SOC Reports, each serving separate functions.


Continue Reading

Data security breaches are impacting long-standing and start-up corporations, as well as public and private entities. No one is immune from these threats and understanding the prevalence is the first step in best preventing this from impacting your organization. Aleks Ostojic Rushing provides the background on phishing expeditions, ways to identify phishing attacks and what

On April 24, 2017, the Office of Civil Rights (“OCR”) announced the first HIPAA settlement based on the impermissible disclosure of unsecured electronic protected health information by a wireless service provider. CardioNet, an ambulatory cardiac monitoring service, provides remote mobile monitoring of and rapid response to patients at risk for cardiac arrhythmias, agreed to pay $2.5 million, and to implement a corrective action plan.

As reported by the OCR, in 2012 CardioNet reported to the OCR the theft of a workforce member’s unencrypted laptop containing electronic PHI (“ePHI”) of 1,391 individuals. OCR’s investigation revealed that CardioNet had an insufficient risk analysis and risk management processes in place at the time of the theft.   Additionally, CardioNet’s provided the OCR draft policies and procedures implementing the HIPAA Security standards, and was unable to produce final policies or procedures implementing the security safeguards for ePHI, including mobile devices.
Continue Reading

Ransomware. It is the word every corporate board and IT team fears. Ransomware is a type of malicious software that can quickly shut down an entire network of computers and compromise an enormous amount of critical data. Often, when a ransomware attack occurs, all connected systems are locked down and a message appears on the

As technology advances, the advertising world is keeping pace. Companies can now advertise more easily and effectively across the Internet. However, the risks associated with that convenience are becoming more and more apparent.

Many companies employ third-party advertising services that use online consumer data and automated software to place advertisements across millions of websites, thousands of apps, and different user-generated video services. Unfortunately, because of this wide-reaching marketing tool, organizations employing targeted ads risk having their advertisement and brand displayed alongside offensive content. (Some types and uses of targeted ads have even faced legal challenges.)


Continue Reading