PII for 60,000 Lost In Yet Another Incident: Know How To Address The Risks Involved With Entrusting PII To Business Partners

Now Available:

Featured Resources:

Yesterday yet another incident occurred where a business partner / vendor lost the personally identifiable information (PII) for which they had been entrusted. Americhoice sent a CD containing the PII of 67,000 individuals to TennCare via overnight UPS delivery.

UPS lost the CD. Americhoice did not encrypt the PII on the CD.

Oops. Another Oops. An apology. Yet another apology.

This is happening with too much frequency. Stronger penalties need to be applied to help ensure organizations are protecting PII, instead of waiting until after an incident occurs and just accepting feeble apologies and assurances it won't happen again.

Last month I blogged about the dangers of entrusting sensitive data and PII to others, "You Will Be Judged By The Company You Keep."

Over the past few years I've done many business partner security reviews to help ensure the businesses my clients are entrusting their sensitive data and PII to have appropriate security programs and controls in place.

I have discovered some very scary situations and huge vulnerabilities that absolutely should not exist in this day and age.

Having strong security practices is not just good business, it is necessary for business; it should not be viewed as an option.

Next Wednesday, September 19, I will be giving a webinar, "Vendor Management For Financial Institutions: Addressing Outsourcing Risks"

Even though the target audience for this particular webinar are financial institutions, the concepts and issues are applicable to anyone entrusting data to business partners.

If you're able to attend, please give me your feedback! I'd love to hear if you have additional tips to add to what I discuss.

Categories

Rebecca Herold's Bio:

Rebecca Herold, CISSP, CIPP, CISM, CISA, FLMI, has been providing information security, privacy and regulatory assistance and services to organizations from a wide range of industries for the past two decades. Rebecca was instrumental in building the information security and privacy program while at Principal Financial Group, which was awarded the CSI Information Security Program of the Year Award in 1998. IT Security ranked Rebecca as one of the top 59 IT security influencers, and Computerworld put Rebecca their list of the world's best privacy experts and on their list of the best privacy consulting firms in both 2007 and 2008. Rebecca has been CPO for two consulting organizations, and has had her own information privacy, security and compliance business since 2004. Rebecca has written chapters for several books, dozens of articles, and has been writing a monthly privacy column for the CSI Alert newsletter since the beginning of 2001, and is working on her 13th book. Some of her other books include The Privacy Papers, Managing an Information Security and Privacy Awareness and Training Program, The Definitive Guide to Security Inside the Perimeter (Realtime Publishers), The Shortcut Guide to Improving IT Service Support through ITIL (Realtime Publishers), and The Practical Guide to HIPAA Privacy and Security Compliance. In addition, Rebecca is the leader of The Realtime IT Compliance Community where she posts to her IT Compliance weblog. You can contact Rebecca at: rebecca_herold@realtimepublishers.net.

Now Available:

Featured Resources:

Realtime Communities

Newsletter

Monthly Archives

RSS

Ask the Expert