#breach notification

Web hosting giant GoDaddy confirms that a data breach has affected about 28,000 of its customers’ web hosting accounts, according to a news report. The company has reset passwords and usernames for some customers as a precaution, although it says no data appears to have been altered, it states in a notification letter to clients.

Web hosting giant GoDaddy confirms that a data breach has affected…

A new Department of Health and Human Services Office of Civil Rights (OCR) CardioNet Resolution Agreement and Corrective Action Plan (Resolution Agreement) settling OCR charges of violations of the Privacy and Security Rules of the Health Insurance Portability & Accountability Act against remote cardiac monitoring provider CardioNet provides important lessons for health plans, health…

Health Plans, Other Covered Entities Have Continuing Duty To Reevaluate HIPAA Enterprise Risk To PHI & Address Security Risks & Other Compliance Concern On Ongoing Basis

Compliance with the Privacy and Security Rules of the Health Insurance Portability & Accountability Act (HIPAA) is a living process that requires employer and other health plans, health insurers, health care providers and healthcare clearinghouses to recurrently reevaluate their HIPAA enterprise risk and timely act to mitigate security threats to electronic (ePHI) and other  protected health…

The state of Tennessee recently passed a bill - S.B. 2005 - that was signed into law by Governor Haslam that makes some important precedent-setting changes to information breach laws in that state. This may influence similar changes in other states' breach notification laws moving forward.

S.B. 2005 makes three important changes to the existing breach notification statute:

The definition of "unauthorized person" is clarified to be inclusive of employee misuse

The previous statute required notification of a breach to be made in "the most expedient time possible and without unreasonable delay."[1]. The revised statute now imposes a window of 14 days from the company's discovery (or notification by an outside party) of a breach to issue the required notification. Both the original and the revised statute provide provisions for delayed notification at the behest of law enforcement.

Most significantly, the revision removes safe harbor for the loss of encrypted data. The revised statute now reads: "'Breach of the security of the system' means unauthorized acquisition of unencrypted computerized data that materially compromises the security, confidentiality, or integrity of personal information..."

At first glance, that third point seems like a disastrous move. The best and most sensible protection any information holder can and should make to protect that data is to use encryption. The loss of a laptop, for instance, wouldn't result in the 'breach of the security of the system' if the laptop were encrypted at rest.

The sky is not falling, however. There's a key phrase in that definition: "materially compromises". The loss of a laptop does not represent the material compromise of data security because whomever recovers it would be unable to access the data in a meaningful way.

So why remove the word "unencrypted" from the definition of a breach? What this does is it closes a loophole for improperly or insufficiently encrypted data.

Here's a couple scenarios to consider.

First, let's stick with that encrypted laptop that someone either had stolen from their car. It's encrypted, so we're good, right? Well, what if it turns out that this employee had his boot password written on a sticky note on the bottom? The data lost is encrypted, yes, but the thief has the password so the data is definitely "materially compromised." The company should, in this instance, need to disclose the breach to the impacted persons.

Second, let's consider the loss of a username and password database. If the passwords are stored using unsalted MD5, then strictly speaking the data is encrypted. Any security specialist in the world would point out that MD5 should not be used any circumstance in 2016, though, because it provides virtually no data security. This loss constitutes a "material compromise" of the security of any personal information contained within those accounts. The company should not be expected to disclose the breach to those impacted persons.

Breach notification law is a rapidly shifting field with a lot of impact on how businesses need to view data security. Despite what may look like the withdrawal of protections for the loss of encrypted data, encrypting data at rest is still an extremely important protection for businesses against legal and reputational consequences in the event of data loss.