School of Public Safety
Center for Information Assurance
Every organization, public or private, which collects. processes, and/or stores customer information is subject to a variety of laws and regulations. Medical facilities must comply with HIPAA, stores that accept credit cards have to conform to the Payment Card Industry Data Security Standard, and attorneys must have an understanding of eDiscovery processes.
A recent survey published by HIMSS Analytics revealed that
approximately one-third of business associates surveyed were not aware
that they need to adhere to federal Health Insurance Portability and
Accountability Act (HIPAA) privacy and security requirements, compared
to 87 percent of health providers.
The lack of
awareness of new federal regulations by business associates coupled
with the large number of third parties hired by hospitals to control
costs through outsourcing, points to a potential area of concern.
The research also found that:
- 50 percent of large hospitals experienced at least one data breach this year
- 68 percent of all hospitals indicated that the HITECH Act’s expanded breach notification requirements will result in the discovery and reporting of more incidents, and 57 percent reported that they now have a greater level of awareness of data breaches and breach risk
- 90 percent indicated they have changed or plan to change policies and procedures to prevent and detect data breaches.
More than 40 states have passed personal information security breach laws, and Federal legislation is pending. Many of these requirements differ in the form of notification, the time frame for notification, and what constitutes a breach -- and almost all of them can impact a business outside their state that conducts a transaction with one of their citizens. Does your North Carolina business have a client in California? If so, you are probably subject to the terms of California Senate Bill 1386. Do you know what they are and how to comply?
Data disasters happen. Is your organization prepared for any eventuality -- equipment or power failure, ice storm or fire? Could you get up and running at an alternate location quickly? What is the cost of your information not being available?
1. Assist public and private sector organizations in the Catawba Valley region to improve their awareness of the need for Information Assurance (IA) programs.
2. Provide a mechanism to bring the expertise of CVCC faculty to bear on solving IA problems for local organizations and businesses through the provision of training and technical assistance services.
3. Use the practical experiences gained through the promotion of IA to improve the ability of the workforce in the Catawba Valley to work in information/knowledge intensive jobs -- including problem solving, analysis, and information security.
