Blog – MFT Nation

Data Breach Trivia from OCR’s “Wall of Shame”

The HITECH Act mandates that the HHS Secretary must post a list of breaches of unsecured protected health information affecting 500 or more individuals. The list is compiled and published in its “Breach Notification Portal,” which has become known as the “Wall of Shame.”

The Wall of Shame shows that more than 160 breaches have been added so far in 2018, and here’s some trivia gleaned from the Wall of Shame: (1) “unauthorized access/disclosure” breaches are the most common type of incident; (2) second most commonly reported type of breach is hacking incidents, which affect far more individuals than other types of breaches; and (3) 2 dozen breaches involved loss/theft of #unencrypted computing devices.

Stay cyber-safe with #encrypted devises and by using #encryption when transmitting data.

Please share with others

• 
• 
• 
• 
• 
• 
• 

• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 

Comments Off on Data Breach Trivia from OCR’s “Wall of Shame”

bTrade Renews Certification as a Minority Business Enterprise

bTrade, the leading provider of secure and managed file transfer technology solutions,  has been recertified as a Minority Business Enterprise (MBE) by the National Minority Supplier Development Council (NMSDC).  “I am pleased to announce that we have renewed our MBE certification, which is highly regarded by many customers, prospective customers, and business partners,” said Steve Zapata, President and CEO of bTrade.  “Having the MBE certification is very valuable, and we take great pride in being recognized as a minority-owned business.”

NMSDC certifications cover a wide variety of businesses from small minority-owned organizations to billion-dollar powerhouses and NMSDC maintains a directory of certified MBEs.  MBE certification is accepted and generally required by many of the largest publicly, privately and foreign-owned companies, as well as universities, hospitals and other buying institutions.  NMSDC has an impressive list of corporate members that represent a veritable “Who’s Who” in corporate America.

NMSDC has established stringent certification standards which identify bona fide minority businesses, and the regional Councils do the investigation to determine whether a business is worthy of MBE certification.  For the recertification process, bTrade worked with the Southern California Minority Supplier Development Council (SCMSDC).  SCMBDC’s recertification process often alleviates the need for customers, prospective customers and business partners to conduct additional audits to verify bTrade’s commitment to workplace diversity.  This process also distinguishes NMSDC from other organizations that publish directories which allow “self-certification” as their standard.

“This certification stands proudly alongside bTrade’s other certifications,” said Zapata.  “These include our FIPS 140-2 security certification, meeting Drummond Group interoperability requirements, compliance with HIPAA standards, and many more.”

Please share with others

• 
• 
• 
• 
• 
• 
• 

• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 

Comments Off on bTrade Renews Certification as a Minority Business Enterprise

The US federal government, thru @USCERT_gov, has published an excellent “security tip” (which actually is more of a detailed guide) for better securing network infrastructure: https://bit.ly/2txAHLw . We love it when we see government working for its citizens!

Please share with others

• 
• 
• 
• 
• 
• 
• 

• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 

Comments Off on

Three Data Security Breaches and Everything was Fine(d)

Starting with the FTC vs. Wyndham case, bTrade’s MFT Nation blog has run a series of posts that we described as “case studies for what not-to-do” in the rapidly changing world of data security.  The latest in this series involves the University of Texas MD Anderson Cancer Center (“Anderson”).

The U.S. Department of Health and Human Services, Office of Civil Rights (“OCR”), investigated Anderson after learning of three separate data breaches involving the theft of unencrypted electronic protected health information (ePHI) of tens of thousands of individuals.  To Anderson’s credit, it had written encryption policies going as far back as 2006 and risk analysis performed by Anderson showed that the lack of device-level encryption posed a high risk to the security of ePHI.

The problem for Anderson, however, was its failure to implement the required encryption.  Anderson did not begin to adopt an enterprise-wide solution to implement encryption of ePHI until 2011, and it failed to encrypt its inventory of electronic devices containing ePHI until much later.

OCR imposed a $4.3 million penalty against Anderson for violating HIPAA’s Privacy and Security Rules.  The penalty was justified “given the high risk to its patients resulting from the unauthorized disclosure of ePHI,” a risk that Anderson “not only recognized, but that it restated many times.”

Click here to read more on OCR’s website about the recent actions taken against Anderson.

If you want to speak with bTrade’s data security experts about implementing an enterprise-wide encryption solution to protect ePHI, or any other type of data, please contact us at info@btrade.com.

Please share with others

• 
• 
• 
• 
• 
• 
• 

• 
• 
• 
• 
• 
• 
• 
• 
• 
• 
• 

Comments Off on Three Data Security Breaches and Everything was Fine(d)