Cyber Security, Data Breach, Education, GDPR, General Data Protection Regulation, HIPAA / HITECH Enforcement, Risk Analysis/Risk Management, State Laws, Tip of the Week

Landmark policy constituting the most stringent data protection in the United States


Note: After having various conversation with a few students learning about HIPAA, State Laws, and GDPR, we thought it would be useful to post a handout provided to the class.

California Consumer Privacy Act (CCPA) of 2018 

Assembly Bill (AB) No. 375: Chapter 55

Beginning January 1, 2020, the bill would grant a consumer the right to request a business to disclose the categories and specific pieces of personal information that it collects about the consumer. 

Consumer Privacy Law for companies that deal with personal data and those operating in the digital space.  Companies that collect web browsing data and generate revenue from targeted advertising over internet platforms or service providers will be affected:

  • Facebook
  • Twitter
  • Google
  • AT&T
  • Verizon


CCPA applies to for profit entities that both collect and process the personal information of California residents and do business in the State of California. However, a physical presence in California is not a requirement, and it appears that making sales in the state would be enough. Additionally, the business must meet at least one of the following criteria for the CCPA to apply (see blue box). Nonprofit businesses, as well as companies that don’t meet any of the mentioned thresholds, are not required to comply with the CCPA.


Historical Background: SB 1386, Peace. Personal information: Privacy

On September 25, 2002, the California Senate Bill No. 1386 Chapter 915 was approved by Governor September 25, 2002 and filed with the Secretary of State September 26, 2002.

“Existing law regulates the maintenance and dissemination of personal information by state agencies, as defined, and requires each agency to keep an accurate account of disclosures made pursuant to specified provisions. Existing law also requires a business, as defined, to take all reasonable steps to destroy a customer’s records that contain personal information when the business will no longer retain those records. Existing law provides civil remedies for violations of these provisions.
This bill, operative July 1, 2003, would require a state agency, or a person or business that conducts business in California, that owns or licenses computerized data that includes personal information, as defined, to disclose in specified ways, any breach of the security of the data, as defined, to any resident of California whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. The bill would permit the notifications required by its provisions to be delayed if a law enforcement agency determines that it would impede a criminal investigation. The bill would require an agency, person, or business that maintains computerized data that includes personal information owned by another to notify the owner or licensee of the information of any breach of security of the data, as specified. The bill would state the intent of the Legislature to preempt all local regulation of the subject matter of the bill. This bill would also make a statement of legislative findings and declarations regarding privacy and financial security.”   
About 16 Years Later

The new privacy law (CCPA) Assembly Bill No. 375, will allow California residents to delete their data or bring it with them to alternative service providers. Data brokers who generate profits by collecting consumer data & profit by selling it to a third party are affected too:

  • Acxiom
  • Epsilon
  • Experian
  • Oracle

The Privacy Act contains a broad definition of “personal information”, as defined below.

The state’s attorney general will be the enforcer of this law. However, consumers will maintain a private right of action should companies fail to maintain reasonable security practices, resulting in unauthorized access to their personal data.

California residents will have a multitude of new Rights:

  • To know what personal information is being collected about them
  • To know whether their personal information is sold or disclosed and to whom
  • To say no to the sale of personal information
  • To access their personal information
  • To have equal service and price, even if they exercise their privacy rights
  • To receive financial incentives from businesses for providing their personal information
  • To prohibit a business from selling the personal information for under 16 years old consumers

For more information see AB 375 CCPA

“Personal information” is defined under the CCPA as “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” The addition of the term “household” adds a dimension to a privacy law that is largely uncharted territory. Specifically, information collected by a business does not have to be associated with a name or specific individual, but rather can identify a household.

The definition of “personal information” under the CCPA also lists a wide range of standard examples that includes Social Security numbers, drivers’ license numbers and purchase histories, but also “unique personal identifiers” such as device identifiers and other online tracking technologies.

Note: CCPA excludes information that is publicly available.

Europe’s General Data Protection Regulation (GDPR) Entered the U.S.

Brief Explanation: Global privacy regulation (EU Regulation 2016/679)

Healthcare businesses (providers, digital health/health IT companies, and their vendors) that “control” and/or ”process” health data in the U.S. that may include data from EU “data subjects” will be required to comply with the new EU General Data Protection Regulation (GDPR).

  • Applicable as of May 25th, 2018 in all member states to harmonize data privacy laws across Europe
  • GDPR is broader in scope than HIPAA, as its protections extend to all broadly defined “personal data,” not just Protected Health Information (PHI)
  • Replaced the 1995 Data Protection Directive from the European Union, which only impacted U.S. companies that transferred the data of EU data subjects out of the EU
  • GDPR affects all companies that do business with EU data subjects, whether or not they have a presence in the EU
  • Any company that uses, collects, or retains any personal data from any European citizen, either knowingly or unknowingly, will have to comply with the GDPR – even if that citizen is physically located in the U.S


Consumer confidence has been miserable and distressful post Equifax and Cambridge Analytica style compromising of our trust, leading to real consequences in personal identity theft , abuse and data privacy.  Companies who were doing business in Europe under EU terms have had to deal with protecting privacy. California laws such as the two mentioned above SB 1386 and AB 375 are setting examples and we should not be surprised when other states follows to improve consumers security controls over the use of their data.

It is very simple, GDPR is similar to the U.S. State laws. HIPAA has many requirements corresponding to the GDPR requirements such as having policies, Data protection impact assessment, Technical vulnerability assessment, training, Data Protection Officer (DPO), etc.

Brief Explanation: HIPAA


Health Insurance Portability and Accountability Act of 1996

Public Law 104-191

Most of us believe that our medical and other health information is private and should be protected, and we want to know who has this information. The Privacy Rule, a Federal law, gives you rights over your health information and sets rules and limits on who can look at and receive your health information. The Privacy Rule applies to all forms of individuals’ Protected Health Information (PHI), whether electronic, written, or oral. The Security Rule is a Federal law that requires security for health information in electronic form.

To improve the efficiency and effectiveness of the health care system, HIPAA included Administrative Simplification provisions that required the U.S. Department of Health & Human Services (HHS) to adopt national standards for electronic health care transactions and code sets, unique health identifiers, and security. At the same time, Congress recognized that advances in electronic technology could erode the privacy of health information. Therefore, Congress incorporated into HIPAA provisions that mandated the adoption of Federal privacy protections for Individually Identifiable Health Information (IIHI).

Be Proactive not Reactive!

While numerous businesses are struggling to implement data strategies to assist them to meet regulatory requirements, it is not too late to start if you have not. With the potential risks and loss of customer trust that you jeopardise by not safeguarding your customers’ data, this is the perfect opportunity to act.

The CCPA has already been amended once and may go through additional updates before it takes effect, but businesses should start to prepare now. Privacy notices, other policies and procedures, and websites will need to be updated before the CCPA takes effect. At the very least, a business should start mapping the personal information that it collects and locations where personal information is stored so it can promptly meet any request under the CCPA.

Our team at RISC Management and Consulting are ready and able to assist your organization from all your Data privacy and information security requirements to State Laws and GDPR to protect your client’s Protected Health Information (PHI) and/or Personal information. We are committed to the success of our clients.

Data Breach, News Events, Risk Analysis/Risk Management

Sutter Health Breach Update

This past week, Sutter Health released a statement stating that they are notifying 2,582 patients that personal information was included in billing documents a former employee emailed to their personal account without authorization. For all but two of the affected patients, no Social Security numbers, financial information or driver’s license data were included.

Despite the incident occurring on April 23, 2013, the breach was only discovered “during a thorough review of the former employee’s email activity and computer access.” The internal investigation began on August 27, 2015, more than two years after the incident. What stands out in this instance was the inability for Sutter Health to discover, mitigate, and remediate this incident within a reasonable timeframe. When it comes to HIPAA, breaches must be reported to HHS and the individuals affected without unreasonable delay and in no case later than 60 days following discovery of a breach or when it reasonably should have been known that a breach occurred.

The last point is key and clearly indicates the need for tools that allow organizations to better understand when PHI or other types of sensitive data leave their network. The best option to track and stop data from leaving your network is a Data Loss Prevention (DLP) solution. In this incident, the third large data breach involving Sutter Health, they have found “no evidence that any of the patient information was used or disclosed to others.” Since the data was sent to a personal email account, it is unlikely, truly impossible, that Sutter Health can determine with 100% certainty that the patient information was not disclosed inappropriately and this is reflected in their offering affected individuals one year of free credit monitoring.

In some other breach cases, however, data is available to forensically determine with certainty what happened after a breach occurred, and sometimes long after a breach occurred. If this is the case, then the information existed when the breach actually occurred. The takeaway in those instances is that logs or other forensic data were not reviewed proactively to catch the breach sooner.  In a digital information world with bigger and bigger data hurtling down the road faster and faster, no one seems to be watching the gauges for trouble!

With the many tools available and the ease with which an employee can move data outside of an organization, a DLP solution is a necessity. Not only would your organization be able to watch sensitive information flowing into, throughout, and out of your network without impacting performance, you can lock down many of those outlets for data leakage. In addition to performing a HIPAA Risk Analysis and publishing policies and procedures, DLP can help your organization maintain compliance with regulations such as HIPAA, Red Flags Rule, PCI, and other state and Federal privacy regulations. As the costs for remediating a breach rise, DLP becomes a more prudent decision that can offer real value as well as peace of mind.

If you are interested in learning more about DLP or other related services, contact RISC Management and Consulting, LLC at 800.648.4358 or visit