Issue link: https://viewer.e-digitaledition.com/i/945876
IN THE FIR S T a r t icle of ou r c yber- s e c u r it y s e r i e s i n t h e No v e m b e r/ December 2017 issue of MD News, we explored the definition of cybersecurity a nd how it differs from, yet relates to, privacy. In this a r ticle, we will intro- duce how cybersecurit y is reg u lated in t he United States. If you conduct business outside the United States, you should be awa re that ma ny countries have differing a nd in some cases more strict laws a nd reg ulations. HOW IS CYBERSECURIT Y REGUL ATED? In t he Un ited States, cybersecur it y has mostly been reg ulated at the state level through data breach notif ication statutes. These laws require companies that suffer a data breach to notify those customers or patients w ith a cer ta in level of det a i l of wh at i n for m at ion wa s or may have been compromised a nd provide remedies to customers or patients to prevent further harm. In the hea lthca re contex t, HIPA A conta ins ver y specif ic breach notif ication reg u- lations if the breach involves protected hea lth information. IDENTIT Y THEFT MONITORING Some states a lso require notif ication to the state's at torney genera l of f ice where the customers or patients a re lo c at e d wh i le m a ny s t at e s re qu i re the compa ny to provide identit y thef t monitoring at no cha rge to customers or patients. There a re identit y t hef t monitoring compa nies who specia lize in providing this ser vice, that monitor potentia l ly suspicious activ it y, such as new accounts on the customer's or patient 's credit f i le a s wel l a s credit inquiries on the credit f ile. MORE REGUL ATIONS ON THE HORIZON There a re a g rowing number of states t h a t a r e i n v e s t i g a t i n g a d d i t i o n a l r e g u l a t ion s t o r e q u i r e c omp a n ie s t o m a i nt a i n c er t a i n c y b er se c u r it y prot ec t ion . For ex a mple, New York recently implemented a cybersecurity reg u lation focused on orga nizations t hat prov ide f i na ncia l ser v ices. A s a rem inder, if you conduct business i nt er nat iona l ly, t here a re a my r ia d of pr ivacy a nd data protection laws that may apply to your business. You do not have to physica lly be located in a nother countr y to be subject to that country 's laws. Therefore, consultation with lega l representation versed in this a rea is critica l. In the next article , we will explore common cybersecurity risks. NOTE: This general summary of the law should not be used to solve individual problems since slight changes in the fact situation may require a material variance in the applicable legal advice. Allison Cole is an attorney with the law firm of Krugliak, Wilkins, Gri™ths & Dougherty Co., LPA, in Canton, Ohio. ■ C BY ALLISON E. COLE, ESQ. Basics for Small Business Owners Cybersecurity 1 8 1 8B U S I N E S S S E C T I O N