On September 30, 2021, the U.S. Department of Health and Human Services’ Office for Civil Rights issued guidance regarding when the HIPAA Privacy Rule applies to disclosures and requests for information about a person’s COVID-19 vaccination status. The guidance addresses common workplace scenarios and answers questions about whether and how the HIPAA Privacy Rule applies.
Continue Reading OCR Guidance Regarding HIPAA’s Applicability to COVID-19 Vaccination Information
United States
DHS Issues Cybersecurity Guidance for Critical Infrastructure Firms
Posted on
Posted in Cybersecurity, U.S. Federal Law
On September 22, 2021, Secretary of Homeland Security Alejandro N. Mayorkas and Secretary of Commerce Gina Raimondo released a joint statement on the Department of Homeland Security’s issuance of preliminary Critical Infrastructure Control Systems Cybersecurity Performance Goals and Objectives. The Preliminary Goals identify nine overarching control system cybersecurity performance goals, each containing specific objectives to support the deployment and operation of secure control systems.
Continue Reading DHS Issues Cybersecurity Guidance for Critical Infrastructure Firms
Zoom Agrees to Pay $85M to Settle Class Action
Posted on
On July 31, 2021, Zoom Video Communications, Inc. agreed to pay $85 million to settle a class action suit that alleged the Company violated users’ privacy rights. The proposed settlement must be approved by U.S. District Judge Lucy Koh.
Continue Reading Zoom Agrees to Pay $85M to Settle Class Action
White House Issues Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems
Posted on
Posted in Cybersecurity, Information Security
On July 28, 2021, President Biden signed a National Security Memorandum that formally establishes an Industrial Control Systems Cybersecurity Initiative and directs the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency and the Department of Commerce’s National Institute of Standards and Technology, in collaboration with other agencies, to develop and issue cybersecurity performance goals for critical infrastructure.
Continue Reading White House Issues Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems
Senator Gillibrand Announces Renewed Data Protection Act 2021
Posted on
Posted in Online Privacy, U.S. Federal Law
On June 17, 2021, Senator Kirsten Gillibrand (D-NY) announced the reintroduction of the Data Protection Act of 2021, which would create an independent federal agency, the Data Protection Agency, to “regulate high-risk data practices and the collection, processing, and sharing of personal data.”…
Continue Reading Senator Gillibrand Announces Renewed Data Protection Act 2021
MEPs Urge European Commission to Amend Draft UK Adequacy Decision
Posted on
Posted in European Union, Information Security
On May 11, 2021, the European Parliament issued a press release requesting that the European Commission amend its draft decisions on UK adequacy to more closely align with EU court rulings and the opinion of the European Data Protection Board. The request came after the Parliament’s Civil Liberties Committee passed a resolution evaluating the Commission’s approach regarding the adequacy of the UK’s data protection regime.
Continue Reading MEPs Urge European Commission to Amend Draft UK Adequacy Decision
Norwegian DPA Issues 2.5M EUR Preliminary Fine for U.S. Company Utilizing Web-Tracking IDs
Posted on
On May 2, 2021, the Norwegian data protection authority, Datatilsynet, notified a U.S. company of its intention to issue a fine of 25 million Norwegian Krone (approximately 2.5 million Euros). The preliminary fine was issued for failure to comply with the General Data Protection Regulation’s accountability, lawfulness and transparency requirements, primarily due to the company’s tracking of website visitors.
Continue Reading Norwegian DPA Issues 2.5M EUR Preliminary Fine for U.S. Company Utilizing Web-Tracking IDs
Court Authorizes FBI to Remove Web Shells from Compromised Microsoft Exchange Servers
Posted on
Posted in Cybersecurity, U.S. Federal Law
On April 13, 2021, the U.S. Department of Justice announced that the Federal Bureau of Investigation executed a court-authorized removal of malicious web shells from hundreds of vulnerable computers in the U.S. …
Continue Reading Court Authorizes FBI to Remove Web Shells from Compromised Microsoft Exchange Servers
NYDFS Settles with Mortgage Company for Data Breach
Posted on
The New York Department of Financial Services recently announced it had entered into a settlement with Residential Mortgage Services, Inc. related to allegations that the company violated the NYDFS Cybersecurity Regulation in connection with a 2019 data breach. …
Continue Reading NYDFS Settles with Mortgage Company for Data Breach
Florida Water Hack Shows Danger of Remote Access Vulnerabilities
Posted on
Posted in Security Breach
On February 8, 2021, Pinellas County, Florida officials announced that a hacker had remotely gained access to the City of Oldsmar’s water treatment system on two separate occasions and was able to change the setting for sodium hydroxide in the water supply. The incident highlights the danger to local government information systems and the dangers of remote access vulnerabilities.
Continue Reading Florida Water Hack Shows Danger of Remote Access Vulnerabilities