====== 2-607 ======

58 Privacy and Security Developments in the Workplace (March 6, 2015)

Joseph J. Lazzarotti

Jackson Lewis P.C.

If you find this article helpful, you can learn more about the subject by going to www.pli.eduto view the on demand program or segment for which it was written.

====== 2-609 ======

Last year, we addressed a wide range of workplace-related risks as companies look to harness the power of the digital age. We recognized that for most employers, employee privacy and data security considerations are changing rapidly, almost daily. Here, we touch on a couple of important developments and emerging issues for human resources professionals, as well as delving a bit into a critical best practice for workplace privacy and security – training.

In short, this article will briefly discuss:

•	the growing presence of “big data” and analytics in the workplace
•	a recent development in California that will help all businesses and employers better understand what it means to have “reasonable safeguards” for protecting personal information.
•	that privacy and data security training for employees is not just a prudent business practice, but very often a legal requirement.

“Big Data” in the Workplace

Earlier this year, the Federal Trade Commission (“FTC”) issued a report discussing “big data.”¹ The report compiles the agency’s learning from recent seminars and research, including a public workshop held on September 15, 2014. Known best for its role as the federal government’s consumer protection watchdog, the FTC highlights in the report a number of concerns about uses of big data and the potential harms they may have on consumers. However, while the report’s focus is on the commercial use of big data involving consumer data, it also describes a number of issues raised when big data is employed in the workplace.

Used in the human resources context, big data has many useful applications such as helping companies to better select and manage applicants and employees. The FTC’s report describes a study which shows that “people who fill out online job applications using browsers that did not come with the computer . . . but had to be deliberately installed (like Firefox or Google’s Chrome) perform better and change jobs less often.” Applying this correlation in the hiring process can result in the employer rejecting candidates not because of factors that are job-related, but

====== 2-610 ======

because they use a particular browser. Whether this would produce the best results for the company is unclear.

Likely spurred at least in part by comments made by EEOC counsel at the FTC’s big data workshop in September 2014, the FTC’s report summarizes the potential ways that using “big data” tools can violate existing employment laws, such as Title VII of the Civil Rights Act of 1964, the Age Discrimination in Employment Act, the American with Disabilities Act and the Genetic Information Nondiscrimination Act. The report also includes a brief discussion of “disparate treatment” or “disparate impact” theories, concepts familiar to many employers.

According to the report, facially neutral policies or practices that have a disproportionate adverse effect or impact on a protected class create a disparate impact, unless those practices or policies further a legitimate business need that cannot reasonably be achieved by means that are less disparate in their impact. Consider the application above. Use of a particular browser seems to be facially neutral, but some might argue that selection results based on that correlation can have a disparate impact on certain protected classes. Of course, as the FTC report notes with regard to other uses of big data – a fact-specific analysis will be necessary to determine whether a practice causes a disparate impact that violates law.

Two other concerns discussed in the FTC’s report that have workplace implications include:

•

Biases in the underlying data. Big data is about the collection, compilation and analysis of massive amounts of data. If hidden biases exist in these stages of the process, “then some statistical relationships revealed by that data could perpetuate those biases.” Yes, this means “garbage in, garbage out.” The report provides a helpful example: a company’s big data algorithm only considers applicants from “top tier” colleges to help them make hiring decisions. That company may be incorporating previous biases in college admission decisions. Thus, it is critical to understand existing biases in data as they could undermine the usefulness of the end results.

•

Unexpectedly learning sensitive information. Employers using big data can inadvertently come into possession of sensitive personal information. The report describes a study which combined data on Facebook “Likes” and limited survey information to determine that researchers could accurately predict a male user’s sexual orientation 88 percent of the time, a user’s ethnic origin 95 percent of time, and whether a user was Christian or Muslim 82 percent of the time. Clearly, exposure to this information could expose an employer to

====== 2-611 ======

claims that its hiring decisions were based on this information, and not other legitimate factors.

Companies can maximize the benefits and minimize the risks of big data, according to the FTC report, by asking the following questions:

•	How representative is your data set?
•	Does your data model account for biases?
•	How accurate are your predictions based on big data?
•	Does your reliance on big data raise ethical or fairness concerns?

There certainly is much to consider before using big data technology in the workplace, or for commercial purposes. As big data applications become more widespread and cost efficient, employers may appropriately feel the need to leverage the technology to remain competitive. They will need to proceed cautiously, however, and understand the technology, the data collected and whether the correlations work and work ethically.

California Sheds More Light on the Meaning of “Reasonable Safeguards” for Protecting Personal Data ²

In February, California Attorney General, Kamala D. Harris – who has been mentioned as a potential nominee to fill Justice Antonin Scalia’s recently vacated seat on the U.S. Supreme Court – issued the California Data Breach Report (Report)³. The Report provides an analysis of the data breaches reported to the California AG from 2012-2015.

But perhaps the most consequential part of the Report for businesses is that it establishes a floor of controls that must be in place for a business to be considered to have adopted “reasonable safeguards” to protect personal information. Other states have a “reasonable safeguards” requirement, but have not provided further guidance concerning that standard. California’s adoption of the Center for Internet Security’s Critical Security Controls (The Controls) may provide multistate employers a path to achieving a greater comfort level in the protections they have (or need to have) in place for employment-related personal information.

====== 2-612 ======

The Report details that nearly 50 million records of Californians have been breached and the majority of these breaches resulted from security failures. In fact, the Report explains that nearly all of the exploited vulnerabilities, which enabled the breaches, were compromised more than a year after the solution to address the vulnerability was publicly available. According to Ms. Harris, “It is clear that many organizations need to sharpen their security skills, trainings, practices, and procedures to properly protect consumers.”

Malware and hacking, physical breaches, and breaches caused by error have been the three most common types of breaches. Of the three, malware and hacking have been by far the largest source of data breaches, with 90% of all records breached by means of malware and hacking. Physical breaches, resulting from the theft or loss of unencrypted data on electronic devices, were next most common, with heath care entities and small businesses most heavily impacted. Breaches caused by error – such as mis-delivery of email and inadvertent exposure of information on the public Internet – ranked third. Government entities made half of all such errors.

Under California law, “A business that owns, licenses, or maintains personal information about a California resident shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.” ⁴ This requirement is important as the Report specifically states an organization’s failure to implement all of the 20 controls set forth in the Center for Internet Security’s Critical Security Controls (The Controls) constitutes a lack of reasonable security.

The Controls are set out in the table below:

CSC 1	Inventory of Authorized and Unauthorized Devices
CSC 2	Inventory of Authorized and Unauthorized Software
CSC 3	Secure configurations for Hardware and Software on Mobile Devices, Laptops, Workstations and Servers
CSC 4	Continuous Vulnerability Assessment and Remediation
CSC 5	Controlled Use of Administrative Privileges
====== 2-613 ======
CSC 6	Maintenance, Monitoring, and Analysis of Audit Logs
CSC 7	Email and Web Browser Protection
CSC 8	Malware Defenses
CSC 9	Limitation and Control of Network Ports, Protocols, and Services
CSC 10	Data Recovery Capability
CSC 11	Secure Configurations for Network Devices such as Firewalls, Routers, and Switches
CSC 12	Boundary Defense
CSC 13	Data Protection
CSC 14	Controlled Access Based on the Need to Know
CSC 15	Wireless Access Control
CSC 16	Account monitoring and Control
CSC 17	Security Skills Assessment and Appropriate Training to Fill Gaps
CSC 18	Application Software Security
CSC 19	Incident Response and Management
CSC 20	Penetration Tests and Red Team Exercises

The Report goes on to discuss numerous findings about breach types, data types, and industry sectors impacted. It concludes with five recommendations at stemming the tide of these breaches:

1.	*Reasonable Security*: Implement The Controls which are viewed by the State’s Attorney General as a minimum level of information security.
2.	*Multi-Factor Authentication. Organizations should make multi-factor authentication available on consumer-facing online accounts that contain sensitive personal information. This stronger procedure ====== 2-614* ====== would provide greater protection than just the username-and-password combination for personal accounts such as online shopping accounts, health care websites and patient portals, and web-based email accounts. The same is true for employment-based portals.
3.	*Encryption of Data in Transit*. Organizations should consistently use strong encryption to protect personal information on laptops and other portable devices, and should consider it for desktop computers.
4.	*Fraud Alerts*. Organizations should encourage individuals affected by a breach of Social Security numbers or driver’s license numbers to place a fraud alert on their credit files and make this option very prominent in their breach notices. This measure is free, fast, and effective in preventing identity thieves from opening new credit accounts.
5.	*Harmonizing State Breach Laws*. State policy makers should collaborate to harmonize state breach laws on some key dimensions. Such an effort could reduce the compliance burden for companies, while preserving innovation, maintaining consumer protections, and retaining jurisdictional expertise.

While the Report, and California’s existing law, are focused on protecting the personal information of California residents, it is important to remember California has continuously been at the forefront of data security legislation. In fact, California was the first state to enact a data breach notification law in 2003, and since that time 46 other states have followed suit. As such, it would not be surprising if other states consider the recommendations in the Report, in particular the minimum standards for reasonable safeguards, and implement similar requirements.

Employee Privacy and Data Security Training: A Legal Requirement and Prudent Business Practice

Many executives may be surprised to learn that one of the most frequent causes of data breaches is employee error, and not just employees in the IT department. The types of information involved in breaches go beyond payment cards, Social Security numbers and patient medical information, and can include valuable proprietary or trade secret information; privileged or financial data belonging to employees, clients and customers; and sensitive internal email communications. Every day mishaps like failing to lock a door, using the wrong email address, forgetting a device on a plane, forwarding the wrong attachment, or not knowing who is authorized to access data can have catastrophic consequences for a business.

====== 2-615 ======

While various safeguards may minimize employee error, employee training is essential in preventing data breaches. In certain industries, training may be required by law, but even if not required by a statute, data security training likely would be considered a reasonable safeguard for businesses required to protect certain data. Additionally, businesses in various industries increasingly are being required by contract, including government contracts, to conduct data security training. Finally, given the vast amounts of readily accessible data, it is a prudent business practice to train employees about the company’s policies and best practices concerning information confidentiality, privacy and security.

Is employee error really a problem?

Yes. Looking back at our own experience as a practice group, having handled hundreds of data incidents and breaches, employee error is easily the most frequent cause. A number of reports and surveys also indicate that employee error is a key reason why companies are experiencing damaging losses of data.

Late last year, the Wall Street Journal ⁵ reported on a survey by the Association for Corporate Counsel that found “employee error” is the most common reason for a data breach. CSO Online reported⁶ on Experian’s 2015 Second Annual Data Breach Industry Forecast, stating, “Employees and negligence are the leading cause of security incidents but remain the least reported issue.” According to Kroll⁷, in 31% of the data breach cases it reviewed in 2014, the cause of the breach was a simple, non-malicious mistake. These incidents were not limited to electronic data – about one in four involved paper or other nonelectronic data.

When people think about data breaches, they tend think more about the illegal hacking into computer networks by individuals, criminal enterprises or even nation states, than they do about employee error. This makes some sense as hacking incidents seem to draw intense media focus and capture the public’s attention. This misconception

====== 2-616 ======

leads to a false sense of security. Individuals erroneously believe that their organization is less likely to experience a data breach because it is not likely to be the target of a hack. Consequently, individuals significantly underestimate the risk of a data breach caused by employee error. An example of employee error mentioned in the ACC survey – “accidently sending an email with sensitive information to someone outside the company” – is something most business either have heard about or experienced.

Even if that is true, do we have a legal requirement to train employees?

For many businesses, the answer is yes, but it will depend on the kind of business, where it is located and the type of data the business maintains. Here are some examples:

•

Healthcare providers, health plans and business associates. Certain health care providers and health plans, and their business associates are subject to the privacy and security regulations under the Health Insurance Portability and Accountability Act (HIPAA). The HIPAA privacy regulations require that:

“covered entities must train all members of its workforce…as necessary and appropriate for the members of the workforce to carry out their functions.”⁸

The HIPAA security regulations require covered entities to:

“[i]mplement a security awareness and training program for all members of its workforce [including management]”⁹

So, all covered healthcare providers such as, hospitals, physician practices, dental offices, nursing homes, and home healthcare providers, have a regulatory requirement to train their workforce members. These requirements also apply to business associates of these covered entities including, accounting firms, consultants, brokers, law firms, and medical billing companies.

The training requirement also extends to certain employer-sponsored group health plans. Many employers sponsor some form of a self-funded health plan, such as a self-funded plan that meets the minimum value requirements for purposes of the Affordable Care Act, or a health flexible spending arrangement. Employees

====== 2-617 ======

who handle protected health information in the course of administering these plans must be trained.

•

Financial Institutions. As one of the most heavily regulated industries in the United States and globally, financial services organizations are subject to a wide range of data privacy and security requirements given the critical nature of the data they use, receive, maintain and disclose. These requirements include employee training:

Safeguards Rule. Under the Gramm-Leach-Bliley Act (“GLBA”) and pursuant to regulations issued by the Federal Trade Commission (“FTC”), certain financial institutions are required to develop administrative, technical, and physical safeguards to protect customer information (known as the “Safeguards Rule). Financial institutions generally include organizations such as lenders, financial advisors, loan brokers and servicers, collection agencies, tax preparers, and real estate settlement services that have customer information, whether collected from their own customers, or received from other financial institutions.

Section 314.4 of the Safeguards Rule requires financial institutions to assess and address the risks to customer information in all areas of their operations, including employee management and training. FTC guidance for compliance with the Safeguards Rule lists a number of steps financial institutions should take, including “[t]raining employees to take basic steps to maintain the security, confidentiality, and integrity of customer information.”

Red Flags Rule. The Fair and Accurate Credit Transactions Act (“FACT Act”) requires certain federal agencies to direct financial institutions and creditors to do more to detect, prevent, and mitigate identity theft. These rules apply to a broad list of businesses - “financial institutions” and “creditors” with “covered accounts”. For example, a “creditor” is defined non-exhaustively to include “lenders such as banks, finance companies, automobile dealers, mortgage brokers, utility companies and telecommunications companies”. And, covered accounts include any account for which there is a foreseeable risk of identity theft.

The set of rules that followed became known as the “Red Flags” rule, which requires these covered entities to adopt programs designed to detect, prevent, and mitigate identity theft. To administer the program in compliance with the regulation, the

====== 2-618 ======

organization must “[t]rain staff, as necessary, to effectively implement the Program.” See, e.g., 16 CFR § 681.2(e)(3).

FDIC Guidelines. The Federal Deposit Insurance Corporation (FDIC) applies the Interagency Guidelines Establishing Information Security Standards (Guidelines) that provide standards for developing and implementing administrative, technical, and physical safeguards to protect the security, confidentiality, and integrity of customer information. The Guidelines apply to depository institutions insured by the FDIC, such as banks, state savings associations, insured state branches of foreign banks, and any subsidiaries of such entities (other than brokers, dealers, persons providing insurance, investment companies, and investment advisers). Under these Guidelines, each institution shall, “[t]rain staff to implement the bank’s information security program.”

Regulation S-P. GLBA also directed the Securities and Exchange Commission to establish appropriate standards to protect customer information. These rules, known as Regulation S-P, apply to investment advisers registered with the Commission, brokers, dealers, and investment companies subject to the Commission’s jurisdiction. Under these rules, these entities “must adopt policies and procedures that address administrative, technical, and physical safeguards for the protection of customer records and information…reasonably designed to:

Insure the security and confidentiality of customer records and information;

Protect against any anticipated threats or hazards to the security or integrity of customer records and information; and

Protect against unauthorized access to or use of customer records or information that could result in substantial harm or inconvenience to any customer.

In Notice 05-49, the National Association of Securities Dealers (NASD) (now known as the Financial Industry Regulatory Authority, or FINRA) reminded its members about the need to comply with Regulation S-P. It stated in part that although there is no “one-size-fits-all” policy or procedure to comply, members’ policies and procedures should “at a minimum” include: “providing adequate training to employees regarding the use of available technology and the steps employees should take to ensure that customer records and information are kept confidential.”

====== 2-619 ======

•

Federal Contractors. Under the Federal Information Security Management Act (FISMA) certain federal agencies are required to develop, document, and implement an agency-wide program to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source. Specifically, under 44 U.S.C. § 3544(b)(4):

Each agency shall develop, document, and implement an agency-wide information security program…to provide information security for the information and information systems that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source, that includes…security awareness training to inform personnel, including contractors and other users of information systems that support the operations and assets of the agency.

•

Educational Agencies and Institutions. In general, educational agencies and institutions receiving funding by the federal Department of Education must comply with the Family Educational Rights and Privacy Act (FERPA). The law and its implementing regulations address the rights parents and students have to students’ files at covered agencies and institutions. Questions concerning the right to access, modify or disclose student records can be challenging. Thus, training is a critical component for any privacy and security compliance program in this sector to ensure that a school’s administrators, faculty and staff members are complying with FERPA.

•

State Law Mandates. Although there is not yet a universally applicable federal data security statute in the United States, a number of states have required businesses and other entities operating in the state or maintaining personal information about state residents to have safeguards in place to protect that information. In some cases, training is an express requirement, in others states it is expected as a “reasonable safeguard.”

California. California’s information security statute (California Civil Code § 1798.81.5) provides that businesses that collect personal information on California residents must use “reasonable security procedures and practices appropriate to the nature of the information, to protect the personal information from unauthorized access, destruction, use, modification or disclosure.” Many wondered what are those “reasonable security procedures and practices.” A recent report by California’s Attorney General helps

====== 2-620 ======

to clarify this standard. In the report, Attorney General Kamala Harris states that the failure to comply with the 20 controls set forth in the Center for Internet Security’s Critical Security Controls “constitutes a lack of reasonable security.” One of those 20 controls is to provide security training to employees and vendors with access to systems containing personal information.

Massachusetts. Under comprehensive data security regulations that apply to businesses that maintain personal information of Massachusetts residents, businesses must maintain a written information security program (WISP). A WISP must include: “[e]ducation and training of employees on the proper use of the computer security system and the importance of personal information security.”¹⁰

Oregon. Oregon also requires certain businesses to maintain a WISP. The WISP must include administrative safeguards under which the business: “[t]rains and manages employees in the security program practices and procedures.”¹¹

Texas. In Texas, certain entities that engage in the practice of assembling, collecting, analyzing, using, evaluating, storing, or transmitting protected health information are subject to a set of HIPAA-like rules to protect that protected health information. Under that law, “[e]ach covered entity shall provide training to employees…necessary and appropriate for the employees to carry out the employees’ duties for the covered entity.”¹²

General Safeguard Requirements. Like California, a number of other states impose general requirements on businesses to safeguard the personal information they maintain. In general, those states require businesses to maintain “reasonable safeguards” to protect personal information of state residents. These states include, without limitation, Connecticut, Florida, and Maryland. Based on the express statutory requirements and other data security standards discussed above, any set of reasonable safeguards should include data security training for employees.

•

Payment Card Industry Data Security Standards (PCI DSS). Businesses that accept credit or debit cards as payment for goods and services will have certain obligations under PCI DSS standards. The major card brands (e.g., Visa, MasterCard, American

====== 2-621 ======

Express, Discover) maintain these standards, which are administered by the Payment Card Industry Security Standards Council. In October 2014, the Council published “Best Practices for Implementing a Security Awareness Program Concerning PCI DSS Requirement 12.6” which states:

[A] formal security awareness program must be in place…Security awareness should be conducted as an on-going program to ensure that training and knowledge is not just delivered as an annual activity, rather it is used to maintain a high level of security awareness on a daily basis.

Our Company does not maintain personal information, and our employee data is secure in our HR Department, so training does not seem necessary in our business

There are least two things wrong with this statement.

First, personal information is not the only information that a business might want to protect. Many companies maintain proprietary and confidential business information that, if shared outside the organization (or with the wrong people inside the organization), could cause it substantial harm. A company’s business partners and customers might obligate it to maintain safeguards to protect the information the business partner or customer shares with the company. Training might be expected to be included in these safeguards, and it may even be expressly stated in the services agreement.

Second, certain employee information is personal information and may be subject to some of the requirements outlined above. For example, the Massachusetts data security regulations apply to customer and employee personal information, and the California Attorney General’s report suggests a similar interpretation in that state. With the growing number of data breaches affecting employees and increasing concerns about privacy, federal and state agencies regulating employment practices seem to be moving in a direction of requiring greater security over employee data, which includes training. Consider the following statement from recent EEOC proposed regulations under the Americans with Disabilities Act concerning wellness programs:

Employers and wellness program providers must take steps to protect the confidentiality of employee medical information provided as part of an employee health program. Some of the following steps may be required by law; others may be best practices. Proper training of individuals who handle medical information in the requirements of the

====== 2-622 ======

HIPAA Rules, the ADA, and any other applicable privacy laws is critical.

What should a privacy and data security training program look like?

There are a myriad of ways to design a training program to create awareness and build a culture of privacy and security in an organization. Key issues organizations should consider when designing a training program:

•	*Who should design and implement the program?* If the organization has a privacy officer, this might be a good choice, but certainly not the only one. However, there should be an individual or department responsible to maintaining the program.
•	*Who should be trained?* In general, this should include workforce members with access to the information the organization desires to safeguard. Interns, volunteers, and other non-traditional categories of workers should not be excluded. However, even unauthorized employees may get access to that information, inadvertently perhaps, and may need to be made aware of certain company protocols, such as how to report a data breach.
•	*Who should conduct the training?* Organizations may conduct training in-house, outsource it, or a combination of both. When performed in-house, the person selected to deliver the training might depend on the information or safeguards being covered. For example, if the safeguards at issue relate to information obtained by call center representatives, the call center manager might be a good choice to deliver the training. It is not necessary, however, that a member of the IT, HR or Legal departments deliver the training, or that it be a person with technical IT knowledge. But, the ability to convey specific information about company requirements, legal mandates and use of technology to maximize security is certainly helpful.
•	*What should the training cover?* Again, the substance of the training will depend on the organization, the data at issue, the audience and other factors. In general, training should cover some basic issues, such as what is confidential or personal information, or what is a data breach. However, training programs can be significantly enhanced when they use real situations that participants in the program can relate to and apply in their jobs.

====== 2-623 ======
•	*When and How Often?* Basic privacy and security training should be provided before an individual obtains access to confidential or personal information. At a minimum, the principles should be conveyed at least annually thereafter. Training also may be needed after changes in policies; following increases in levels of access or sensitivity of information; to react to changes in technology; following a security incident and other situations, such as a merger or acquisition.
•	*How should training be delivered?* There are many ways to deliver a consistent message about data security throughout an organization. These include policies, notices, newsletters, intranet dashboard, in-person sessions, online courses, videos, testing, tabletop exercises, employee resource group (ERGs), or a combination of these. The ability for participants to interact and ask questions can be critically important for them to understand their responsibilities as they relate to the particular business.
•	*Should training be documented?* Yes. In some cases, such as under HIPAA, documentation is required. However, an organization will be in a much better position to defend its data privacy and security practices if it can show that it maintains a comprehensive training program. This generally means that the organization tracks the materials covered in the training and those who attended or received the information.

We did training, and employees still send the emails to wrong addresses and make other mistakes!

No system of safeguards is perfect, and that includes privacy and data security safeguards. Compliance is an ongoing process, and periodic data security training is an essential component of any organization’s data security compliance efforts. Through periodic training, organizations reinforce awareness regarding data privacy and take steps to manage risk, avoid litigation, and mitigate business exposure.

^1.	Big Data: A Tool for Inclusion or Exclusion? Understanding the Issues, Federal Trade Commission, January 2016. Available at https://www.ftc.gov/system/files/documents/reports/big-data-tool-inclusion-or-exclusion-understanding-issues/160106big-data-rpt.pdf.
^2.	This section was adapted from an article prepared by Jackson Lewis attorneys: Jason C. Gavejian, Principal, Morristown, NJ and Damon W. Silver, Associate, New York, NY.
^3.	California Data Breach Report, California Attorney General, Kamala D. Harris, February 2016. Available at https://oag.ca.gov/breachreport2016.
^4.	Cal. Civ. Code § 1798.81.5(b).
^5.	Nicole Hong, Employee Error Leading Cause of Data Breaches, New Survey Says, The Wall Street Journal Law Blog (Dec 9, 2015). Available at http://blogs.wsj.com/law/2015/12/09/employee-error-leading-cause-of-data-breaches-new-survey-says/.
^6.	Taylor Armerding, Healthcare breaches need a cure for human errors, CSO Online (Jan 19, 2015). Available at http://www.csoonline.com/article/2871215/data-breach/healthcare-breaches-need-a-cure-for-human-errors.html.
^7.	http://www.kroll.com/en-us/cyber-security/data-breach-prevention/cyber-risk-assessments/data-security-statistics.
^8.	HIPAA Privacy Rule § 164.530(b).
^9.	HIPAA Security Rule § 164.308(a)(5).
^10.	Data Security Reg. 201 CMR § 17.04(8).
^11.	ORS § 646A.622(d)(A)(iv).
^12.	Texas Health and Safety Code § 181.101.