Australia's government agencies can learn a lot from the nation's banks, when it comes to risk management and protecting privacy, says Graham Ingram, General Manager of the Australian Computer Emergency Response Team. "There are too many people in government organisations who are in denial [of risks]," he says.
In the second major HIPAA enforcement action announced by federal authorities this week, Massachusetts General Hospital and its physicians organization have entered into a resolution agreement that calls for paying a $1 million settlement and taking corrective action to avoid future violations.
The owner of four clinics in Maryland has been fined $4.3 million for HIPAA privacy rule violations that involved failing to provide 41 patients with access to their medical records and then failing to cooperate with federal investigators.
Securing data in the public cloud isn't much different from other types of IT security. "It's the same advice we give for almost any deployment of IT because it is still the right thing to do," NIST Senior Computer Scientist Tim Grance says.
When a database breach occurs, consumer notification continues to be a public problem, and it's time for the federal government to step in, says Linda Foley, co-founder of the non-profit Identity Theft Resource Center.
Fraud attempts will escalate, not diminish, as new threats and channels blossom in 2011. Growth in mobile banking and the use of social networks are expected to pose new security challenges, experts say.