Preparing for Data Privacy Compliance (2/2)

Continue from Preparing for Data Privacy Compliance (1/2)

The Health Insurance Portability and Accountability Act (HIPAA)

America’s “Privacy Rule” established a set of national standards for the protection of certain health information. The U.S. Department of Health and Human Services issues it as a requirement of the 1996 HIPAA.

It addresses the use and disclosure of individuals’ health information. One of the big achievements of the Privacy Rule is an assurance that individuals’ health information is properly protected. 

However, it allows for the flow of health information required to provide and promote high-quality healthcare and to protect the public's health and well-being. 

Violations of HIPAA often crop up because of these issues: 

• A lack of sufficient risk analyses
• Insufficient training about HIPAA amongst employees 
• Business Associate Agreements that are inadequate
• Inappropriate disclosures of Public Health Information (PHI)
• Ignorance about how to comply with the rules 
• Failure to report security breaches within the required time frame

The Payment Card Industry Data Security Standard (PCI DSS) 

This is a series of security standards. They’re there to make sure that any company that processes credit card information maintains a secure environment for related data. 

An independent body manages and administers the PCI DSS. The major payment card brands like Visa and MasterCard were behind this move. They are also responsible for enforcing compliance. Fines typically range from $5,000 to $100,000 per month for compliance violations. 

Although penalties are not widely publicized, they can be catastrophic for a small business. It is vital to be familiar with your merchant account agreement. It should outline your exposure to any related risks.

Brazil’s General Data Protection Law (LGPD) 

The LGPD has lots of similarities with the EU’s GDPR. In fact, companies already GDPR compliant will have already completed much of the work necessary to comply with the LGPD.

The LGPD’s aim is to help individuals have more control and rights over their personal data. At the same time, it tries to simplify the regulatory environment for international trade and business.

Any organization that processes the data of people in Brazil must abide by the LGPD. It doesn’t matter where it’s located. When the intent of the data is to promote the provision of goods or services to people in Brazil then companies must ensure they’re LGPD compliant.

The LGPD applies to businesses of any size. It requires organizations to appoint a Data Protection Officer (DPO), though this does not have to be an actual person. Companies can outsource the position to third parties like specialized companies or law firms. 

The LGPD is tougher than its European counterpart when there are data breaches. However, the fines for serious breaches can be less severe. The maximum is 2 percent of an entity’s revenue in Brazil, up to around 8 million dollars. 

Are You Well Enough Prepared for Data Privacy Compliance?

The range of data protection laws that companies have to comply with can be daunting. The list of regulations is only likely to grow in the future. On top of that, it is likely that amendments to all these laws will happen over time.

Ensuring you and your business achieve data compliance is time-consuming and has a measurable cost. 

One way you can mitigate some of the risks around data compliance is to use iDox.ai. 

Our services are there to help businesses ensure the documents they store are compliant. Get in touch with us now to find out why you should make iDox.ai your data compliance solution.