The issue of not knowing what data a company has often arises in the context of mergers and acquisitions, particularly among those businesses that acquire smaller ones. (Photo: LeoWolfert/ Shutterstock.com)
When it comes to an awareness of what data they have and where it resides, health care organizations may suffer from overconfidence, despite experiencing the second-largest amount of cybersecurity breaches, suggests a new study on data privacy management within the industry.
Seventy percent of the survey respondents—made up of 258 top business executives and information technology decision makers within mid- to large-size U.S. companies—reported that they were “very confident” or “extremely confident” in knowing exactly where sensitive data resides. However, only half of the respondents said they update their inventory of personal data once a year or less.
“Because of the massive volume of data that people are dealing with, you really need to use technology to crawl that data to understand what's there,” Kristina Bergman, CEO and founder of data privacy automation provider Integris Software Inc., said in an interview. Then “companies can actively assess their risk and proactively make decisions about how to manage the data.”
The Seattle-based company conducted the survey, which it dubbed the Integris Software 2019 Healthcare Data and Privacy Maturity study.
The issue of not knowing what data a company has often arises in the context of mergers and acquisitions, particularly among those businesses that acquire smaller ones, and in the case of data transfer agreements, especially with credit card processors or third parties, Bergman said, adding that the oversight generally is not negligent.
“The reality is that the people who are negotiating those agreements, the lawyers and [business representatives], are not the same people who are opening up the pipes and transferring the data,” she said. “The IT people aren't reading and checking the contract.”
To help remedy this unawareness, Bergman suggests continuously and automatically monitoring and mapping the sensitive data that companies collect and store across locations.
“It is good to know immediately, which will catch things before they become issues,” she said.
Other findings from the survey include:
- Respondents were much more confident in their own ability to respect data-sharing agreements than their partners' ability to reciprocate in kind, with a nearly 61 percent increase in “very confident” and “extremely confident” levels in their own compliance efforts versus their partners.
- The health care industry is better prepared for security compliance mandates than other industries, with 35 percent scoring themselves as “fully prepared” for the European Union's General Data Protection Regulation, though only 16 percent said they were “fully prepared” for the California Consumer Privacy Act.
- Organizations are using several types of tools to discover and track the location of personal information, including surveys and spreadsheets, metadata management and data catalog.
Read more:
Complete your profile to continue reading and get FREE access to BenefitsPRO, part of your ALM digital membership.
Your access to unlimited BenefitsPRO content isn’t changing.
Once you are an ALM digital member, you’ll receive:
- Breaking benefits news and analysis, on-site and via our newsletters and custom alerts
- Educational webcasts, white papers, and ebooks from industry thought leaders
- Critical converage of the property casualty insurance and financial advisory markets on our other ALM sites, PropertyCasualty360 and ThinkAdvisor
Already have an account? Sign In Now
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
Kristen Rasmussen
Kristen Rasmussen is an Atlanta-based reporter who covers corporate law departments and in-house attorneys.
