Boston Document Shredding, Office Paper Shredding, onsite Shredding, Drop Off Shredding

The Health Insurance Portability and Accountability Act (HIPAA) of 1996 ensures that healthcare organizations in the United States will be responsible for the secure electronic transmission of patient information and the safe storage and disposal of that information.

The HIPAA legislation has four primary objectives:

* Ensure health insurance portability by eliminating job lock due to pre-existing medical conditions
* Reduce healthcare fraud and abuse
* Enforce standards for health information
* Guarantee security and privacy of health information

HIPAA Penalties

HIPAA noncompliance can have devastating consequences. It opens you up not only to severe fines and penalties, but also to litigation and negative publicity. Noncompliance can result in the following:

* Civil fines of up to $25,000 a year
* Criminal penalties reaching $250,000 and up to 10 years in prison

Examples of items to shred due to HIPAA:

* Patient Medical Records
* Billing Records
* Prescriptions
* Insurance Records
* X-Rays
* Computer Disks
* Sign-In/Registration Forms
* Hard Drives

The Fair and Accurate Credit Transactions Act (FACTA) is a broad-sweeping consumer rights bill providing for:

* Notice of consumer rights
* Credit score explanations
* Methods for disputing inaccurate credit reports
* Notice of negative credit reports
* Medical information and consumer reports
* Nationwide specialty consumer reporting agencies
* Workplace investigations
* Information sharing among affiliates
* Opt-out for risk-based pricing
* Disposal of consumer information
* Penalties of FACTA violations
* Disposal of consumer information

A ruling issued in November 2004 from FACTA addresses the disposal of consumer information — name, address, SSN, credit information and data compiled from this information.

Any person who maintains or otherwise possesses consumer information for a business purpose — in electronic or paper must "take reasonable measures to protect against unauthorized access or use of the information in connection with its disposal." FACTA requires disposal to be done properly — burning, pulverizing or shredding.
Violations of FACTA

If you are found noncompliant, you could be vulnerable to severe fines and even subject to class-action lawsuits, including:

* Civil Liability — Actual damages sustained if identity is stolen as a result of corporate inaction, or statutory damages up to $1,000 per employee.
* Class-Action Lawsuits — If large numbers of employees are affected, they may be able to bring class-action suits and get punitive damages from employers.
* Federal Fines — Up to $2,500 for each violation.
* State Fines — Up to $1,000 for each violation.

The Economic Espionage Act (EEA) is a very powerful law that helps with the enforcement of properly handling information. This is the first federal law that defines and severely punishes misappropriation and theft of trade secrets.

However, according to this act, the government will protect only companies that take "reasonable measures" to safeguard their information.
EEA Violations

A defendant convicted for theft of trade secrets under Section 1832 (which makes the commercial theft of trade secrets a criminal act regardless of who benefits) can be imprisoned for up to 10 years and fined $500,000.

Corporations and other establishments can be fined up to $5 million.

Gramm-Leach-Bliley (GLB) requires banking and financial institutions across the United States to describe how they will protect the confidentiality and security of consumer information.
Violations of GLB

If you are found noncompliant, you could be vulnerable to severe fines and even subject to class-action lawsuits. Noncompliance can result in the following:

* Institutions can be subjected to civil penalties of up to $100,000 for each violation.
* The officers and directors of the financial institution can be subject to, and personally liable for, a civil penalty of up to $10,000.
* Imprisonment for up to five years is possible.

National Institute of Standards and Technology (NIST)’s Computer Security Resource Center

SANS (SysAdmin, Audit, Network, Security) Institute’s Twenty Most Critical Internet Security Vulnerabilities

United States Computer Emergency Readiness Team (US-CERT)

Carnegie Mellon Software Engineering Institute’s CERT Coordination Center

Center for Internet Security (CIS)

The Open Web Application Security Project

National Association For Information Destruction

International Shipping

US Mail Forwarding Service