Data Security Compliance

As new threats continue to present themselves, the data security landscape is constantly changing. Our federal data security compliance lawyers have the experience and insights your business needs to mitigate its risk of a breach and avoid substantial federal penalties for non-compliance.

Companies of all sizes and across all industries need to be concerned about data security. Whether your server (or your cloud provider’s servers) house customers’ or patients’ personal information or you need to protect your company’s own sensitive and proprietary data, failing to place adequate emphasis on data security can lead to sudden, substantial, and perhaps irreparable harm.

Not only is data security important from the perspective of protecting the sensitive information that your business possesses, but it is important from the perspective of federal compliance. Corporations professional practices, and other businesses that fail to adequately protect consumer data can face substantial penalties. What is “adequate” is not clear-cut, and different entities can have different obligations based on factors ranging from the type of information they possess to the size and geographic scope of their business operations. Add in the fact that new threats continue to present themselves on a nearly-daily basis, and maintaining compliance suddenly becomes a formidable burden.

Federal Compliance Lawyers Experienced in Complex Data Security Matters

Our federal compliance lawyers represent clients with respect to all aspects of data protection and statutory and regulatory compliance. We serve clients ranging from individual doctor’s offices to international corporations, and we provide services ranging from compliance program development and implementation to breach response and notification compliance.

The regulatory landscape for data security compliance is extraordinarily complicated – even small business can be subject to myriad compliance obligations at the state, federal, and international levels. As regulators continue to become more sophisticated in their digital monitoring and enforcement efforts, businesses of all sizes are increasingly facing compliance audits and investigations. At Oberheiden, P.C., not only can we help you protect your business’ and customers’ or patients’ sensitive information, but we can thoroughly document your data security efforts to proactively demonstrate compliance in the event of a federal inquiry as well.

What Does it Take to Be Compliant with Regard to Data Security?

With regard to compliance, state, federal, and international laws and regulations generally focus on the protection of consumer data. At the federal level in the United States, the regulatory obligations piecemeal. Companies can potentially be subject to a host of statutory and regulatory obligations depending on the sectors in which they operate and the types of information they collect. For example, federal statues with data security compliance implications include (but are by no means limited to):

• Cable Communications Policy Act (CCPA)
• Children’s Online Privacy Protection Act (COPPA)
• Driver’s Privacy Protection Act (DPPA)
• Federal Trade Commission Act (FTCA)
• Gramm-Leach-Bliley Act (GLBA)
• Health Insurance Portability and Accountability Act (HIPAA)

State laws can impact companies’ data security compliance obligations on a nationwide scale as well. As summarized by the National Conference of State Legislatures (NCSL):

“At least 25 states have laws that address data security practices of private sector entities. Most of these data security laws require businesses that own, license, or maintain personal information about a resident of that state to implement and maintain ‘reasonable security procedures and practices’ appropriate to the nature of the information and to protect the personal information from unauthorized access, destruction, use, modification, or disclosure.”

As also noted by the NCSL, the number of states with data security laws has doubled since 2016, and this trend toward state-level data security protection enforcement is likely to continue for the forseeable future. Since state laws typically apply to any entities that have access to information about in-state residents, companies will often be forced to comply with multiple states’ laws in addition to maintaining federal and international compliance.

At the international level, the most-significant concerns for businesses that use and store personally identifying information (PII) arise under the European Union’s recently-enacted General Data Protection Regulation (GDPR). The GDPR requires companies to adopt extensive policies and protections to ensure the security of EU residents’ PII, and the costs of non-compliance can be substantial. While many US-based businesses do not face substantial compliance burdens under the GDPR (particularly businesses such as healthcare providers that only target and serve customers and patients domestically), for companies that are subject to the GDPR, ensuring compliance needs to be a consistent priority.

How We Help Businesses and Professional Practices Establish and Maintain Data Security Compliance

Our firm’s data security compliance services include providing advice and representation for identifying risks, establishing compliance policies and procedures, maintaining compliance on an ongoing basis, and responding to actual and potential security breaches. As with all aspects of our corporate compliance representation, we work closely with our clients’ executive leaders, in-house counsel, and key stakeholders to develop custom-tailored compliance solutions.

We serve our clients with respect to all aspects of data privacy and security compliance at the state, federal, and international levels. This includes (but is not limited to) providing assistance with:

• Patient health information privacy and security
• Consumer data privacy and security
• Financial information and transaction data privacy and security
• Employee data privacy and security
• Corporate data and proprietary information security
• Governing contracting data privacy and security compliance

Due to the varying applicability of state, federal, and international data security laws and regulations as well as the specific demands of different businesses operating within different industries, no two data security compliance programs will ever be alike. In today’s world, while there are industry standards, there is simply no such thing as a “standard” data security compliance program. In order to ensure that we are thoroughly meeting our clients’ unique needs, our federal compliance lawyers provide services including:

• Initial Needs Assessment – In order to determine what data security measures are necessary, it is first necessary to determine the nature and extent of the information within your business’s or practice’s custody or control. We will carefully assess your company’s compliance needs so that we can tailor the rest of our services accordingly.
• Documentation of Policies and Procedures – With a clear understanding of your business’s or practice’s compliance needs, we can develop customized policies and procedures designed to provide the tools your business needs to achieve compliance at the state, federal, and international levels (as applicable).
• Service Provider Contracting – As a general principle, companies cannot avoid the consequences of non-compliance by delegating responsibility to third-party service providers. Our attorneys can negotiate critical protections into your IT service agreements and other relevant contracts to ensure adequate protection.
• Consumer and Patient Terms of Sale and Service – Our attorneys can also draft appropriate terms of sale and service for use with your business’s or practice’s customers or patients. While waivers of consumer rights are often unenforceable (and can potentially get companies into trouble), there are appropriate protections that can be utilized to substantially mitigate companies’ risk of liability.
• Website and Social Media Compliance – Websites and social media are often overlooked when it comes to data privacy and security. However, violations involving websites and social media are often the most public, and they can lead to the most immediate and irreparable consequences as a result. Our federal compliance lawyers can help ensure that your company’s online presence is not a liability.
• Employee Training, Enforcement, and Discipline – A data security compliance program will only be impactful if it is implemented effectively. This involves conducting initial and ongoing employee training as well as adopting appropriate measures to enforce compliance and discipline employees who put the company at risk due to compliance violations.
• Ongoing Compliance Auditing and Needs Assessments – Once a data security compliance program has been implemented, regular audits and monitoring can help ensure compliance and prevent potential issues from triggering substantial exposure. Businesses and professional practices must continually re-assess their needs as well as new regulations and threats emerge.
• Stress Testing of Data Security Programs and Protocols – Are your company’s logical security measures as strong as they need to be? Our attorneys can assist with stress testing of data security programs and protocols and provide recommendations for remedying any potential exposure risks.
• General Data Security Compliance Counseling – When questions and potential issues arise in the realm of data privacy and security, companies often do not have time to wait. Our federal compliance lawyers are available 24/7 to provide general data security compliance counseling on an as-needed basis.
• Interaction with State, Federal, and International Authorities – If your business or practice is contacted by the Federal Trade Commission (FTC), Consumer Financial Protection Bureau (CFPB), Department of Justice (DOJ), Federal Bureau of Investigation (FBI), or any other agency or authority with regard to a potential data security or privacy issue, our attorneys can deal with the authorities on your company’s behalf.

Speak with a Data Security Compliance Lawyer at Oberheiden, P.C.

Do you have questions about your business’s or professional practice’s data security and privacy obligations? To speak with one of our federal compliance lawyers in confidence, call us at 888-680-1745 or request a confidential initial consultation online today.