It was two close calls that changed how Rob Israel thought about encrypting the data on his users’ laptops.
A few years ago, a laptop at the John C. Lincoln Health System, a Phoenix-area hospital group where Israel is CIO, was stolen from an employee’s office. It could have contained financial or (worse) patient information but, fortunately for Israel, “The laptop was brand-new and had no data on it yet,” he says. Still, this pilfery and an earlier PC theft from a common work area (which resulted in a loss of noncritical data) pushed him to revisit his company’s security strategy.
The result: Lincoln Health avoids storing data locally on users’ computers — PCs and laptops.
In today’s workplace, it’s impossible to eliminate mobile computing devices — laptops, thumb drives, mobile phones, PDAs and iPods. If you follow the news, you know that dozens of organizations have had mobile devices lost or stolen, and many of them were not as lucky as Lincoln Health. Since California enacted a data breach notification law in 2002 (followed by 32 other states), there have been a host of embarrassing disclosures about missing computers, most recently at the U.S. Department of Veterans Affairs, the Federal Trade Commission, the Transportation Department, accounting firms Deloitte & Touche and Ernst & Young (three separate occasions this year), Wells Fargo and ING banks, Fidelity Investments, the YMCA and Chevron.
About half of the states’ breach-reporting laws give companies a way to avoid disclosing such breaches: the use of encryption on the mobile devices. The other states’ breach laws encourage the use of encryption, as do other privacy protection laws such as the federal Gramm-Leach-Bliley Act covering financial information, and the Health Insurance Portability and Accountability Act (HIPAA) covering medical information. Avoiding both the breach penalties and the other costs of losing critical data makes an encryption strategy well worth the effort, says Tim Mc
