By:
On:
In: *Connecting the Dots Blog*, Information Privacy, Information Security, Legal, Regulatory Compliance, Risk Management

  Dissemination vs. Implementation The Veterans Affairs Department recently announced they will be publishing monthly online accounts of data breaches and lost BlackBerrys and laptops in order to improve accountability and increase transparency. What was shocking to me was that from April through July of this year, the VA has lost 72 BlackBerrys and 34 laptops.  Patient information has been sent to the wrong address or mailed incorrectly 441 times.  There were 9,746 breach incidents involving notifications to patients and 2,501 incidents in which credit reporting was required. Almost 10,000 breach incidents in 3 months!  What is wrong with this picture?  Instead of just disseminatingRead More →

By:
On:
In: *Connecting the Dots Blog*, Human Resources, Incident Reporting, Information Privacy, Information Security, Regulatory Compliance, Risk Management

In case you didn’t notice among all the TARP and Stimulus Bill news…the Veterans Affairs Department has agreed to pay $20M to settle a lawsuit filed by veterans due to a VA laptop containing sensitive information stolen in 2006.  (Before I go any further, I want to be clear that I completely support veterans receiving compensation for out-of-pocket expenses that resulted from the computer theft, credit monitoring to protect against identity loss and medical expenses that were the result of severe emotional distress.) So how is “customized knowledge” and “individual-level accountability” worth at least $20M of your and my money (tax payer dollars)? For starters,Read More →