Where the law and cybersecurity intersect By Gene Marrano
Don’t think of having an attorney in the mix when considering data privacy concerns for your business? Think again. Christen Church, an attorney with the Gentry Locke office in Roanoke, says they often get involved with Data Privacy and Cybersecurity issues, depending on the nature of the business and the type of information that needs to be protected: “what obligations do the recipients of that data have to protect it, to treat it confidentially and to limit … access to it?” I.e., Credit card information, financial or personal health details. One issue – the United States has not approached data privacy on a national, “holistic basis,” meaning it can be an industry and state specific hodge-podge of guidelines, says Church. Most are familiar with HIPAA – the national
Submitted
Christen Church
12
t AUGUST 2021 / vbFRONT.com
standard for health care information privacy, but notes Church, most states have their “own flavor” on adherence to that standard, and who can have access to that data. Ditto for financial information disclosure. That also means companies based in one state have to know the laws if they conduct business elsewhere. Privacy breaches and any liability would be based “on where the harm would be felt,” by the consumer, notes Church, who has a focus on health care business clients. Attorneys become involved she says when a business is developing a data security plan and they want to know what their obligations are to keep that information safe and away from prying eyes. Development of an Incident Response Plan is in order, since even with the best of intentions, notes Church, the most security and top-flight training, “something could happen. We need to be prepared for that.” Collaborating with clients on reporting/legal obligations when there is a breach is another focus for Gentry Locke in the Data Privacy & Cybersecurity realm. Being prepared ahead of a security issue is the best way to go, adds Church. Making sure your IT vendors are not corrupted where there is a malware issue, that they can get you back online quickly and safely. “You want to have that relationship ahead of time.” There is also cybersecurity insurance, which has “come a long way,” and Church says Gentry Locke will examine those policies for clients. “You really have to dig in to see what the coverage is. Kind of a wellness check … to help prepare for an event.” In many cases the biggest
