A annual study conducted by the Ponemon Institute showed that the geographic location can dictate the cost of a breach with the main factors being the type or nature of threat as well as the policies and laws enforced within the country.

The report analyzed 277 companies who had experienced a data breach in 9 different countries (all currencies were converted into US dollars). The three main causes were:

1. In the study, malicious attacks accounted for more than 37% of security breaches in 2012.
2. Negligent employees and contractors mishandling confidential data accounted for 35% of data breaches.
3. Systems glitches such as application failures, inadvertent data dumps, errors in data transfer and authentication failures accounted for 29% of data breaches.

They found that the highest costs associated with these data breaches were found in the U.S. ($277) and Germany ($214) while the lowest financial impact occurred in Brazil ($71) and India ($42).

No matter where your business is located, follow these best practices to reduce the risk of information breaches:

• Create strong information security policies and procedures.
• Train employees about the proper handling of confidential information.
• Provide the right IT (data loss, encryption solutions, etc.) to protect sensitive data.  
• Work closely with trusted business partners when choosing a security partner

Of course, managing and protecting data, especially sensitive data, is critical in all workplaces. Recent research shows that organizations experience about one fraud event per week.

The cost of a data breach includes the time spent dealing with it, damage to the firm’s reputation, the possibility of identity theft, and there may be fines.

The average dollar cost has actually been pegged at $194 per lost or stolen record and $5.5 per security breach incident, according to the 2011 Cost of Data Breach Study by Symantec Corp. and Ponemon. 

So how do you prevent data breaches from occurring in the first place? Implement sound information security policies and procedures:   

• Designate a Chief Information Security Officer (CISO) – research has shown this can reduce the cost of a data breach by 35% per compromised record.
• Form a data security team with members from key departments such as information technology, compliance, human resources, legal, and communications.
• Maintain a running inventory of all information that needs to be protected.
• Schedule on-going security training for employees – recent research shows negligent employees are the top cause of data breaches.
• Partner with companies that are committed to information security.

Of course, managing and protecting data, especially sensitive data, is critical in all workplaces. Recent research shows that organizations experience about one fraud event per week.

The cost of a data breach includes the time spent dealing with it, damage to the firm’s reputation, the possibility of identity theft, and there may be fines.

The average dollar cost has actually been pegged at $194 per lost or stolen record and $5.5 per security breach incident, according to the 2011 Cost of Data Breach Study by Symantec Corp. and Ponemon. 

So how do you prevent data breaches from occurring in the first place? Implement sound information security policies and procedures:   

• Designate a Chief Information Security Officer (CISO) – research has shown this can reduce the cost of a data breach by 35% per compromised record.
• Form a data security team with members from key departments such as information technology, compliance, human resources, legal, and communications.
• Maintain a running inventory of all information that needs to be protected.
• Schedule on-going security training for employees – recent research shows negligent employees are the top cause of data breaches.
• Partner with companies that are committed to information security.

It directs employees to keep their desks and work space clean and uncluttered at all times with a specific emphasis on protecting sensitive information.

To best protect your company's sensitive data, your workplace should provide lockable storage as well as secure settings and passwords for electronic devices. All employees should be encouraged to protect their cell phones and other storage devices, and any printed and visible information, when they leave their desks – even if it’s just for a coffee. Of course, when information is no longer needed, it should be placed in a locked console for secure shredding.

A Clean Desk Policy helps protect your company in so many ways including:  

1. Privacy law compliance. In Canada, for example, PIPEDA legislation requires organizations to safeguard personal information; in the U.S.A, there are several federal privacy laws such as FACTA, HIPAA / HITECH, Gramm Leach Bliley and Sarbanes Oxley.
2. Fewer data breaches. When private information is protected, there is less likelihood of information theft, fraud or a security breach.
3. Reduce opportunities for dishonesty. Leaving sensitive information unattended and visible may attract prying eyes.
4. Saves money. Encouraging ‘digitized’, not printed, documents cuts paper use, etc. 
5. Positive space. Uncluttered work spaces make a good impression on employees and any visitors.    
6. Saves time. Research shows that many employees waste time searching for information... a tidy space will help.
7. May save your sanity. ‘Organized’ employees spend less time stressing out because they can’t find something.

The iPass 2012 Mobile Workforce Report (Q3) shows that many of the workers do not have data security features on their smartphones, tablets and other devices. Furthermore, many are taking steps to bypass their company’s IT department to access corporate data on these devices.

This increases the risk of data breaches but worse, it shows that employees are not up-to-speed on information security.

Now that employees are looking forward to their summer vacations, it’s a good time to remind them to keep private information private when they are working off-site. Here are some guidelines to consider sharing:

• Assume all business documents are confidential – and should be removed from the office only if necessary.
• Have a shred-all policy to ensure all documents are securely destroyed whether you’re in the office – or at the cottage. Your secure destruction provider may supply confidential disposal bags so documents can be returned for secure shredding and recycling.
• Install encryption technology on all storage devices.
• Be sure your security settings as well as passwords and firewalls protect devices with internet connections.
• Avoid printing confidential information from laptops or other computers.
• When working in a public area, be conscientious about protecting devices and information.

This may not seem like a big deal, but a recent study conducted by IPSOS Reid Research indicated that over half of small business didn't think a breach would occur and if it did, it wouldn't really have much effect on their organization. This is a perfect example of the negligence that happens in businesses every day. In this case, the Hospice of North Idaho reported to HHS that an unencrypted laptop computer containing the ePHI of 441 patients had been stolen in June of 2010. During the investigation HHS discovered that HONI had not conducted a risk analysis nor had it taken steps to develop policies and procedures to address mobile device security as required by HIPAA Security rule.

I believe that most businesses adopt the attitude ‘that won’t happen to us’ – as indicated by research and HHS will most likely chase the big targets. After all, they are probably most at risk due to the number of employees and number of mistakes likely to be made. The Health Information Technology for Economic and Clinical Health (HITECH) Breach Notification Rule requires covered entities to report an impermissible use of disclosure of unprotected health information or a “breach” of 500 patients or more to the Secretary of HHS and the media within 60 days after the discovery of the breach. Smaller breaches, like the one at HONI, must be reported to the Secretary annually.

So, be warned. HIPAA rules are not just for large entities and it requires that breaches be self-reported. Not doing so and waiting to get caught can mean a very expensive fine and damage to your reputation and brand. For more information on legislation, check out our HIPAA and HITECH podcast. 

In fact, these are job titles in the information security industry and they’re attracting lots of attention.    

 

A recent report from job market expert Burning Glass Technologies shows that the demand for cyber security professionals over the past five years grew 3.5 percent faster than demand for other IT jobs, and about 12 times faster than for all other jobs.

This increase in demand can be attributed to the creation of many new positions within the information security industry.  Here’s a quick look at some of them:

• Computer Crime Investigator: Recovers deleted, hidden or encrypted data from hard drives for police.
• Penetration Tester:  Also known as white-hat or ethical hacker, tries to penetrate systems to find vulnerabilities and help a company improve security.
• Incident Responder: Handles the aftermath of a security breach incident.
• Information Security Analyst: Assesses policies and makes recommendations to improve them. 
• Network Security Engineer: Oversees computer network security systems.
• Forensics Analyst: Identifies how a cyber crime occurred, and who or what was responsible.
• Security-Savvy Software Developer: Helps create secure software that is free from vulnerabilities.

The soaring demand for information security professionals is perhaps signaling an important shift in the industry as workplaces put a lot more money and effort into protecting their confidential information against security breaches and fraud.  

Check out our report for more information around the state of the information security industry. 

It seems everywhere you turn; more folks are getting into the game of information destruction and why shouldn't they? Information security has become a hot topic and there is definitely a need out there to help people and companies keep their information secure. So it seems around every corner, people are buying trucks, sticking shredders in them and all of a sudden….you’re a “Shredding Guy”. Easy right? WRONG!

Protecting other people’s confidential information requires a significant investment to do it right. First off, you need the right equipment. Secure trucks with all the right locking mechanisms are expensive and specialized. Recently I came across a fellow who jumped into the game with a recycled freezer truck that on the surface looked pretty secure. But on closer inspection, it was clear that this truck was built to keep ice cream frozen not confidential information secure. Next you need a commercial grade shredder that cross cuts the paper into confetti-like pieces and is capable of shredding not just paper but other forms of media as well.

To top it off, you need knowledge and experience to gain the trust of your customers. Do you really think they are going to trust you with an ice cream truck and a used strip shredder you bought on Craig’s list? By the way, how long have you been doing this? You need some time in the “information destruction” saddle to call yourself an expert. Being a shredding guy may look easy but this industry is built on trust – trust you have the equipment and expertise to ensure the confidentiality of your customer’s information.

Hey Mom and Dad….look what I did. I went out and became a shredding guy and I think that’s a pretty noble cause – don’t you?

That’s a lot of paper not being accounted for!


 

Paperless office predictions began in 1975 when personal computers were first being introduced. At that time, a story in Business Week proclaimed that most record-handling would be electronic by 1990.

Of course, that never happened.

Fast forward to 2013 and cloud computing, electronic document management, electronic signatures, and other technology like e-readers and tablets, are all expected to help decrease the use of paper. However, the global demand for paper is still higher than ever, exceeding 400 million tons last year.

While some of that can be attributed to global population growth and subsequent demand, it’s also clear that certain printed documentation has a place in the workplace such as legal documents, contracts, medical papers, etc. At the same time, many people still like to handle paper.

What industry experts are most concerned about though is that some workplaces may operate as though they are ‘paperless’ resulting in minimal attention to document security. This puts business at a higher risk of security breaches and fraud.

The bottom line is this: paper still has a place in the workplace and along with it, a comprehensive information security policy that includes secure storage and destruction.

For more information on maintaining on information security, check out our factsheet on how to protect your workplace from security breaches and fraud.   

    

       
       REDUCE ENERGY USE

1. Switch to energy efficient light bulbs and fixtures.
2. Adjust the thermostat – down in winter and up in summer.
3. Use energy efficient photocopiers and printers.
4. Power down the office at the end of the day.

REDUCE WASTE


5. When information security is not an issue, use both sides of paper for photo-copying.
6. Encourage other paperless office strategies – i.e., converting documents into digital form.
7. Involve employees – introduce ‘litterless lunch’ days (non-plastic reusable containers).
8. Stock the lunchroom with re-usable mugs.
9. Introduce a green bin program in your organization’s lunch room.



CHOOSE GREEN


10. Switch to suppliers that offer sustainable products and services.
11. Rethink packaging of products you make or receive – less is more.
12. Improve air quality with indoor plants and a fragrance-free policy.


GREEN – OR NO – COMMUTES


13. Encourage employees to carpool... or walk, bike or take public transportation to work.
14. Use videoconferencing when possible instead of long distance in-person meetings.


RECYCLE


15. Recycle e-waste such as mobile phones and printer cartridges. But to avoid the risk of a security breach, computer hard drives and other data sensitive e-media must be securely destroyed before recycling.
16. Purchase office furniture and furnishings such as mats and carpeting made from recycled materials.
17. Use recycled paper products.
18. Partner with a reliable document destruction company so that all documents that are no longer               needed are safely shredded and recycled.

    
    For more information and tips around making your business greener and more secure,check out our factsheet.
     

The Third Annual Benchmark Study on Patient Privacy and Data Security by Ponemon Institute showed that data breaches in this sector are continuing to increase. Over 90 percent of healthcare organizations had at least one data breach in the past two years; almost half of respondents had more than five. Not only is the frequency of security breaches rising but the average cost of dealing with information breaches is also continuing to rise. In the Second Annual Study in 2011, the Ponemon Institute stated the average was at $2.2 million compared to $2.4 million. 

One problem, says Rick Kam, president of ID Experts who sponsored the study, is that healthcare organizations have not kept their information security processes up-to-date. In fact, many companies continue to follow the same processes they have always followed.

Today, BYOD (Bring Your Own Device) programs and mobile device usage in the workplace are two of the biggest – and newest – threats to patient data. Eighty-one percent of organizations allow employees to use their own mobile devices to access patient information. Sixty-nine percent don’t secure medical devices that contain protected health information of patients.

To fully commit to information security, industry experts recommend:

• Re-structured information security reporting to senior management;
• On-going review and updating of policies (adding mobile devices and other IT);
• Pre- and post-breach processes;
• Regular security compliance assessments;
• Partnering with a reliable information security company for secure data destruction services.

For more information on protection patient information, click here. 

 

Here’s a look at four of the most common IT tools in the workplace, the security risks they pose, and how a company can reduce the risk of breaches.


 

CELLPHONES – According to Verizon researchers, lost or stolen mobile devices are a huge security risk. The SIM (Subscriber Identification Module) card inside every phone contains company and personal information. How to reduce the risk: Password protect (encrypt) mobile devices. Also, before disposing of any cell phone, remove the SIM card and destroy it.  
 

COMPUTERS – Even if the hard drive has been wiped, ‘improper disposal’ of computer hard drives create security threats (information thieves can still restore the data). How to reduce the risk: Partner with a reliable company that offers secure hard drive and other e-media destruction with an itemized Certificate of Destruction for your files.  
 

EMAIL – Accessing personal email at work through web-based email accounts increases the risk of breaches because hackers are penetrating firewalls. How to reduce the risk:  Develop an Internet usage policy and educate staff about the dangers of visiting questionable sites and opening unknown attachments.
 

PORTABLE STORAGE DEVICES - Memory sticks are often used for bringing work home. But employees may lose these devices or unknowingly pick up viruses from their home PCs. How to reduce the risk: Encrypt the devices (or some workplaces ban them altogether), and educate staff about their use.  
 

For more information about information security and what business are doing to remain secure, click here. 


 

That’s just one of the ways office-based printers can put potentially sensitive information at risk.  
 

Networked multi-function printers (MFPs) are also a concern. They contain hard drives for queuing print requests from computers as well as for copying, scanning, emailing and faxing documents. The document images are stored for indefinite periods of time on the hard drives, which means they could end up in the hands of information thieves.

 

While there are ways a company can protect itself, a recent report by research and analyst company Quocirca shows that less than one-quarter of polled businesses had implemented print security initiatives even though 63% had experienced one or more print-related data breach.
 

How can a business better manage printing security risks? Here are some important tips:   

• Create a formalized printer security plan.
• Talk to your printer manufacturer about options that protect the printing environment. For example, security settings to encrypt images.
• Implement secure printing – called pull printing – across all devices so documents are released only upon user authentication using a PIN code, smart card or biometric fingerprint recognition.
• Track print, copy, scan and fax usage with a secure printing tool. An audit trail will identify misuse and waste.  
• Ensure employees receive on-going training.  
• Monitor the print infrastructure regularly. 

Printer security needs to be an important part of every company’s information security strategy. For more information on protecting your business, click here.   

 

How about banning the use of cell phones?

• Create a culture of information security.
• Introduce compliance guidelines that include fair consequences for violating rules.
• Improve on-going mandatory employee training as a reminder of what is expected.
• Consider banning devices that can record or photograph – in certain departments such as R&D.
• Have all employees read – and sign – that they acknowledge and understand information security protocols.

1. Make information security a part of your corporate culture including standardized policies and procedures, proper on-boarding as well as regular training


2. Have IT develop information security guidelines (i.e., password protection, email security, encrypt files) and be sure employees receive on-going education.


3. Inventory all computers to have a record of all the sensitive information they contain.


4. Isolate, if possible, sensitive information on the fewest number of computers.


5. Don’t store sensitive information that is not required.


6. Stay on top of relevant privacy laws and legislation to ensure your company is always in compliance.


7. Put procedures in place that ensure those employees who leave the company or change departments can no longer access off-limits information.


8. Ensure that contractors and service providers are familiar with your security procedures.


9. Don’t stockpile old hard drives or other electronic devices that store data.


10. Dispose of old hard drives and e-waste securely. A hard drive eraser does not guarantee that data can’t be restored. Destruction is the most effective way to permanently render data files inaccessible. Partner with a trusted e-media destruction company that has a secure chain of custody to ensure proper destruction.   

The Information Commissioner’s Office had ordered an investigation of hard drives, USB sticks and cell phones sold at internet auction sites and trade fairs to see if any data remained on them. Sure enough, 34,000 files on the 200 hard drives, 20 USB sticks and 10 cell phones contained personal or corporate information including bank statements, passports, birth certificates, employee information, and tax and medical information.

Of course, this kind of data is a gold mine for data thieves, whether they’re using data recovery software on devices they’ve stolen from garbage bins or landfill, or buying the data online through hacker forums and other websites. While the cost online to obtain this information is astonishingly low - according to a blogger on Naked Security, a hard drive containing information from one million bank customers was listed on eBay for £35 (about $55) – what data thieves do with the information afterwards is where things really start adding up.

One of Ponemon Institute’s most recent studies shows that data breach incidents cost U.S. companies on average $204 per compromised customer record. The average cost on a per-incident basis is around $6.75 million.

The best way to avoid a data breach is to securely destroy your hard drives and avoid stockpiling hard drives and other types of eMedia. For more information about secure hard drive destruction services, click here.



 

• Mandatory training on information security for employees;
• Ban the use of portable hard drives in the workplace;
• Unapproved USB keys are not allowed to be connected to the computer network;
• Perform regular clean-outs of storage facilities and avoid stockpiling unused hard drives
• Destroy all unused hard drives using a third-party provider who has a secure chain of custody

• Form a BYOD committee.
• Create BYOD policies, such as limiting the amount of client information in emails, mandating a start-up password and inactivity timeout, and having data encryption.
• Work with IT professionals to put security policies in place.
• Work with HR professionals to educate employees about these policies.  

It’s not as crazy as it may seem.  

 

• Create a workplace culture that values and respects confidentiality and privacy.
• Develop an information security strategy that complies with privacy laws and legislation.
• Keep employees involved in information security through on-going education and communication.
• Partner with an information security company that disposes of private information in a safe and secure manner.

The U.S. Chamber of Commerce, for example, estimates that theft by employees costs American companies $20 billion to $40 billion a year.

 

1. Create a good workplace environment lead by senior personnel who demonstrate their commitment to all policies.
2. Include background checks in your hiring procedures.
3. Educate employees about anti-fraud policies. 
4. Limit employee access to supply and storage areas.
5. Protect confidential information by limiting access to files and securely shredding your paper when it is no longer needed.
6. Set up an anonymous reporting system – Statistics Brain shows that employee tips reveal over one quarter of all internal fraud cases.
7. Perform regular audits throughout your workplace. Audits have revealed 18.8% of fraud cases.

• Over 50% of c-suite executives in the U.S.  stated they didn’t use a professional shredding service. Discarded documents often end up in unsecure places such as blue boxes or the garbage which can lead to potential security breaches.

Security Tip: Partner with a reputable shredding company that has a secure chain of custody including locked consoles for documents that are no longer needed.

• Last year, over half of businesses in the U.S. stated they felt erasing or deleting electronic data when it is no longer needed is a secure method. Many businesses are not aware that these methods of disposing data can be easily retrieved by identity thieves using simple software.

Security Tip: Ask your shredding provider about their e-media services. Hard drives and other types of media should either be shredded or crushed to ensure the information is completely destroyed.

• 50% of small businesses last year stated they use an in-house shredder. Not only is this method time consuming and expensive, however it often involves less secure practices such as strip-shredding and storing documents in unlocked areas.

Security Tip: Select a shredding company that uses secure document destruction consisting of cross-cut shredding, locked consoles and a secure chain of custody.

• 46% of small businesses in 2012 said they do not have someone in charge of information destruction at their workplace. These can lead to weaknesses within your information security plan.

Security Tip: Create a data security program with someone in charge. If you are lacking in resources, this service is often offered by shredding specialists.

• In 2012, only 27% of businesses stated they train their staff on a regular basis on secure information handling and destruction.  With workplaces constantly changing due to organizational shifts and turnover, not holding regular training can cause knowledge gaps within your staff ultimately leading to unsecure practices.

Security Tip: Initiate regular staff training on information security. Have training material on hand for ongoing support in between training sessions so when new employees begin, they are able to obtain this information.  

• Know what confidential information your business maintains.
• Keep only the information you need for your business.
• Make sure sensitive information you keep is protected and stays private.
• Create a plan if a security breach occurs.
• Partner with a reputable shredding company.

1. Create information security policies and procedures for your facility.
2. Keep up to date on your industry’s laws and legislation (such as HIPAA, Health Insurance Portability and Accountability Act).
3. Train employees on proper disposal of confidential information.
4. Develop a shred-all policy – so that all hard copy and e-documents that are no longer needed are securely destroyed.
5. Be sure your information security company provides locked consoles, on-site shredding in secured trucks and a Certificate of Destruction after every shred. 

1. How much will it really cost? Some companies charge per image (page) and may also charge extra for set-up, file preparation and indexing, delivery, etc. Get those details in writing.  


2. Is the imaging process compliant with privacy laws and legislation? This is very important. During the document scanning process, documents should be securely tracked and managed and then destroyed.


3. Does everything have to be scanned? This can be costly. A complimentary security assessment by the secure information expert would be most helpful to determine what must be imaged, shredded and stored. 


4. Where will scanning be done? To avoid any disruption in your workplace, it’s recommended that documents are picked up by GPS-tracked transport and taken to a secure record center for processing.


5. How are documents destroyed following the scanning process? Shredding is the most secure method of document destruction. You need to know where this will take place and by whom.


6. How will data be returned? Find out if you will receive encrypted CDs, DVDs or hard drive for upload to your system, secure FTP or upload to your Cloud storage solution.

• A four-year-old starts getting suspicious mail, like pre-approved credit cards that are normally sent to adults.
• A high school graduate applies for his or her first credit card – and is denied because of a bad credit rating.
• A couple receive a call at night ‘alerting’ them about a stolen credit card... all the caller needs to do is confirm sensitive financial information including address, credit card and Social Security numbers.
   

1. Limit the personal information you carry around to only those pieces that you require on a day-to-day basis.
2. Ensure that you are aware of the person or organization you are speaking to over the phone before providing personal information. 
3. Always securely dispose of personal information by shredding documents before they are recycled. 
4. Research any social networks or secured sites you are planning on joining before providing your personal information.

• Unintended disclosure (this means information was publicly posted, mishandled, or sent to the wrong party via email, fax or mail);
• Cyber attacks;
• Insider breaches;
• Physical loss (paper records were lost, discarded or stolen)
• Portable and stationary computerized devices (that were lost, discarded, or stolen).

• Regard digital document management as a way to free up office space and document storage budget – and solve workplace issues.
• Look for opportunities to include document imaging in an existing budget. For example, piggy-back a scanning project with a move or consolidation of office space.
• Introduce electronic document management as a business solution for different departments in the company. For example, digitized information will simplify the process of finding and sharing information for customer service.
• Apply the scanning process as an information management strategy - destroying obsolete documents and imaging those that must be kept.
• Speak to a trusted supplier first. For example, your document destruction supplier may also provide scanning services and be an expert at keeping confidential documents confidential.     

For the average client, 50% of their records in storage are obsolete, meaning they are held past their retention requirements.  If you consider that every box sitting in outside storage costs you between $15 and $45 over 5 years in hard costs and another $7 to $20 in labor costs to access, you may be surprised by how much money you’re wasting every year.  If the average Fortune 1000 company has one box in storage for each of their 33,500 employees, that equates to between $250,000 and $750,000 in wasted hard costs and another $117,000 to $350,000 in wasted labor. Think about what you could do with that extra money.

Consider using Shred-it’s proprietary Shift Your Spend analysis , it’s complementary and will help to uncover where you may be wasting your money.  Let us help you release your stored-up documents before you put off your priorities for another year.

• Create a written document of information security policies and procedures.
• Train employees about those policies and conduct periodic information security audits. 
• Securely dispose of all data that is no longer needed – shred hard copy as well as information on hard drives and other electronic devices.

1. An in-house shredder takes up precious floor space.
2. It’s time-consuming to remove rubber bands, paper clips, staples, and the list goes on
3. It takes an hour for an employee to shred the average amount of paper he or she uses a month… multiply that by the number of employees you have in your office - shredding paper, and you’re losing a lot of productivity by doing it yourself.
4. The shredding itself causes dust and airborne particles, and (even low-speed) shredders can produce flying fragments. Health and safety precautions (another cost factor) are important.  
5. On-going maintenance (oiling, unclogging and cleaning) is absolutely necessary. And parts like knives and cutters, etc., will need sharpening or adjusting, and of course, the equipment can always break down.

 
 

1. ‘Expiring Internet Domain Name’ Scam – Unsolicited letters arrive saying the business’s internet domain name is due to expire and must be renewed; or a new domain name similar to the current one is offered. 
2. ‘Directory Listing/Unauthorized Advertising’ Scam – A company is advised by mail or phone about a directory listing or advertisement in a magazine or webpage that in fact hasn’t been booked.   
3. ‘Office Supply’ Scam – The company receives and is charged for (over-priced) office supplies that were actually never ordered.  

• Create clear information security policies.
• Educate employees who process the invoices or answer the phone about scams.
• Confirm that goods or services were ordered and received before paying an invoice.
• Never give out any business information unless it is known what the information will be used for.
• Ask for all business deals to be confirmed in writing (not just over the phone).  
• Limit the number of employees that can approve purchases.
• Be sure there are security procedures for verifying, paying and managing accounts and invoices.
• Ask for proof when anyone calls claiming the business has ordered or authorized something.

1. The award highlights the Information Security Tracker, which underlines the importance of information security as a global issue – and that’s important.


2. The award also helps highlight the key messages around information security:
   
   • Regularly review document destruction policies
   • Conduct annual security audits, and
   • Implement comprehensive trainings for employees  


3. The survey is important as it showed that small businesses need to better protect sensitive information. While 78.6 percent of U.S. respondents knew that protecting confidential data is the law, almost one-third of companies never train staff on information security and 35.5 percent have no protocol in place for storing and disposing of confidential data.


4. The award confirms Shred-it’s commitment as a reliable source for data loss prevention information.


5. Shred-it decided to make the Information Security Tracker an annual campaign. Take a peek at our 2012 Information Security Tracker.  

• Create an information security strategy for the management and destruction of confidential documents.
• Be sure that security policies are compliant with national identity theft and privacy legislation.
• Train new employees on information security.
• Keep all existing employees up-to-date on information security best practices.
• Limit the number of employees who handle confidential documents.
• Implement a shred-all policy, and be sure that all documents – paper and electronic – are destroyed on a regular basis.

Well, don’t be surprised if the receptionist does at your next visit.

1. Implement a policy to ask patients, and especially new patients, for two pieces of identification (one of them being photo ID).
2. Also, make it a policy to ask new patients for their referral source.  
3. Improve handling of patient records. Research shows that medical files are often left unsupervised in rooms, on desks and in door folders. 
4. Review any new patient records for inconsistencies.
5. Digitize patient records, and partner with a document destruction company to dispose of paper when it is no longer needed.

1. Frees up space. Documents are often stored in bulky filing cabinets and boxes in premium office space.
2. Saves money. Document storage costs (file cabinets, folders, paper, ink, even weather control systems) are negated.
3. Supports compliance. Cleaning up files is a great time to make sure document storage and destruction adhere to privacy laws such as the Gramm-Leach-Bliley Act, Health Insurance Portability and Accountability Act, and others. Learn about your industry’s compliance requirements by watching this helpful 2min video: Watch Video
4. Simplifies Employees’ Jobs. Digitized information can be pulled on demand compared to the time spent rummaging through paper files.
5. Easier handling of information. It’s much easier to access needed files rather than physically going through hundreds of files.
6. Better security. Digital archiving is a more secure way of storing, organizing and sharing documents (no more passing paper documents around). About 36% of U.S. businesses have no policy for document storage.
7. Better overall control. A business will be able to keep better track of records. An archiving program logs who attempts to access a file and when they logged in and out. That makes tracking information leaks easier.
8. Business continuity, no matter what. Statistics suggest that 70% of businesses would fail within a few weeks if paper records were lost in a fire, flood or other disaster. That wouldn’t happen with backed-up digital documents.   
9. Preservation. Digital files last longer than paper.

 

• Only take confidential information out of the workplace when it’s absolutely necessary.
• Avoid printing out confidential documents; use email or digital storage devices instead.
• Transport any printed documents securely.
• Be especially careful if you work in public places such as coffee shops or the park.

1. The company has a secure chain of custody that is all about helping you to prevent expensive and damaging information security breaches.
2. Company representatives go out of their way to tailor the service to your specific needs.
3. The company is knowledgeable about all privacy laws and legislation for your specific industry. 
4. A dedicated support team is willing and able to provide helpful advice around secure document destruction.
5. All documents are recycled after shredding, and an annual Certificate is produced to track the amount recycled through your shredding program. 

1. The company has a branch in your local area.
2. The company is committed to best practices in secure document destruction.
3. The company is prompt and efficient with as little disruption to your workplace as possible. “Always cooperative, always on schedule, always efficient, great company,” is how one testimonial has described it.
4. There is a dedicated support team that is available to answer questions, address concerns, and meet with you if need be.
5. The company utilizes the latest technology. For example, handheld technology improves efficiency such as ensuring each console is emptied completely during servicing.
6. Service is convenient and flexible – if you need to change the time or the job in any way, it’s never a problem.
7. The company is always on time for its scheduled appointments.

1. Information security from start to finish... for example, documents are not sorted in any way before they are shredded.
2. Trustworthy – All employees are security-checked and  specially trained to handle confidential material.
3. Transparent – Customers are invited to watch their documents being shredded.
4. Secure consoles – Consoles for document storage are locked, and documents are not retrievable once they’ve been deposited.
5. Flexibility – You can have a one-time or regularly scheduled shredding service.
6. Efficiency – Any rescheduling is done quickly and with courtesy.
7. Variety of shred-sizes – Depending on your industry’s specifications, different shred-sizes are available.
8. Options – Consoles are available in several custom finishes so you can complement your office decor if you want to.
9. It’s all about you – The company assigns a dedicated support team to every customer.
10. Reach – The company has locations around the globe... just in case you do too.

• Implement ongoing risk analysis processes and create a policy specifically designed to limit exposure to fraud and data breaches.
• Regularly train employees in proper document management and encourage their adoption of security best practices.
• Utilize special locked consoles to house sensitive materials that are waiting to be properly shredded.
• Implement a “shred-all” policy so that all unneeded documents are fully destroyed on a regular basis.
• Don’t overlook hard drives on computers or photocopiers; physical hard drive destruction is proven to be the only 100% secure way to destroy data from hard drives permanently.
• Hire a reliable vendor that is well-informed and keeps you compliant with pertinent legislation, training requirements etc.

 

• Use initial and on-going security assessments to identify problem areas.
• Recommend a shred-all policy so employees don’t have to decide which documents are confidential – all are securely shredded at your location.
• Install locked consoles in their workplace for secure document storage before shredding.
• Have NAID (National Association for Information Destruction) certification.
• Provide cross-cut shredding in a variety of different sizes.
• Issue a Certificate of Destruction after every shred.
• Make service a priority.

That’s a huge amount of money, and it underlines the importance of protecting clients in industries where private information is required in everyday transactions.

 

1. Conduct information security assessments. Knowing how internal documents are generated, revised and stored can help identify security risks. Be sure to include both electronic and paper-based sources.


2. Encrypt data. Smart phones, tablets and laptops are becoming standard business equipment for employees. As a result, it’s important to encrypt data on these devices just in case the device is stolen or lost.


3. Introduce a shred-all policy. A shred-all policy means that all workplace documents will be shredded when they are no longer needed. Employees won’t have to decide which documents are confidential. Also, shredding documents is a 100 percent secure way of destroying them completely. (Remember, 56 percent of businesses in North America do not have a secure method of document destruction.)


4. Don’t forget Electronic Media. When it comes to disposing of sensitive data, don’t overlook hard drives on computers or photocopiers. Erasing a hard drive does not guarantee that data is gone. In fact, physically destroying a hard drive is the only sure way to destroy any data on it. 

A national medical records firm is one of the latest examples of how that can happen.

On New Year’s Eve, Impairment Resources LLC’s San Diego office was broken into.  Their electronically-filed information from 14,000 patients – including their addresses, Social Security numbers and medical diagnoses – were taken.  

The company did its due diligence and reported the breach, but several weeks later it also filed for bankruptcy protection. According to reports, Impairment Resources had $226,000 in assets, more than $580,000 in liabilities, and the potential for countless lawsuits from individuals resulting from the data breach.

Regardless of how sensitive information gets into the wrong hands, the consequences can be significant, and it’s not just large companies at risk.

Medical practices of all sizes must be compliant to the privacy and security rules set out by the Health Insurance Portability and Accountability Act (HIPAA). There must be appropriate safeguards in place to protect patients’ health information.

Here are some of the most important safeguards:

• Develop a HIPAA compliance program and review and update it regularly
• Document policies and procedures
• Be sure HIPAA training is in place for employees
• Introduce a shred-all document shredding policy to ensure all sensitive documents are securely disposed of and permanently destroyed when no longer needed

• Have a security risk assessment of both physical and technical security.
• Review policies and procedures around security, record retention and document disposal. Shredding documents and eMedia is the most secure way to dispose of sensitive information when it’s no longer needed.
• Review and improve employee training practices.
• Work only with service partners who are committed to security best practices.

Most businesses today recycle their paper documents as part of their commitment to sustainable practices. But if you’re not recycling paper securely, your good intentions could lead to a security breach.

 

1. Watt’s up: You would never leave home with all the lights on, computers and printers running, so why is it OK to do this at the office? Using a power strip for devices like computers, lights and printers makes it easy to shut down an entire desktop at once.


2. Light for less: Artificial lighting accounts for 44% of the electrical use in office buildings. As your current light bulbs burn out, replace them with Energy Star-rated light bulbs and fixtures, which use at least 33% less energy than regular lighting.


3. Smarter heating: Create an afterhours and weekend thermostat setting. If you know your employees aren’t going to be in the office, use a lower setting that conserves more energy during these hours. Be sure to allow an override function so that it can be changed if someone decides to come in to work.

• Review the lifecycle of all health information created in your organization and document where the information is created, how it’s maintained, and how it’s disposed of.
• Develop a compliance checklist that is reviewed and updated regularly.
• Be sure policies and procedures are documented and are an integral part of new – and on-going – employee training. 
• For document destruction, introduce a shred-all policy to ensure all sensitive documents are securely disposed of and permanently destroyed. 

1. Do your own risk assessment as a start. Meet with heads of departments and discuss what security policies are in place, if there is effective employee training about security policies, and where security breaches might occur.


2. Do a more structured Risk Assessment Survey. For example, the survey at http://www.shredit.com/Shredding-Service/Risk-Assessment-Survey.aspx looks at how you are managing information security. 


3. Partner with a recognized document shredding company that will do regular security risk assessments of your workplace as part of its service. The company will make best practices security recommendations. For example, introduce a shred-all policy so that all unneeded documents are destroyed on a regular basis; use locked consoles placed strategically throughout the office for secure document disposal; and have  your confidential documents destroyed on-site in a locked area on a mobile shredding truck. Also, you should receive a Certificate of Destruction immediately after each shred.

• Employees’ Work Space: Have every employee clean their desk areas to free up and organize their space. Provide desktop organizers or trays.
• Activity Centers: General activity centers will help keep things organized. A Reference Center, for example, would include binders, manuals and dictionaries. A Supply Center would contain office and paper supplies.
• Storage: Be sure to have a good system for filing, dating and then disposing of documents according to privacy legislation.
• Document Disposal: Partner with a knowledgeable shredding company that specializes in secure document and eMedia destruction. Locked consoles for documents that needed to be shredded should be placed in high traffic areas around the office. The document shredding service provider should come regularly to shred materials on site and in a locked and secure area at your   office location. You should receive a Certificate of Destruction immediately after each shred.
• Cleaning Service: Be sure your cleaning service does background checks on its employees. You want a clean, secure office across the board. 

• Keep tax returns for four years after they are filed.
• Once you have the annual statement for taxable investments, dispose of all the monthly statements you’ve received. Document shredding is the most secure method of disposal. E-waste can be shredded too.
• Keep bank statements that back up information on tax returns for up to seven years. Otherwise, shred them.  
• Destroy canceled checks after a year unless they confirm information on your tax return.
• Keep credit card statements for big purchases and charitable contributions. Otherwise, shred statements.
• Shred pay stubs after you have received payment.
• Keep records of retirement plan contributions indefinitely.

• Train employees about what type of paperwork has confidential information.
• Limit access to areas where confidential documents are stored.
• Understand compliance legislation and document retention policies that pertain to your industry. 
• Use a reliable document shredding provider to destroy confidential documents once they are no longer needed.

• Type of cut. Home office shredders typically shred documents in vertical strips. This cut is substantially less secure than a crosscut or confetti shred.

 

• Office materials. Some lower-quality shredders cannot accommodate paper clips, staples or bound documents so your employees must take the time to prep each document prior to shredding.

 

• Multimedia. Credit cards, CDs, hard drives and computer disks must be shredded to maintain security and a less expensive shredder usually doesn’t have the power to shred these tougher materials.

 

• Capacity. Budget shredders can’t handle multiple sheets of paper at once or have a low capacity – meaning it could take a while to shred a large document.

 

• Longevity. An inexpensive shredder is likely to fail under the usage demands of an office because most units simply weren’t designed for that type of wear and tear.

 

Four common document shredding myths:

1. No one looks through my trash so why would I shred? You might be surprised to learn that combing through trash or dumpster diving is a routine activity for many thieves, and it is considered so profitable, it’s been a tactic for some organized crime rings.

 

2. I store my records securely so I don’t need to shred. While securely storing your records is a sound security practice, both the United States and Canada have laws that mandate how long businesses should retain records before destroying them.

 

3. You can’t recycle shredded paper. Shredded paper can indeed be recycled and used for a variety of consumer products.

 

4. My company is too small for a shredding service. Considering a 2010 EPA report found the average office worker uses 10,000 sheets of paper per year; your office is creating more paperwork and waste than you’d imagine.

Information protection is the law

In the U.S. (and Canada), laws prohibit medical practices from putting sensitive documents such as patient information into the garbage. All confidential information must be protected – and completely destroyed – when no longer needed.

Shred it – for sure

The most secure method of document destruction is shredding. Once paper has been properly shredded, it can’t be reconstructed again. (Keep in mind that identity thieves have been known to painstakingly put hand-torn documents back together again.)

Information security checklist

To protect against security breaches in any type of business, Shred-it, a world-leading information security company, recommends:

• Stay up-to-date about privacy laws and legislation in your industry.
• Be compliant with all the rules.
• Implement a shred-all policy in your workplace.
• Partner with a reliable shredding company.

Find out more about Information Protection. 

 

1. In 2009 Heartland Payment Systems announced hackers had broken into computers used to process 100 million transactions for 175,000 merchants.
2. In 2009, the U.S. Department of Veteran Affairs inadvertently compromised the identity of 76 million veterans
3. In 2009 Supermarket chain Hannaford Bros. Company had a security breach that affected up to 4.2 million customers.
4. In 2008 Bank of New York Mellon compromised the information of 12.5 million people.
5. In 2008 CheckFree Corporation reported that hackers hijacked several domain names and tried to install malware on visitor’s computers, affecting an estimated 5 million people.
6. In 2007, Certegy Check Services disclosed that an employee had stolen the personal information of 8.5 million people.
7. In 2007, 6.3 million customers of TD Ameritrade had their confidential information potentially exposed when a database was hacked.
8. In 2006 TJX Company, Inc. announced more than 45 million customer records had been stolen.
9. In 2006 U.S. Veterans Affairs officials revealed that a laptop containing the personal information of 17.5 million veterans was stolen in a burglary. 
10. In 2005 Card Systems experienced a security breach that exposed more than 40 million card numbers.

• Less demand for new lumber; more trees are left in our forests
• Less energy and water needed for processing new lumber
• Less waste being dumped in landfill sites

• They participate in other green initiatives such as using biodegradable hydraulic fluids or gas-efficient fleet vehicles.
• They use recycled materials in any other aspects of their business.

• Has an excellent reputation and can provide references
• Understands laws, especially as they pertain to your industry
• Employs personnel that have undergone rigorous training and a background check
• Offers a security risk assessment
• Provides secure, locked consoles for documents prior to destruction
• Shreds all documents in a locked on site area where the document handler is the only one with access
• Gives you the option of watching the document destruction and provides a Certificate of Destruction
• Uses cross-cut shredders and can accommodate other media types such as CDs and disks
• Recycles all shredded paperwork

• A staff member at a VA Medical Center in Kentucky took home his laptop without authorization that contained the medical records of 1,900 patients.
• The physical medical and billing records of roughly 1,200 patients went missing during an office move at Fairview Health Services in Minneapolis.
• Southern California Medical-Legal Consultants unknowingly had medical files of almost 300,000 Californians unsecured on the internet.

• Hire a director of compliance or legal counsel who can provide guidance and internal audits.
• Restrict or manage employees’ access to sensitive patient information.
• Designate an annual budget for security management systems.
• Train employees on current HIPAA legislation and perform audits to ensure it is followed.
• Develop strict security policies for any employee who uses laptop or mobile devices to access patient information.
• Destroy confidential paperwork, records and billing documents in a timely and secure manner.

• Personal information with a signature
• Account numbers
• Patient medical information
• Financial documents
• Legal contracts or information

• Understand privacy laws and how they apply to your business
• Be compliant, with a clearly communicated information security policy
• Store documents securely and shred them once they are no longer needed
• Use a reliable shredding services and consider shredding all documents and implementing a shred all policy

• 43% classify themselves as “frontrunners” and think they have an effective, proactive security strategy.
• 27% identify themselves as “strategists” and felt they had the right security plan but didn’t always execute it.
• 15% felt that they were “tacticians” while another 14% felt they were “firefighters” because they simply responded to security threats and issues.

• Develop and implement a comprehensive security policy that covers electronic and paper information.
• Understand the threats unique to your company and how to mitigate the risks.
• Appoint a security information executive or CIO that reports at a high level on security policy and effectiveness.
• Earmark a security information budget to ensure the initiative has enough funding to be successful.

• Fraudulent attacks. Phishing emails, viruses, click-jacking or malware are commonly found on social networks.
• Brand hijacking. A company’s page is breached or hacked and false information is posted.
• Corporate content. Proprietary or confidential information is shared by employees or they distribute company updates that are incorrect.
• Electronic communications. Employees use low-security social sites to collaborate or share high-value, confidential documents.

• Outline current and intended social media usage and ensure these activities are aligned with your company’s goals…and its security policies.
• Perform a risk assessment to identify and quantify the various, unique threats associated with your social media initiatives. 
• Enhance your current security policies to include social media guidelines such as: appropriate/inappropriate employee use, information security policies, marketing and communications usage and vendor management plans.
• Provide social media training so employees receive practical demonstrations of what constitutes acceptable use and what types of information can/cannot be shared.  
• Monitor social media channels to ensure that employees are adhering to security policies.

• 9 million Americans and 2 million Canadians are victims of identity theft annually.
• Identity theft costs victims in the U.S. approximately $5 billion dollars, taking 20 million hours and over $150 million to resolve.

1. Make sure your security policy has executive-level support so VPs, directors and managers can lead by example.
2. Create a realistic training plan to educate employees about the security policies in stages, allowing your employees to retain what they learn.
3. Keep security top-of-mind by regularly communicating the latest threats, scams and security news to employees.
4. Enlist the support of other departments such as IT and Human Resources to perform login audits, training sessions, etc.
5. Remind employees that security isn’t limited to protecting customers – a secure company protects them as well.
6. Work with finance to ensure that you have a budget for your security policy efforts and training.

• Begin your “security-centric” thinking in the interview process by asking prospective employees questions about information security so you can gauge whether it’s important to them.
• Emphasize your data security achievements and milestones during new employee orientation.
• Devote a section/subsection of your website to your company’s security initiatives and how they help keep client information protected.
• Promote your company’s new security programs or new initiatives in a press release, through social networks, etc.
• Highlight your track record of security in fact sheets, presentations, brochures or other marketing materials.

• Risk: Accessing client and prospect information
• Solution: Have IT monitor logins periodically to ensure sales is only accessing the information they need for specific accounts or sales


• Risk: Communicating sensitive information via email
• Solution: Train employees about what information can be shared electronically and encrypt all emails/attachments


• Risk: Working off site or from home
• Solution: Educate employees about the importance of using only secure networks and that security policies must be followed, even from a remote worksite


• Risk: Using portable technology including laptops, USB drives and smart phones
• Solution: Keep security software current on all devices, use encryption software and ensure all items are password-protected and default to a locked screen when idle


• Risk: Generating confidential paperwork such as contracts, renewals, rate information, service level agreements, etc.
• Solution: Implement a shred-all policy where all paperwork (regardless of what it contains) is shredded securely once it is no longer needed

• Identify the corporate materials that are classified as confidential and should be protected.
• Develop a comprehensive overview of how these internal documents are generated, revised and stored so you can spot any security weaknesses.
• Encrypt the data on portable devices such as smart phones, tablets, external memory drives and laptops so company information is better protected in the event of theft or loss.
• Extend the same secure document handling practices used with client information to corporate documents, and shred documents once they are no longer needed.

• Employees do not always understand or receive proper training about privacy compliance and security protection requirements.
• There is a lot of paperwork generated on a daily basis, and anything confidential (that does not need to be retained) must be destroyed in a secure manner.
• Hard drives in copiers, laptops and external storage devices can contain confidential information so they must be handled securely.
• Breaches are likely to occur due to human error or negligence

• Identify the unique security challenges within your organization.
• Understand how data is handled internally and where it may be exposed to risk.
• Consider implementing a shred-all policy, so no one has to decide what is or isn’t confidential
• Make funding your organization’s compliance and security efforts a top priority.

• Examine the paperwork lifecycle to understand how it is passed between departments, outside parties, etc. so you can spot any potential weaknesses or loopholes.
• Limit access to confidential information within your workplace by locking filing cabinets, limiting access to the record room, etc.
• Train employees on how to handle confidential information and educate them about the legal obligation of protecting every individual’s privacy.
• Implement a shred-all policy, where all documents are shredded once they are no longer needed. 

• Employ a security officer or manager who is responsible for maintaining and enforcing HIPAA-compliance standards.
• Train new hires on secure information handling practices that are HIPAA-compliant.
• Limit access of confidential records to only those who require it.
• Facilitate regular training sessions to keep employees up to date on HIPAA legislation.
• Develop an incident response procedure in the event of a breach.
• Dispose of confidential information securely by shredding it once retention periods are met.

1. Strip shredders, the smaller ones commonly found in personal offices, do not provide secure document destruction because the vertical strips can be reassembled. 
2. Personal shredders oftentimes fail under the demands of an office environment, leaving confidential information intact until the equipment is replaced.
3. Personal shredders cannot shred tougher materials such as staples, binders, paperclips, CDs, DVDs and more.
4. Computers and photocopiers may expose confidential data, even with hard drive erasing software – only destroying the hard drive professionally is 100% reliable.

1. Shredding paperwork uses employees’ time, taking them away from other, more productive activities.
2. Just shredding your documents doesn’t make your business legally compliant – in the event of a suspected breach, a Certificate of Destruction from a reputable shredding provider is required to show proof of destruction.
3. Unauthorized employees may be exposed to sensitive information as many companies use an administrative-level employee to reduce the resource costs of document shredding.
4. In house shredding cannot respond to spikes in demand, which is commonplace in many businesses.

1. According to the Ponemon Institute, in 2010, the cost of a breach was $214 per compromised record, and a data breach event averaged $7.2 million.
2. In addition to restitution, companies face expensive legal fees, and possibly, fines or criminal investigations.
3. Intangible costs such as the damage to a company’s reputation, negative media coverage, increased customer attrition rates, etc.

1. How many people do you employ? 
We’ll assume 25 for this example.
2. How many people in your office need to perform shredding on a weekly basis?  
   A reasonable (even conservative) estimate would be that about 20% of the workforce or 5 people shred documents.
3. How long does it take to shred documents? Remember to factor in the time it takes to get to the shredder, remove paper clips and staples, feed the document, etc. We’ll assume 30 minutes per person in this example.
4. Time spent shredding per week:
   30 minutes/week x 5 employees = 150 minutes/week
5. Time spent shredding per month:
   150 minutes/week x 4 weeks = 600 minutes or 10 hours of lost time each month!

• Cost of document shredding equipment, including maintenance contracts or repair/replacement expenses.
• Cost of associated supplies such as wastebasket liners and receptacles.
• Cost of physical space dedicated to shredding equipment and collection units.
• Cost to dispose of shredded materials.

• Standardize the application paperwork so you are receiving consistent, comparable information about each and every applicant.
• Perform a background check plus a credit check to determine whether the candidate has been forthcoming in the application process.
• Include situational interview questions to gauge how well the applicant understands the importance of information security.
• Check references and ask questions that are specific to the candidate’s job functions, especially the handling of confidential information.
• Use a reputable hiring agency because if their hiring or screening process is poor, you may have a major liability working for you.

1. Know who you’re hiring by performing background checks, contacting references or outsourcing recruitment to a reputable employment agency.
2. Limit network access to keep employees’ access restricted from confidential information unless it is an absolute job necessity.
3. Monitor employee activity by using software thatsends alerts if certain files are accessed or an employee makes an attempt to download restricted information.
4. Educate your employees about how to properly handle emails, share files and destroy confidential paperwork once it is no longer needed.
5. Update your security policies to keep pace with new threats from criminals, employee turnover and emerging technology.

• The personal information of 1.7 million patients, staff members, contractors and suppliers of Bronx hospitals and clinics operated by Health and Hospitals Corporation was breached when electronic files were stolen from an unlocked van.
• 192 paper records of patients were compromised after a hospital employee left the paperwork on a Boston subway train.

• Underscore the importance of compliance. Many companies still don’t know what constitutes HIPAA or FACTA compliance – don’t be one of them and learn only after you’ve received a fine or had a breach.
• Screen new hires thoroughly. Employees will have access to confidential information as part of their job functions so it is imperative to know who you’re hiring and if they have a criminal background.
• Establish a virtual office policy. Both of the breaches I cited earlier occurred when records were taken off site – ensure that employees who use laptops or transport paperwork of any kind are well-trained in security policies.
• Destroy all paperwork as soon as it is no longer needed. Paperwork containing confidential information represents a huge risk so destroy it securely as soon as you don’t need it.
• Explore outside expertise. With all of the considerations associated with running a compliant organization, you might find that an expert consultant can help you establish information security policies and train staff.

• United States SMB Security
  • 25% of SMBs have never reviewed their document destruction processes
  • 6.7 million SMBs have never conducted a security audit
  • 36% of SMBs have no protocol for storing and disposing of confidential data 

• Canadian SMB Security
  • 47% of SMBs believe that a data breach would not impact their business
  • 640,000 SMBs are not aware of the legal requirements for storing and disposing of confidential data
  • 38% of SMBs have no protocol for storing and disposing of confidential data

• Understand the document lifecycle and when it should be destroyed.
• Review how documents are stored and consider that limiting access or keeping cabinets or record storage areas locked is a smart, low-tech deterrent.
• Conduct ongoing security information training as changes can occur to privacy legislation.
• Destroy confidential documents securely as mishandled paperwork is an easy way for Security breaches to occur.
• Make security a company-wide initiative – from awareness about the latest scams to reporting any suspicious activities, a culture of trust is a great defense against security breaches.

• Security plate. Much like a beveled or angled slot for a mail drop, a secure console will have a non-removable security plate that prevents documents from being removed once they are deposited.
• Static cling-free nylon bag. Due to the fact that even one non-shredded document poses a serious security threat, it is important to choose a provider that lines their consoles with cling-free nylon bags. You’ll be assured that all of the contents are captured and then destroyed entirely.
• Easy disposal. Look for document shredding providers that don’t require any sorting of materials or the removal of paper clips, staples, etc. prior to shredding. Many consoles are built with wide feed slots to accommodate larger volumes or paper or even bound materials. Making the disposal of such documents as quick and simple as possible helps ensure employee adherence.
• Non-moving. In theory, wheeled consoles sound like an excellent idea because they make transporting the documents to the shredder very easy.  The console’s mobility, however, becomes a serious liability when thinking about document security because the entire unit and its contents can be wheeled away…and stolen. 

• Cost. At first glance, using in house resources might seem much less expensive because shredding equipment can be relatively affordable and you already have personnel that can be utilized. But, upon further examination, consider the fact that shredding equipment must be capable of shredding everything from CDs to hard plastics, in addition to shredding documents to such a size where they cannot possibly be recreated. The equipment must also be maintained and serviced to ensure it is in good working condition. Moreover, while your employees may already be company resources, the time and distraction it takes to use the shredder adds up to significant numbers, when considered in terms of weeks/months.
• Operations. In addition to the expense of the equipment and personnel labor, another variable is the hassle of preparing materials for shredding. From removing staples, rubber bands or paper clips to hand-feeding the shredder, the task of shredding can be onerous and annoying. Much like the copier that refuses to clear a paper jam, a malfunctioning shredder can waste important time and create frustration. This frustration or anxiety can carry over to other tasks the employee has and can create a less-efficient and less positive work environment.
• Security. The reason for having shredding equipment is to ensure confidential documents are disposed of securely. Yet, the in house shredding model creates several security loopholes. One consideration is how the confidential information is handled before it is shredded. Most offices simply have receptacles that contain items “to be shredded.” Unless such containers are locked, third-party cleaning services or maintenance people can simply steal documents after hours – and expose the contents to tremendous risk. Another problem arises when determining which internal personnel is cleared to handle such sensitive records – after all, confidential documents may include accounting statements, employee records, proprietary company data, etc. One disgruntled employee could share a vast amount of confidential documentation, jeopardizing customer, employee and company information.

1. Identify the paperwork that should never be destroyed. Certain corporate documents and records need to be kept indefinitely such as: certificates of incorporation, corporate charter, constitution and bylaws, minutes of board of directors meetings, deeds and easements, stock certificate/transfer records, retirement and pension records, labor contracts and license, patent, trademark and registration applications. Financial documents that should be saved indefinitely include: income tax reports, annual financial statements, accounting records and income tax payment checks plus all documents relating to fixed assets owned by the company and depreciated over time. 
    
2. Determine what can be disposed of immediately. Memos, outdated forms, to-do lists, notes, old sales and marketing materials, etc. can all be discarded immediately, without any retention period. While most of this paperwork is harmless, internal documents that contain customer information or proprietary company information need to be shredded as opposed to being disposed of in garbage or recycling containers. This situation highlights why a “shred-all” policy may make sense because shredding every document eliminates any confusion or subjectivity about what constitutes confidential information.
    
3. Understand your industry’s legal compliance retention periods.
   1. Six to seven years. Typically, this information will include sales records such as invoices, monthly statements, shipping papers and customers purchase orders. In addition to sales receipts, you need to keep employee records plus all travel records such as expense statements and receipts.  Financial records that need to be kept include personnel and payroll records, such as payments and reports to taxing authorities, including federal income tax withholding, FICA contributions, unemployment taxes and worker's compensation insurance as well as all bank reconciliations, voided checks, and check stubs.
   2. Three years. Examples of financial information include monthly and quarterly financial statements as well as personnel paperwork including employee applications, benefit records, expired insurance policies and general business correspondence.
       

The security risk occurs because an estimated 60% of Americans do not realize that the copier has a hard drive, and therefore, never sanitize it before selling, giving away or swapping out their current photocopiers. That means would-be thieves simply need to download/print the contents of a copier’s hard drive to gain access to literally thousands of documents – many of which could contain confidential information.

Think this threat isn’t credible? In February 2010, CBS News investigated the photocopier hard drive issue firsthand by going to a warehouse in New Jersey, where they purchased four used printers. It took an IT security expert only minutes to remove the hard drives, run a widely available forensic software program and then download tens of thousands of items in less than 12 hours. The results of the investigation were shocking – domestic violence complaints, pay stubs and even detailed medical records with names, prescriptions and diagnoses. If these documents fell into the wrong hands, not only would they potentially expose innocent victims’ personal information, but also the company that mishandled the printers could receive serious monetary fines and damage to its reputation.

With the seriousness of this threat in mind, what should you do to prevent a copier-related security breach?

• Destroy the hard drive. If a photocopier is slated for an upgrade or removal, have an IT professional remove the hard drive and destroy it thoroughly and securely.
• Consider encryption hardware. Most copier manufacturers offer security or encryption packages that render the hard drive information unreadable.
• Explore specialized products. There are photocopiers products on the market that automatically erase an image from the hard drive, as opposed to storing it.

In addition to these specific precautions, your company can also explore more general practices to improve its overall security that include:

1. Document all information security risks specific to your organization - consider both paper-based and electronic information sources. Of particular importance is data generation, storage, transfer and the information destruction process.
2. Develop/implement policies that control employee access to confidential information.
3. Train your employees in best practices in secure information management and destruction.
4. Destroy all confidential information - in electronic and paper form – after legal retention periods are met.
5. Explore outsourcing information destruction to reputable, professional providers. A high-quality provider can ensure the total security of the information destruction process, and can provide documentation to certify that the chain of custody has been maintained and the work has been completed.

With these tips in mind, you’ll be on your way towards creating a company culture that values and emphasizes the importance of respecting an individual’s privacy. Additionally, by being aware of specific risks such as a photocopier’s hard drive, you can then take proactive steps to incorporate such risks into your comprehensive security policy – creating a better and more secure workplace for employees and customers.

• Consumer reporting agencies
• Resellers of consumer reports
• Lenders
• Insurers
• Employers
• Landlords
• Government agencies
• Mortgage brokers
• Automobile dealers
• Waste disposal companies
   

• Over 1.3 million complaints were received by the CSN (Consumer Sentinel Network) during 2010: 54% fraud complaints; 19% identity theft complaints; and 27% other types of complaints.
• Identity theft was the number one complaint category in the CSN for calendar year 2010 with 19% of the overall complaints.
• A total of 725,087 CSN 2010 complaints were fraud-related. Consumers reported paying over $1.7 billion in those fraud complaints; the median amount paid was $594.

1. Review credit reports. This commonsense step is critical because the sooner you suspect your personal credit or business has become compromised, the quicker you can swing into action by notifying credit agencies, banks, etc.
2. Consider freezing your credit report. Both individuals and businesses are commonly victimized by criminals stealing credit card offers, opening accounts and racking up fraudulent charges on them. While freezing your credit account costs about $30, it prevents anyone from opening new accounts. *The downside is that this freeze must be lifted every time you apply for credit.
3. Secure your computers and wireless connections. Protect your computer from viruses and attacks by using a security programs and scheduling routine scans. It isn’t enough to simply have the security software installed; it also needs to be updated regularly as new threats occur. If your home or business uses wireless internet, the network needs to be secured and password protected.
4. Get an employer identification number (EIN). An EIN is a nine-digit number assigned to a business by the IRS, and by obtaining one, your business can use this number on paperwork as opposed to your personal social security number. By limiting the use of your social security number, you’re reducing the chances of it being seen and stolen.
5. Shred all documents that contain sensitive information. While this tip is the law for business owners, it truly cannot be overemphasized when considering personal and professional security. From credit solicitations to billing receipts and more, your mailbox, recycling bin and garbage are attractive targets for thieves. Consider using a reputable third-party shredding provider to ensure all documents are destroyed securely and thoroughly.
6. Extend your thinking beyond financial identity theft. While most of us think about identity theft in terms of fraudulent purchases, thieves also target medical and criminal record identity theft. These crimes involve people making medical charges under a false identity or even committing crimes using someone else’s name. For individuals, these crimes underscore the importance of monitoring all of your personal information. For businesses, it is an important reminder that thieves are looking for more than just social security numbers and credit card information.

• More comprehensive. Leaving the decision of what constitutes a secure document up to employees introduces a subjective element – and potential risk. If an employee makes a poor judgment, a confidential document could wind up in the garbage or recycling bin, where it could become compromised.
• Improved compliance. Legislation such as the Sarbanes-Oxley Act, USA Patriot Act or Canada’s PIPEDA all mandate certain requirements in regards to information privacy and carry expensive penalties for non-compliance. By implementing a secure shred-all policy, companies can quickly move toward fully-compliant policies.
• Better protection internally. While company-specific documents may not be deemed overtly confidential in terms of the company’s privacy policy, they still may contain proprietary information, trade secrets, customer lists, etc. A shred-all policy eliminates this risk entirely by destroying all printed documents.
• Environmentally friendly. By selecting a high-quality shredding provider that recycles all of the shredded materials, 100% of all discarded materials will be recycled as opposed to some materials getting thrown away as garbage. This environmentally responsible position can be promoted as a point of differentiation.

• Cost. By generating more materials that need shredding, there will be a corresponding increase in the cost of shredding services. This increase in price needs to be factored into the budget, although when one considers the potential costs of a security breach, the relative increase in shredding costs could be easily justified.
• Execution. Implementing a shred-all policy requires a certain amount of preparation and planning. From the placement of secure consoles and collecting the documents to training employees on how the policy works, a shred-all policy must be implemented strategically.

• Equipment.  Although some companies provide laptops for employees working remotely, many do not.  If a computer doesn’t have current anti-virus software, data encryption and firewalls, it may be vulnerable to an attack.


• Wireless connections.  Even the most secure computer hardware can be exposed if it is operating on an unsecured wireless connection.  From improperly configured home networks to public coffee shops, laptops operating on an unsecure connection create an attractive target.


• Weak/duplicate passwords.  Most people know they should use unique passwords and mix both capitalized and lower-case letters with numbers.  Yet, breaches continue to occur when usernames/passwords are hacked from a minimally-secured site, and then used to gain entry to more secure portals.


• Improper document disposal.  From sensitive corporate information to private customer and prospect lists, employees may need to print confidential information as part of their job duties.  Most home offices are not properly equipped to destroy such paperwork securely.

While these risk factors may have the leadership team fearful of telecommuting, there are many commonsense and relatively low-tech ways to reduce the chances of such a security breach. 

1. First, a company needs to create telecommuting security and privacy guidelines so employees have a clear understanding of what constitutes risky behavior and how to minimize such risks. 
2. Additionally, a company should consider providing its employees with laptops so it can control the levels of security and encryption on each machine, plus mandate regular password changes. 
3. Finally, a third-party document shredding company can provide secure locked containers for confidential paperwork disposal and schedule regular pick-ups to destroy such materials.

• Security policies and training. People, whether negligent or intentional, continue to represent the greatest risk when considering workplace security:
  
  • Develop formal information security policies and train employees on how to follow them.
  • Limit access to confidential documents and the number of people who handle them.
  • Show employees that security is a company-wide initiative by management leading by example.

• Information security strategy. With risks and threats continually evolving, it is important to have security best practices in place that:
  
  • Call for regularly-scheduled, periodic security audits.
  • Identify any loopholes or vulnerabilities with the information lifecycle, particularly data storage, transfers and destruction.
  • Pay attention to unique security risks within your business model, examining both electronic and paper-based information.
  • Emphasize building vendor relationships with companies that understand your risks plus best practices and legal compliance.

• Electronic information sources. Websites, networks, emails, software and hardware all present opportunities for security lapses:
  
  • Install and update firewalls, anti-virus software and network protection on all computers.
  • Ensure employees use strong passwords that are changed regularly.
  • Generate individual user accounts for each employeeso each employee can be held accountable for his or her actions on various networks and activity within sensitive files.

• Paper-based information sources. Printed documents containing confidential information pose a tremendous security risk if they are mishandled, lost or stolen so it is important to:
  
  • Store documents that are no longer needed in secure, locked consoles until they are destroyed.
  • Implement a “shred-all” policy so that your employees do nothavetodecide which documents contain sensitive information.  Instead, all documents are securely destroyed on a regular schedule.
  • Examine working with a reputable document shredding provider if sourcing document destruction in -house is not a viable option.
     

1. Examine the entire document lifecycle. Before you can identify any security vulnerabilities, you must first understand your company’s document workflow and lifecycle. From creating the documents to storing and transferring them, many documents touch multiple departments and personnel. The more touch-points, the greater the risks.
2. Develop security policies. By creating an internal document handling process, employees will have a clear understanding of what constitutes a sensitive document, how to handle them properly and what to do in the event of a potential breach or suspicious behavior. Additionally, it is important to research national and local legislation to ensure your new policy is 100% compliant with rules and regulations. 
3. Limit access. The more people who have access to sensitive documents, the greater the risk of a theft or breach. Restrict employee access to confidential data. This should be done based on specific business needs or specific categories of personnel. From limiting access to the record-keeping room to locking filing cabinets, there are many ways to accomplish this task.
4. Perform training. Ongoing updates to privacy legislation and personnel changes mean that it’s not enough to simply create a privacy policy – it also must be adapted and reinforced from the top down. It makes sense to implement quarterly training or retraining sessions so the privacy policy is easily understood and followed. 
5. Destroy documents securely. Confidential documents must be destroyed once they are no longer needed or the legal retention period is met. Secure destruction means they are shredded in such a way that the document cannot be reconstructed, and the intact document is not exposed to risk prior to shredding. This can be accomplished with a regularly-scheduled on site shredding service.
6. Build a culture of respect. With all of the potential hazards for security breaches and identity theft, a company can only minimize the risks it faces, as opposed to eliminating them entirely. Therefore, the company needs to create a culture that values and respects confidentiality and privacy. Employees will be better educated and motivated to adhere to the privacy policy and treat document security as an important company initiative.

1. Concern: Document storage prior to destruction.
   Threat: If confidential documents are stored in open bins or unsecured containers prior to collection, the information is exposed to tremendous risk. After all, anyone who walks by the bins could potentially take whatever sensitive documents piques his/her interest.
   On site solution: Top-notch providers use secure consoles that prevent documents from being removed once they are deposited. Also, look for non-moving consoles to eliminate the possibility of someone stealing the entire unit.


2. Concern: Facility compliance.
   Threat: The very model of off site shredding means that your documents are transported to a different location to be shredded. You’ll likely not have access to the facility where the documents are destroyed and if the facility your shredding vendor uses doesn’t meet compliance regulations, you’d be none the wiser.
   On site solution: Destroying documents on site involves the use of a specially-equipped, secure shredding truck. The shredder is in the back of the truck and destruction takes place right away. Many providers even offer their clients the ability to watch the shredding process on site for added peace of mind.


3. Concern: Transportation.
   Threat:The very act of transporting non-shredded documents to the shredding facility introduces an element of uncertainty and risk. If the transportation vehicle experiences mechanical failure or become involved in an accident, its contents may become compromised. In the event such a problem occurs, your document security can become compromised, too.
   On site solution: There is no transportation of un-shredded materials involved in on site shredding because the documents are loaded into the on site truck and securely destroyed.


4. Concern: Contact with materials.
   Threat: Each person who is in contact with intact, confidential documents poses a potential security threat or opportunity for breach. From the collection agents and drivers to the loading dock handlers and document sorters, you might be amazed and unnerved by how many times your documents are exposed to different people…and risk.
   On site solution:With the documents moving only from secure consoles to the on site truck for immediate shredding, the risk of excess handlers and personnel is removed.


5. Concern: Turnaround time to destruction.
   Threat: As stated in the above point, each person who potentially has access to your confidential documents introduces another element of risk. With that thought in mind, it is not uncommon for off site document shredding providers to leave documents unattended on loading docks, while in the queue to be destroyed. This action introduces yet another opportunity for a security breach.
   On site solution: With the actual shredding occurring on site, documents are never left unattended from the time they arrive at the truck to the moment they are destroyed.

• Breaches are costly events for an organization; the average total cost per reporting company was more than $6.6 million per breach (up from $6.3 million in 2007 and $4.7 million in 2006) and ranged from $613,000 to almost $32 million.
• Cost of lost business continues to carry the highest impact: The cost of lost business continued to be the most costly effect of a breach averaging $4.59 million or $139 per record compromised.  Lost business now accounts for 69 percent of data breach costs, up from 65 percent in 2007, compared to 54 percent in the 2006 study.

Another smart preventative measure is to completely destroy all records that contain confidential information as soon as they are no longer needed for record-keeping or compliance purposes. After all, a lesser amount of confidential paperwork lying around the workplace translates to fewer opportunities for a breach. Instead of purchasing a shredder and hoping it is used diligently, some companies choose to partner with an outsourced document shredding solution. In this partnership, the onus of collecting and destroying documents falls to the outsourced provider. Using this model, your customer, and their loyalty, are as protected as your company.



 

• Cost of document shredders, including maintenance, repair and support contracts.
• Cost of associated supplies such as wastebasket liners and bins.
• Cost of physical space dedicated to shredding equipment and collection bins

• Total cost of staff strictly dedicated to developing document handling protocol and policies
• Total cost of staff dedicated to staying abreast of any changes to related legislation.
• Cost of total average staff hours used to shred the documents.
• Cost of total average staff hours spent in training on document handling best practices and policies.

• Onsite shredding so the documents aren’t exposed to the risks associated with leaving the property and transportation
• Options such as regularly-scheduled service, one-time service and non-paper destruction.
• Flexible service frequency and storage console options.
• Various levels of destruction technology to meet the needs to different document classifications.
• Expertise in establishing an auditable document destruction system that is easy to implement and use.

After carefully considering the importance of protecting your customers, employees and your business from security breaches and possible of identity theft, outsourced shredding solutions may present itself as one of the most cost-effective ways to raise your business’ level of security. Now, unburdened with the challenges of document security, you and your employees can focus on what makes the business successful and prosperous.




To learn more, download our guide to Secure Document Processes Critical to Business Success.



 


 

1. How many people do you employ? We’ll assume 20 for our purposes.
2. How many people in your office need to perform shredding on a daily basis?  A reasonable estimate would be that about half, or 10 people shred documents daily.
3. How long does it take to shred the document? Remember to factor in the time it takes to get to the shredder, remove paper clips and staples, feed the document, etc. We’ll assume 3 minutes/day in this example.

With this challenge in mind, it may make sense to consider a different approach to document shredding that keeps employee productivity high. One such option is to research outsourced document shredding providers. Not only will a reliable document shredding company provide all necessary equipment and collection bins, but also they will collect the materials in an unobtrusive manner that doesn’t disrupt the workflow of your office. You will most likely be paying less than your current $150 a month.   You’ll also have the peace of mind of destroying documents safely and securely – and the added satisfaction of performing it in a manner that ensures employee productivity doesn’t suffer.




To learn more, read the Human Resources Guide to a Total Security Culture





 
 

While every organization is unique, typical risks include a lack of strategic security planning and comprehensive policies, particularly regulating insider access to sensitive information, as well as policy implementation issues. This creates an environment where confidential employee information may be easily mishandled, either through negligence or wrong-doing. This mishandled information is an easy target for identity theft fraudsters who may operate both inside and outside of your organization.
 

• Are there formal policies in place governing the issues of information security in your organization and in your department?
• Is access to employee records restricted to HR professionals and other key personnel?
• Is this access strictly differentiated, based on the specific business needs of specific categories of personnel?
• Do restricted and differentiated access policies apply to both paper-based and electronic employee files?
• Do you monitor your office for printed employee-related documents?
• Is paper waste in your department fully destroyed on a regular basis?

• List all potential risks that may threaten the security of your employee records.
• Examine both paper-based and electronic-information sources; analyze every stage of your workflow and information cycle from data generation and storage to data transfer from location to location and document destruction.
• Create comprehensive information-security policies ensuring your department is fully compliant with companywide policies and procedures, as well as national identity theft and privacy legislation.
• Restrict access to employee records, based on specific business needs of specific categories of personnel. If your organization operates internationally and has centralized information management systems, consider establishing country-specific levels of access.
• Build an organizational culture that values and respects the integrity of employee and other sensitive information.
• Train your staff in secure document management and destruction; implement a shred-all policy, making sure all paper documents are securely destroyed on a regular basis.

To learn more, read the Human Resources Guide to a Total Security Culture

On site shredding is a mobile operation where a specially outfitted truck comes to your place of business and the shredding occurs before they leave your premises. Off site shredding is when your documents are collected from your business and transported to a facility and shredded at a later time or date.

• The shredded paper is typically mixed and compacted into bales for recycling. Some people feel the mixed shredding provides greater security and protection against documents being re-created.
• You’ll receive a Certificate of Destruction, verifying the materials were completely destroyed

• More personnel is involved because the materials must be picked up and transported to the facility before any materials are shredded. It’s critical to verify that all people who have contact with your materials are prescreened.
• Off site service providers often sort the documents prior to shredding in order to improve the recyclability of the paper, leaving your information unnecessarily exposed.
• You don’t have physical access to the documents once they’ve left your office so there is no way to visually view and verify that your confidential documents have been shredded.
• It is difficult to pinpoint how long sensitive information is left unattended or potentially unsecured in queue or a loading dock before it is shredded.
• The actual transportation itself offers another element of uncertainty – does the provider have a redundancy plan in case the transportation vehicle breaks down or is involved in an accident?
• There can be a long time between when it is collected and when the information is shredded, further delaying receipt of a certificate of destruction.

• Your materials are transported after they are destroyed. Any person who handles the shredded paper will not be able to read it. 
• All shredded paper is mixed together in the truck, making it virtually impossible to piece back together. With the materials being destroyed on site, there also is no risk associated with the transportation vehicle breaking down or losing the documents before they are destroyed.
• The materials are securely handled on your premises, so you know exactly who had access to the materials before being destroyed. 
• Documents are not left unattended so they are not exposed to undo risk (example: loading dock)
• You can witness the entire document destruction process AND immediately receive a Certificate of Destruction.

• It typically costs more than off site shredding , as you’re paying for the provider to come to your place of business and destroy the documents

• Can the provider guarantee that not one piece of confidential information is left unshredded? Can you witness the shred?
• Will the provider sign a Business Associate Agreement?   A Business Associate Agreement is a contract between a person or company and its associates who will have access or use confidential information. It is most often seen in the context of working with medical companies and protected health information (PHI).
• When shredded, where does the confidential information go? Landfill? Mill? Other?
• Can you receive the Certificate of Destruction immediately?

• Fraud resulting from exposure of health data has risen from 3% in 2008 to 7% in 2009, a 112% increase (Javelin Strategy and Research)
• Nearly 1.5 million Americans have been victims of medical identity theft with an estimated total cost of $28.6 billion. (Ponemon Institute)
• It takes more than twice the time to detect medical information fraud and the average cost is $12,100, more than twice the cost for other types of identity theft.  (Javelin Strategy and Research)

In the challenging and hectic world of healthcare, destroying sensitive patient information is more than just a moral obligation – it’s also the law. Medical professionals need to take the risk of medical identity theft seriously and take equally serious steps toward preventing it. One such tactic is exploring an outsourced document destruction service. Not only will patients be better protected, but your practice will be too.




To learn more, view our free Preventing Medical Identity Theft Guide

But what exactly constitutes an insider breach? According to the 2009 article, “Myth or not: Most Security Breaches Originate Internally” published by Michael Kassner in the Tech Republic blog, the terms are defined as follows:

• Insiders: Consists of current/former employees and contractors that have permission to access an organization’s computer systems and network.
• Security breach: Defined as a situation where an individual intentionally exceeds or misuses network, system, or data access in a manner that negatively affects the security of the organization’s data, systems, or operations.

While these steps and measures will help prevent an insider breach, it is important to remember another great deterrent – company culture. From the CEO and leadership to customer service and brand ambassadors, creating a company rooted in loyalty, trust and security will help set the expectation that an inside breach is simply not possible when so many employees are committed to “doing the right thing.” Moreover, when this type of culture is merged with the right precautions both digitally and procedurally, the risk for an insider security breach decreases exponentially.




To learn more, download our free Customer Service Guide to Secure Document Destruction and Reputation Management.







 

• Perform an initial security audit.  Identify what data you are collecting, how you are using that data, with who you’re sharing that data and how you are protecting it.  Once you’ve completed the preliminary audit, review processes carefully for loops or lapses that could lead to a breach.  After the initial audit, you’ll need to plan for quarterly ones to ensure your procedures are compliant with the latest regulatory legislation. 
• Develop a privacy policy.  At its basic level, a privacy policy will clarify what data your practice collects and how it is used and protected.  Once the privacy policy is developed, it needs to be communicated to patients as well as internal personnel – plus adhered to!
• Respect patients’ information. When you’re subject to HIPAA regulations, you have legal obligations to obtain consent prior to certain processing activities, including most third-party disclosures of information.  In most cases, aA patient’s data should be used for health purposes only, such as treatment and payment.  A patient’s consent must be sought and obtained prior to engaging in any non-healthcare purposes such as releasing information to financial institutions or selling mailing lists to interested parties.  
• Develop safeguards and redundancies.  As we all know, mistakes can happen – a breach could literally be as simple as transposing two digits in a fax number.  Getting back to the first point,Your must ensure your record fulfillment team has a system of checks and balances that ensures the right information is sent to the right place.
• Destroy sensitive information securely.  Medical identity theft is on the rise, and that’s due in part to the vast amount of confidential patient paperwork that is created in order to maintain compliance.  Waste baskets, recycling bins and unsecured file folders can be easy targets for thieves.  Access to confidential information needs to be limited, or more practically, destroyed securely.  Given the burdens of running a successful and compliant medical practice, it may make sense to consider outsourcing document destruction services.  An outsourced model ensures documents are destroyed safely and thoroughly, plus reduces the burden on internal personnel.
• Training is essential.  Simply put, training cannot be over-emphasized.  HIPAA regulations and privacy legislation are continually updated so compliance is a moving target.  Regularly scheduled employee trainings help staff stay current on changes.  Moreover, by emphasizing training and compliance, you’re able to reinforce the privacy and patient-first company culture.

These suggestions and tips in this brief post are intended to help you find a starting point in reviewing, revising and shaping your internal policies and practices.  While some of the suggested tips such as internal audits may seem daunting, others such as outsourcing a document destruction provider, can be implemented quickly and easily – and make a huge, positive impact on your level on compliance.

As your medical practice grows, doubtlessly the challenges of protecting the privacy of customer data will also continue to expand and increase.  But, the importance of maintaining a compliant practice cannot be overstated.  Not only can violations spell disaster in terms of patient satisfaction and retention but also your medical practice could be exposed to civil and/or criminal prosecution, which could result in large monetary penalties.  In the case of privacy protection and taking precautions against identity theft, preventative measures are truly your practice’s best friend.
 

To learn more view our free Preventing Medical Identity Theft Guide

But, you don’t have to be Jeep or a Fortune 500 company to appreciate the importance of a carefully cultivated and maintained reputation.   Small businesses need to promote, preserve and protect their brand and reputation, too.  In the era of online review sites and social media where everyone (yes, everyone) has a microphone, reputation management matters more than ever for small businesses.  In an article published in July 2008 in Small Business Search Marketing, Matt McGee writes, “We’re doing business in an era when search engines appear to be putting greater value on blogs and user-generated content; when customers are more likely to trust the unfettered comments of their peers; and when anyone unfamiliar with who you are and what you do is likely to type your name into a search engine and ‘Google’ you.”

Given the likelihood that potential customers will be researching your brand online before you even know they are interested, it makes sense to turn a careful eye towards preserving and protecting it.  Reputation management steps include performing research on your own company and product names, seeking peer to peer feedback and ensuring your customer support quickly resolves any client issues.  But what can you do to protect your brand from more insidious reputation problems such as security breaches or identity theft? 

Experts caution that small businesses are more vulnerable to identity theft than larger companies because many SMBs lack the internal procedures or security redundancies to protect themselves from such crimes.

Additionally, small businesses typically don’t have the deep pockets to withstand the monetary damages from a theft.  What’s more, the very issue at the heart of this post – the importance of maintaining a stellar reputation – is now jeopardized, which could result in lost business.

With the importance of protecting a small business from identity theft, what steps should your company be taking today to reduce the risk?
 

• Develop secure processes for the handling and/or destruction of paperwork containing confidential information.
• Invest in software and hardware that provides the latest encryption protection if you complete transactions online.
• Create a company culture of responsibility and security.  When employees are integrated within the company’s philosophy and values, they’ll feel more empowered to “do the right thing.”
• Ensure all new hires are initiated to security processes and understand the importance of following them.

Another opportunity to seek outside services exists within document destruction.  When you think about the sheer volume of paperwork your business produces on a daily basis – billing receipts, credit card transaction slips, employee paperwork and more – there are plenty of opportunities for criminals to harvest sensitive information this information to get into the wrong hands if it isn’t destroyed carefully.  And destroying paperwork is comprised of so much more than placing a shredder in the room with the copier.

Considerations for sound document destruction include: professional grade shredding equipment, timely collection of documents and shredding them on site in a secure environment.  A quality outsourced shredding company can answer all of these needs, plus provide screened personnel that has been trained in best practices for compliant document destruction.
 
By understanding the importance of protecting your small business from identity theftsecurity breaches, which in turn protects its all-important reputation, you can feel confident that your brand can stand up to the press and online feedback.  Even more important, while we’ve examined the need for secure, anti-theft protocols from a reputation management perspective, these security measures to protect consumers are more than a moral obligation – it’s also the law.



To learn more, download our free Customer Service Guide to Secure Document Destruction and Reputation Management. 

 






Or, read the Small Business Guide to Document Security.

1. Spend time on the pre-screening steps.  While such measures are a cost to the company in terms of time and resources, they can quickly spotlight a potential new hire’s problematic tendencies.  Reference calls, credit audits, background checks, motor vehicle records and drug tests are all commonly employed tactics to help determine if an employee is suitable for hire.
2. Create security awareness campaigns.  Many security breaches committed internally are simply a result of carelessness.  Implement regular training sessions for each department to review best practices for internet security, document handling and more.
3. Implement ongoing training.  In conjunction with the IT department, train employees to operate the technology and systems in conformance to all appropriate policies.  As a deterrent, include an overview of how activity is monitored and who is notified on any irregular activities.
4. Educate employees.  With identity theft on the rise, thieves have clearly devised new scams and tactics.  Educate employees about the latest scams thieves use online, via e-mail, and over the phone to try to get them to divulge confidential information.
5. Keep employment records immaculate.  While the IT department will likely be the resource to deactivate logins and credentials, it is the job of human resources to coordinate such communications.  Ensure your company and department has iron-clad communication policies about personnel changes.
6. Determine who needs access.  In keeping with point 5, it also makes sense to conduct periodic audits of employee logins and credentials to ensure their level of access is aligned with their job responsibilities.  It is a security best practice to limit access as much as possible, within reason.
7. Destroy paperwork securely.  While recent headlines about identity theft typically revolve around malware or sophisticated phishing scams, stealing confidential paperwork remains a popular way to commit such a breach.  Implement a company-wide process for the handling of sensitive paperwork such as billing transaction receipts, credit records, employee paperwork, etc.  Considering the vast amount of paperwork produced, and that destroying it securely requires more than a shredder from the local office supply store, it may make sense to turn to an outside, accredited document destruction provider.
8. Build a culture of trust.  From incentivizing quality employee referrals and rewarding outstanding attendance records to company parties or a sympathetic sounding board, the human resources department has many ways to build a culture of trust with employees.  Once such a culture is built and cultivated, employees feel committed to the success of the organization and more empowered should they see a security breach or hear of plans for such an event.

• Shred everything on a regular basis. By implementing “shred all” policies, you avoid the risks of human error or poor judgment about what needs to be shredded.
• Shred before recycling. Don’t let confidential documents sit unattended in recycling bins
• Create a culture of security. Train all employees in information security best practices to reduce human error. Explain why it’s important, and conduct regular security audits of your office to assess security performance.
• Think prevention, not reaction. Instead of just dealing with breaches as they happen, develop preventative approaches that are strategic, integrated and long-term, such as eliminating security risks at the source and permanently securing the entire document lifecycle in every part of your organization.

While a company can implement its own paperwork destruction procedures, they also then must allocate the time and resources to ensure the document destruction occurs at regular intervals and the paperwork cannot be reconstructed.  Professional document destruction services exist for this very reason and provide more than just state of the art equipment.  They can also destroy documents onsite so businesses know sensitive paperwork has not left their premises.  Some document destruction services raise the bar even higher with personnel that are trained in identity theft legislation compliance so they can ensure best practices are instituted and followed.  By trusting professionals to handle this important part of running an aboveboard and compliant operation, companies are now able to focus on doing what makes them successful without the fear of a major security breach.





To learn more, download our free Customer Service Guide to Secure Document Destruction and Reputation Management








 

• Financial reserves.  Identity theft is a cruel financial blow for any organization, but SMBs are particularly vulnerable because their financial position is often more precarious, with much smaller on-hand cash reserves to combat fraud. 
• Legal resources.  Larger corporations typically have onsite legal teams who can provide counsel in the event of a security breach.  SMBs rarely have access to such resources and support.
• Standardized policies.  Many SMBs are so focused on a growth strategy that internal “housekeeping” issues such as security policies and compliance requirements are often relegated to the back burner, leaving them exposed to risk.
• Human resource departments.  Due to their smaller size, many SMBs don’t employ human resource personnel.  Since the onus of keeping employee paperwork secure falls to HR, this omission can expose sensitive information to potential risks.  Additionally, HR handles the screening of new hires, so without an HR department, employees may not be screened as thoroughly.

• Patients’ records are accidentally faxed or mailed to the wrong person
• Medical records are stolen and misused after being disposed of improperly
• Laptops containing confidential information or medical records are lost or stolen
• Medical files left unattended in file rooms, on staff desks and in door folders; or unrestricted physical access to sensitive medical files.

• Developing stringent and enforceable policies regulating access to sensitive patient information, as well as the protocols for authorization and authentication of individuals accessing health information.
• Designating an annual budget for security management systems
• Training employees on current HIPAA legislation and ensuring it is followed
• Destroying sensitive documents in a timely manner
• Partner with a document destruction specialist to audit your operations to help your organization identify gaps in security.