Pulse - June 2021 - 22

TOOLS FOR SUCCESS
DATA PRIVACY LAWS
The law calls for companies to " implement and maintain reasonable
security procedures "
Tony McReynolds, courtesy of AAHA
W
ith the lack of direction in Washington, it's
not surprising that other states have taken a
cue from California and drafted their own
privacy laws. Before we look at individual CCPA
" copycat " laws from New York, Massachusetts, and
other states, let's first review California's privacy law,
which is the envy of the nation and soon to come to
your state. Is your practice ready?
In 2018, the California Consumer Privacy Act (CCPA) was
signed into law. Its goal is to extend consumer privacy protections
to the internet. It's not an exaggeration to say the CCPA
is the most comprehensive internet-focused data privacy legislation
in the US, and with no equivalent at the federal level.
If you use a cloud based practice management system. It's
looking at you. It's no longer just about financial or health
related information.
A striking innovation within the CCPA is its very broad
definition of personal information:
(1) " Personal information " means information that identifies,
relates to, describes, is capable of being associated with, or
could reasonably be linked, directly or indirectly, with a particular
consumer or household. Personal information includes,
but is not limited to, the following:
Identifiers such as a real name, alias, postal address, unique
personal identifier, online identifier Internet Protocol address,
email address, account name, social security number, driver's
license number, passport number, or other similar identifiers.
(D) Commercial information, including records of personal
property, products or services purchased, obtained, or
considered, or other purchasing or consuming histories or
tendencies
In short while you may not think that pet parent and pet
patient data is valuable enough to protect. The regulatory
authorities do. If you don't take reasonable security measures
to protect that data, your practice will be held liable.
Reasonable Security Procedures
(a) (1) Any consumer whose nonencrypted or nonredacted
personal information, as defined in subparagraph (A) of paragraph
(1) of subdivision (d) of Section 1798.81.5, is subject
to an unauthorized access and exfiltration, theft, or disclosure
as a result of the business' violation of the duty to implement
and maintain reasonable security procedures....
A few practices worry about the ramification of ransomware.
With the new two stage ransomware and consumer
22
JUNE 2021
PULSE
data protection regulations leaves most veterinary practices
exposed.
* Infiltrate the network, steal all and any business related data
* Request a ransom or the hacker will sell and release the
information onto the dark web.
* Encrypt the entire network so that you can't access it.
Most practices have very little if any data protections in
place. This creates for a double threat. Losing years of practice
data + Fines and legal fees from the state legislators.
The Good News
It doesn't have to be expensive or complicated to take reasonable
measures to protect your data. Here are a couple reasonable
measures you can take to start to protect your data.
1) Realize you have data that is valuable
2) Get Cyber Security training for your staff
If you need any help protecting your practice contact us to
schedule your IT Security Audit. Download and follow the steps
in our " 5 Simple Steps to Protect Your Practice " eBook. P
Peace Love & Plants, Clint Latham J.D. clint@lucca.vet www.lucca.vet
http://www.lucca.vet
Pulse - June 2021

Table of Contents for the Digital Edition of Pulse - June 2021
