In
today’s
fast-moving,
hyper-connected
world,
legal
and
compliance
teams
shield
organizations
from
a
constant
stream
of
internal
and
external
threats
to
sensitive
data.
Effectively
countering
these
threats
requires
more
than
simply
erecting
strong
controls;
it
requires
navigating
the
complex,
shifting
landscape
of
privacy
and
data
protection
laws.
Privacy
and
cybersecurity
laws
and
regulations
change
constantly.
Laws
such
as
the
Health
Insurance
Portability
and
Accountability
Act
(HIPAA)
stringently
control
how
organizations
manage,
store,
use,
and
protect
data
within
their
scope.
And
literally
every
state
has
laws
that
may
also
bear
on
privacy,
security,
or
both.
Noncompliance
can
result
in
reputational
harm,
financial
penalties
and
damages,
or
even
long-term
consent
decrees.
Addressing
these
requirements
requires
people,
process,
and
technology
controls.
But
as
good
as
process
and
technology
get,
humans
remain
the
weakest
link.
I’ve
seen
seemingly
small
mistakes,
such
as
leaving
confidential
documents
on
a
printer
or
sending
sensitive
information
to
the
wrong
recipient,
escalate
into
major
compliance
issues.
For
instance,
a
pharmacy’s
training
video
once
inadvertently
revealed
sensitive
health
information
–
a
patient’s
name,
prescription
details,
and
medical
diagnosis
–
leading
to
multiple
federal
investigations.
While
awful
for
the
organization
involved,
this
underscores
a
broader
point:
That
staff
in
every
department
must
understand
their
role
in
protecting
sensitive
information.
Since
legal
and
compliance
teams
can’t
be
everywhere,
training
is
an
essential
tool.
Regular,
targeted
training
helps
employees
better
understand
their
critical
role
in
data
protection
and
avoid
potential
lapses.
Real
world
examples
like
that
pharmacy
training
video
powerfully
illustrate
the
importance
of
compliance.
Training
must
accompany
and
foster
a
culture
of
accountability
and
awareness.
Employees
should
feel
comfortable
questioning
the
need
for
certain
data
and
explaining
how
and
why
they
follow
established
procedures
when
handling
sensitive
information.
Organizations
must
also
engage
in
cybersecurity
tabletop
exercises
so
everyone
knows
how
to
respond
in
an
emergency,
and
hold
regular
data
protection
tests
to
help
avoid
one.
When
incidents
occur,
a
coordinated
reactive
strategy
is
as
vital
as
proactive
prevention.
Legal
and
compliance
teams
must
work
closely
with
IT
and
security
departments
to
deploy
a
swift,
effective
response,
analyze
breaches,
determine
cause
and
exposure,
and
identify
and
enact
remediations.
Post-incident
reviews
should
focus
on
root
cause
analysis,
letting
organizations
learn
from
mistakes
and
opportunities.
Not
every
compliance
risk
or
effort
is
internal.
Data
may
flow
between
organizations
in
unseen
virtual
rivers.
Therefore,
it’s
crucial
to
ensure
that
a
company
understands
these
data
flows
and
that
its
vendors
who
receive
information
maintain
high
privacy
and
security
standards
for
data
in
transit
and
at
rest.
Simple
questions
and
processes
can
help
unearth
potential
red
flags.
For
a
vendor,
such
questions
might
include:
-
Tell
me
about
your
privacy
and
cybersecurity
teams.
How
many
people
are
on
these
teams?
What
are
their
credentials
and
training? -
Can
you
share
your
incident
response
plan?
Please
provide
a
real-world
example
of
the
plan
in
action. -
What
strategies
do
you
employ
to
protect
data
and
ensure
it
is
used
and
disclosed
properly? -
Can
you
share
details
about
your
access
control
measures? -
How
do
you
train
your
teams? -
How
do
you
test
the
effectiveness
of
your
data
protection
measures?
As
legal
and
compliance
professionals,
we
champion
privacy
and
cybersecurity
in
our
organizations,
but
success
requires
a
team
effort.
Building
resilient,
actionable
frameworks
that
meet
regulatory
requirements
but
also
instill
trust,
confidence,
and
reliability
enables
success.
Fortunately,
with
diligence,
thoughtfulness,
a
culture
of
compliance,
and
strategic
action,
we
can
navigate
this
complex
terrain,
safeguarding
our
companies,
colleagues,
leaders,
and
partners.
Photo:
anyaberkut,
Getty
Images
Shara
Rasmussen
is
Deputy
General
Counsel,
VP
Privacy,
Risk,
and
Compliance
at
Collective
Health.
She
is
an
experienced
compliance
and
privacy
professional
who
has
also
served
as
Chief
Compliance
and
Privacy
Officer
at
VillageMD
and
Executive
Director
of
Corporate
Responsibility
at
AdventHealth.
Rasmussen
holds
a
JD
in
Health
Law
from
Loyola
University
Chicago
School
of
Law,
an
MPH
in
Public
Health,
and
a
BA
in
Psychology
from
the
University
of
North
Carolina
at
Chapel
Hill.
She
also
holds
professional
certifications
in
healthcare
compliance
and
privacy
compliance.
This
post
appears
through
the MedCity
Influencers
program.
Anyone
can
publish
their
perspective
on
business
and
innovation
in
healthcare
on
MedCity
News
through
MedCity
Influencers. Click
here
to
find
out
how.