http://shrinkster.com/17ls

I know someone (BruceW?) posted this here last week, but I can't seem to
locate the original posting.

The headline reads: "Abandoned business records can't be destroyed"  but
that isn't a completely accurate characterization of the actual text of the
bill, AB1094.

The article goes on to state:

"The bill is the first of its type in the nation, said Joanne McNabb, who
heads the state's information security office, and it's intended to prevent
abandoned records from being dropped into the trash or hard drives from
being sold on eBay."

Which is a bit more accurate- it prevents landlords who find records that
reflect PII or PHI abandoned in place, or commercial storage vendors who
have clients default on contracts for "dumping" the records, but instead
requires them to be properly disposed of, based on the type of information
they include.

The manner in which this will be enforced is still being determined, and
it's apparent the people working on developing the guidelines aren't too
clear on the concept yet, given these comments in the article:

"For example, she said, the Department of Defense has a triple-overwrite
standard for destroying electronic records that renders them truly unreadable."

Those of us who have spent years managing this type of information KNOW this
isn't the most effective way of eliminating electronic records from either
media or hard drives- you simply destroy them, rendering the content unreadable.

"Also, landlords could charge a fee, similar to a security deposit, to cover
the costs of disposal if tenants abandon their records."

And I think everyone knows how THIS would go over, in either the case of a
landlord OR a commercial service provider... a landlord would have NO WAY of
knowing how much information a tenant might have and what portion of it
contains PHI or PII, and they are not covered by a Business Associates
Agreement, so by law, they are not authorized to inspect the records.  

As for a commercial service provider storing the records, they charge for
storage a minimum of one month in advance, and if they are in regular
contact with a client (rather than waiting months to make contact) they
would know much sooner that they had closed down.  I can tell you though,
the first vendor that seeks to build a fee in to cover themselves in the
eventuality a client goes out of business is going to lose a ton of
business.  And unless they develop some formula to pay interest on that
"deposit" they take in, they'll come up against a legal challenge for
holding that money.  

It will be interesting to see how this develops...  

Larry
[log in to unmask] 

List archives at http://lists.ufl.edu/archives/recmgmt-l.html
Contact [log in to unmask] for assistance
To unsubscribe from this list, click the below link. If not already present, place UNSUBSCRIBE RECMGMT-L or UNSUB RECMGMT-L in the body of the message.
mailto:[log in to unmask]