A key factor in minimizing the risk of a breach when working with business associates is to provide these partners with the minimum amount of information they need to perform their services, says security expert Brian Lapidus.
The new virtualization guidance issued by the PCI Security Standards Council urges organizations to take a risk-based approach when dealing with virtualization methods, especially within cardholder data environments.
The release of the list coincides with the issuance of the Common Weakness Scoring System that allows software makers to identify vulnerabilities in their programs and buyers to determine software they acquire is secure.
In a case weighing privacy vs. free speech, the U.S. Supreme Court has struck down a Vermont law that requires physicians to give their consent before information about their prescription-writing habits can be sold to help market prescription drugs.
Federal officials should offer detailed guidance on how to conduct a "risk of harm" assessment to comply with the HITECH Act Breach Notification Rule, says Harry Rhodes, director of practice leadership at the American Health Information Management Association.