In actions brought by 16 states and the federal government, a medical record service provider paid a total of $1 million for having draft-like policies and failing to act on known system vulnerabilities. A key prosecution weapon was an all-access pass into the company's behind-the-scenes security discussions a pass that could have been limited, if not prevented, had counsel been included at the right time.
A company's security practices will take the stage in breach litigation; when they do, they need to leave a good impression. Company policies, incident response plans, and other efforts will be reviewed with scrutiny following a breach, so they should not only be in final form (without any draft markings) but also clearly communicate how the company protects information.
Some stages of privacy and security plan development are betterkept internal. It is important that data in need of protection whether of a customer, employee, or thecompany itself is appropriately identified as needing protection and actually protected. In addition,however, any discussions behind security efforts have the potential to reveal infrastructure weaknessesand marketing strategies. It's important to protect this information from unwanted attention as well.
If your company hasn't determined what it knows (and doesn't know), a security risk assessment is key to identifying both gaps in policies and security measures that need to be addressed and how your company should respond to incidents involving information. As part of that process, privacy and security discussions should include counsel early on to help ensure not only that all possible legal ramifications are considered, but also that conversations about such ramifications are appropriately protected.
Using outside counsel in the engagement of external assessment firms, a company may successfully assert attorney-client privilege over the discussions and what-ifs behind the performance and documentation of the assessment. In addition to determining what may be protected by privilege and what may need to be released (for examination by a regulatory authority), counsel may also assist in developing the narrative connecting all of those components to make sure that the audience for your efforts gets the whole show.