2011 Data Security and Privacy Trends

Contact me at witsowitz@m2powerinc.com for a copy of the 2011 Data Security and Privacy Trends. You will be surprised and it will affect more small businesses and professions such as medicine, law, and accounting.

House and Senate Pass Red Flag Exclusion

The House and Senate agreed that physicians should not be identified as creditors under the FTC regulation known as the Red Flag Rule. It now awaits President Obama's signature. That does not mean that the medical industry has dodged a bullet in its responsibilities to protect identities.

While emphasis is on HIPAA as it relates to privacy and identity theft protection, let us not forget that as much as they may be intertwined in data collection and storage requirements they are not intertwined events when used criminally. One can steal an identity and not PHI [protected health information] and vice versa. There is no criminal trafficking of PHI. There is criminal trafficking of identities. Identity theft is lucrative and desired among thieves. It's easy to steal and in medicine it is used to gain access to expensive treatments and drugs. It is also lucrative because it is a repeatable crime that only requires gaining access to the information one time and using it or selling it over and over again. Once identities are stolen it can victimize individuals for years.

PHI, if inappropriately leaked, subjects medical personnel to consequences based upon company policy and subjects the company to HIPAA violations. The harm to the patient in most cases is either embarrassment or personal damages (including possibly economic). Identity theft subjects patients to potential loss of life, limb and civil liberties because there is more than one record out on the same identity. Talk about medical errors.... How is the doctor, NP, RN, or PA charged with treating the patient going to know which is right? How is a receptionist in an ER room or doctor's office going to know? The answer is they can't know 100% for sure.

Be advised that a trend is appearing among state attorney generals that if HIPAA violations occur, they will tack on requirements to include identity restoration as part of the damages. Connecticut was the first to shoot that arrow over the bow and many more are following. Massachusetts set a law in place that if you have a Massachusetts resident doing business in your organization that you are subject to Massachusetts identity laws or don't do business with a Massachusetts resident. The same goes for treating them. So the subject of identity theft is not going away nor is the obligations to conform to state requirements and among other authorities.

While I empathize with my medical industry brethren about not wanting to duplicate or add on any more unfunded mandates than is humanly able, this is one "red flag" we simply cannot ignore. It infiltrates our communities, our schools, our jobs, and our friends and families. It costs more financial loss than HIPAA violations. It cannot be stopped only controlled. Following HIPAA guidelines in good faith is prudent. When you protect an identity you not only save the company and your jobs, but you also save people a lifetime of heart ache and you save their lives.

Keeping Your Identity Safe During the Holidays

Our exposure to Identity theft is stronger during the holiday season.
Kroll Fraud Solutions Center posted the following tips to keep your personal information safer

Tip#1

Before you hit the stores, the very first thing you should do is take stock of what you are bringing along with you. Clean out your purse or wallet and remove unnecessary key identity components or valuables. Take inventory of whatever you will be carrying. That way, you’ll know what was taken if your purse or wallet is lost or stolen.

For added protection, keep your valuables with you at all times – your purse, wallet, or cell phone is not safer in your locked car than in your possession. Thieves know this is a common habit and will be scanning the parking lots looking for cars they can break in to.

Consider your preferred method of payment before heading out – there are pros and cons to each, and it’s up to the consumer to determine which best suits his or her needs. Generally, from a theft standpoint, credit cards are a safer bet because, unlike debit cards, you usually have more protection against fraudulent charges – many credit cards have a zero liability policy. Cash is another option, but while you will not have to worry about personal identifiers, it will be gone for good if your purse or wallet is stolen. Take your checkbook only if it’s absolutely necessary – stolen checks can turn into an ongoing forgery nightmare and give the thief direct access to your checking account.

Finally, be stingy with your personal information. If a store clerk asks what seems like too much personal information during a transaction, remember that you have a right to ask why it’s needed. Some stores ask for phone numbers or zip codes for customer tracking – sharing this information won’t necessarily increase your risk of identity theft. Beware of shoulder surfers and shield your PIN number while entering it on a keypad. Resist the temptation to apply for credit at the register – you may get a hefty discount on your purchases, but there’s added risk at this time of year that your identifiers will be exposed. Someone may overhear your information or, if it is written down, the paperwork can be easily misplaced.

Tip#2

Contrary to popular belief, online shopping does not necessarily carry any additional risk for identity theft than shopping in the store, provided you are taking reasonable precautions. However, it’s important to remember that thieves generally step up their activities during the holiday season – the increase in online traffic and transaction levels offer plenty of opportunities to steal data.

It sort of goes without saying, but you should never use a public computer (like those found at the library) to perform online financial transactions. Likewise, if the coffee shop is offering free – yet unsecured – wi-fi, don’t be tempted to buy anything there, either. These are high-risk scenarios that offer little protection to the consumer. You never know if a public computer contains spyware, such as a keylogger or some type of malware, and it is very easy for thieves to steal data via unsecured wireless internet hookup.

Even when using a computer you trust, you should make sure you have installed your security software’s latest update and run a scan of your computer. Beyond that, practice smart shopping by visiting reputable sites and being careful not to fall for phishing scams that will try to trick you into giving up or exposing personal information. Some sites may offer great deals, but be skeptical about the level of safety they provide for financial transactions.

Just as you would keep receipts from the stores, keep a record of all your online transactions. Check your debit/credit accounts daily and make sure only the transactions you’ve authorized have been registered. If you see any unauthorized transactions, dispute them with your financial institution immediately. If you haven’t received your monthly statement, call the financial institution to verify that no one has changed the address on your account.

Contact me for more information about how you can protect your identity and that of your company as well.

Happy Thanksgiving

Is this really the age of healthcare reform?

While suggestions and solutions about how to fix healthcare vary, what is clear is that the election is not resulting in new ideas only rhetoric and fear of change for the purpose of swaying votes. It is about the people or is it about the party?

What is also clear is that the strategy to decide how to reform healthcare in our communities is based on money. Hasn't that strategy already demonstrated how faulty it is? It is not to say that money should not be a consideration. It is to say that money should not be the leading criteria.

For example many doctors grappling with how to shape their practices in the coming decade tend to decide based upon the ability to earn more money first and infrastructure second. When considering whether to become an accountable care organization in the next 14 months most physicians speak about the end result of gaining more income.

History will tell you time and again the failures of approaching growth in that specific manner. Yet like countless of other fads we've seen in the past 20 years, the hype is driving action rather than reality. Becoming an accountable care organization is a good idea that requires a great deal of thought least of which should be about the shared savings physicians may or may not enjoy.

Until we are willing to change our viewpoints about what's really important and in what order of importance, healthcare reform will not succeed well whether under Republican, Democrat, Independent, Libertarian, Social, or Green rule. Is it about the people or is it about the doctor? Is it about the people or is it about the party? Is it about the people or is it about money? As patients we need to do the same. Is it about the care and the cost of it or is it about the value of it and how you define value of care?

Perhaps healthcare should be approached like a business model with a social responsibility. It encompasses so much more than how to make more money or how to save it. Using the 6P method established by Kris Rajan of CoGrow Inc, a practice would have a better chance at long term success.

You can find the 6P model in the book "The Blatant Truth About Owning A Medical Practice".

Identity Theft up 123%

According to a report by the US Treasury Department, identity theft rose 123% in the past 5 years. The question that begs to be asked is why we aren't taking it seriously? Most believe that monitoring will be enough. What if I told you that monitoring only covers less than 20% of identity theft? Most of identity theft has nothing to do with credit cards and credit reports and if you wait for it to notify you, it's too late.

When you think that all it takes is knowing your name and your date of birth to steal your identity then everyone is at risk because the only form of proving your identity is your driver's license and it has enough information to steal it, use it, and repeatedly abuse it for years to come.

Protecting it is useless if it doesn't include a plan what you are going to do when it happens to you. Ask the 22 year old I met at Applebees the other day when I inquired about how they ID people. Her identity was stolen when she was 6 years old and she just found out. Six hundred hours won't begin to cover what has to be reversed in her case. The cost will be with her for a lifetime. For others the cost will be their lives.

State of Connecticut Acts

Five Days ago the State of Connecticut imposed upon all licensed insurance agents, of any type, the responsibility of reporting any identity theft breaches their clients inform them about to the attorney general's office. The attorney general has already taken the stance that any privacy breach that occurs in their state will require identity theft consultation and recovery as part of a company's responsibilities.

Three and one half percent of identities stolen are compromised and the costs to business grows exponentially. Not too many companies do full restoration really. Connecticut fired the first shot. How far behind do you think other states are in enacting the same requirements?

So tell me have you done your privacy prebreach preparedness yet? Do you know if it was done well? Take my test and find out.

As it relates to identity protection "How Naked Are You?" Take the Test. Get Your Score.

For Propriety Sake

For Propriety Sake

My mother passed away four months ago. Recently I began receiving solicitations by mail offering my Mom free services and discounts to local businesses. When I called them to find out how they got my address in New York connected with my Mom’s name from Florida, they told me they bought it from a list broker. When I inquired again with the list brokers, I was advised that they buy their lists from the credit bureaus. Yes you read it right. Experian, Equifax, and Transunion sell our information to list brokers for a fee.

It appears that when we advise credit card companies of the death of a credit card holder they record the correspondent address of the next of kin in their records. They then contact the credit agencies of a change of address which is mistaken as a move to a new neighborhood. As such the list is sold to local business as a new move. While the social security administration is responsible to notify the credit bureaus of a loved one’s demise, it will take a long period of time, leaving the door open to these disconcerting actions.

What is equally troubling is the ability to get all three agencies to stop selling it. The online and customer service centers are designed to work with live individuals who have had their credit reports compromised. There is no support for the death of a loved one. After two months of trying I finally went to the corporate offices of each credit bureau. One effort required getting help at the president’s office.

Here’s what you need to know in order to remove your lost loved one’s information:

• Get a copy of the death certificate.

• Contact Transunion at 800-987-3670 and request Mary Litwa or her department. She will then request you fax her a copy of the death certificate. Stress that you are requesting the suppression of your loved one’s information.

• Contact Equifax at 404 885-800. Request someone in special disputes. They will provide direction to fax the death certificate to 888 826-0573. However you will need to talk to them first to provide appropriate information.

• Send a letter to Experian with a copy of the death certificate and power of attorney or proof of executorship to PO Box 9701 Allen, Tx 75013. Request the “opt out” department.

• Contact the Direct mail association online at https://www.ims-dm.com/cgi/ddnc.php. Register the information of your loved one to stop mail solicitations.

• Make sure you have identity theft protection for your parents long before they become ill and need our support to protect their identities in life and in death. Go to www.ID247.com to get the most support as well as a discount. Contact me for the discount code. They were recently rated by consumer magazine and a copy of that article is available by emailing ester.horowitz@apsaintl.com. Put in the subject consumer magazine.

Identity theft is a growing crime. Dormant social security numbers are a panacea for thieves once it is discovered that is it dormant due to death, incarceration, or an underage child. Don’t give them the chance to learn it. Make sure you notify the primary credit bureaus to suppress the use of their information for any reason.

Business Owners Hate Spending Money on What they Can't See

I had a conversation today about trying to get business owners to recognize that they need to comply with certain laws. While the choir understands that not doing so puts businesses at risk, the choir still can't get why the business and the owner is willing to take their chances despite law.

I stated that business owners and small businesses are reluctant to pay for something that doesn't have an immediate ROI emotionally or economically. For example, if a supplement company were given an opportunity to distribute their product internationally for the cost of liability insurance, they are motivated to make the investment provided the opportunity far exceeds the cost. But the same company may not want to purchase liability if it involved something more remote like PCI compliance when they don't see the value. Especially in unfunded mandates. Every company is subject to one or more of five major privacy mandates and all of them are unfunded. Most companies don't even know they are required.

In addition, they are unwilling to part with funds for something that has a million and one chance of ever happening in their eyes. "We're too small for anyone to care" is the usual mantra. However, when it comes to identity theft, it only takes one to put a small business out of business. The likelihood is not "if" but "when" and far greater than all of the other risks that businesses must contemplate.

So how do you motivate a business or organization to comply? Fear doesn't work because most companies are immune to what feels remote them. Instead, what hits home now? Did a customer loose a wallet or have a credit card turn down? Did an employee have a credit problem due to a bad profile? Did the company computers get infected or go down for any length of time recently? Did an employee loose a laptop or blackberry? Ask who they turned to when it happen and why?

Another way is to show companies how unfunded mandates actually have hidden wealth opportunities they can acquire immediately in employee morale, growth opportunities, and economically. If you are interested email me at witsowitz@verizon.net and write in the subject "Wealth in Unfunded Mandates".

New Technology to Fight Identity Theft

Governor Patterson, of New York, declared that New York is a hotbed for terrorism and he states “New York has a target on its back as the epicenter, the source of terrorism, with a very unique population". In February, the state began using facial recognition software to reduce the ability for identity theives from requesting multiple licenses. So far 1000 cases have been thwarted.

But we all know that it is human nature to find ways to get around any road block when a thief is bent on stealing identities. So for now, we can breath a bit... but not for long because as well all know, there is no fail safe method.

What his news has acknowledge is that it is very real. It confirms the use of identity theft as a terrorist strategy. It has infiltrated our communities and daily doings including among our children . All the things that I've been saying all along.

Strategy is as Strategy Does Which Do you Do?

Due to the nature of what I do in identity theft, a colleague convinced me, after 20+ years of others trying, to get my insurance license. “What did I say to convince you” she asked. "Good timing" was my answer. It involved making sure that having an insurance license made sense in furthering the strategies and goals of the company’s business model. Not simply for the sake of earning additional income. The knowledge acquired along the way helped me to better understand risk in a way I couldn’t before.

As a company that is built on growing other organizations, I state that you cannot grow what you don’t protect routinely. In today’s environment that has never been truer. There is a difference between strategizing your business model and strategizing your activities in the business. Which are you doing? Which one should you focus upon? Taking it one step further, are you sharing it with your employees?

Our Nation Is Unprepared According to CSIS Study

Center for Strategic and International Studies (CSIS) recently issued a study called “A Human Capital Crisis in Cybersecurity,” that highlights how the United States is facing a chronic shortage in cybersecurity experts. According to the study our nation is in a very weak position when it comes to cyber security and our nation is unprepared to defend itself against increasingly sophisticated online attacks.

And you wonder why identity theft is rising. Forty percent of privacy breaches are cyber related. It is not that your IT support is not good at what they do. It is because there is no fail safe method.

Business Identity Theft

In today’s global, national, regional, and local business markets you cannot grow what you don’t protect. In professions like medicine, finance, and insurance, an organization cannot grow if it doesn’t meet certain criteria that not only encourages expansion but legally allows it. That includes such things as marketing tactics that meet ethical, federal, and state regulations. Yet in our desire to expand, acquire new customers, and reap gainful returns, we over look how our image, our brand, and our business can be hijacked. It’s a rising form of identity theft that overwhelms and sometimes wrecks organizations.

Recently the Colorado State Attorney General and the Colorado Secretary of State created an avenue in which business can come and file a complaint about their company being a victim of identity theft. That is not a common practice in most states yet. Even with state support, the ability to find criminals and prosecute them is quite difficult. Resources will only be allocated to high profile cases.

If you think that the organization is too small or too large for anyone to bother, think again. Most times a business will not know that their identities are being used elsewhere. So what is a business to do? Contact me for a check list of what you can do to protect your business better.

ID Theft, Fraud, and Real Estate Transactions: Save a World of Hurt

The real estate process generally includes a buyer (or renter), seller (or landlord), financial officer, lawyer, and agent to execute the sale successfully. Within that process many more people become involved. Depending upon the deal, it includes a prequalified mortgage, credit check, offer to purchase (or rent), contract (or lease), mortgage application ($$$ paid in advance), title insurance, exterminator, homeowner’s insurance, closing, and recording the sale among it. The amount of people and sets of eyes that look at every detail of the transaction becomes an easy target for identity theft. [I have not even touched what happens after the transaction is completed … a conversation for another day.]

When you consider that eighty percent of identity theft occurs from negligence due to lack of knowledge or lack of care, and the fact that the sale is recorded for public scrutiny, it leaves every new homeowner and every old homeowner at much higher risk. Never mind the number of people that view the property in the process which may have access to enough information within view. (No one thinks of these things do they?)

This week alone, an IT guy employed by a major bank was arrested for bilking millions from both employees and unsuspecting consumers. What makes you think that identity theft doesn’t happen in real estate transactions?

Despite new laws governing how everyone in the chain of events must act with respect to the real estate transaction, there is no law that says you can’t recommend identity theft protection as a standard policy. What the feds want is transparency and clean lines of relationships.

Add a standard recommendation to every home buyer (renter) and seller (landlord) that they should consider identity theft protection. It will save a world of hurt later. Identity theft is a repeatable crime.

It will also demonstrate that the organization goes one-step beyond the FTC and State identity theft law to make consumers and landowners aware they are vulnerable and empower them with what they can do about it.

There is no statute of limitation for identity theft. If the buyer/seller decline to obtain services, then you have it as a matter of record. They can’t turn around and tell you that you didn’t advise them, making you criminally or civilly liable later. Think about it and then email me at services@m2powerinc.com to learn how to develop an identity theft and fraud program in your organization.

Life Paid Me Back

The foundation of any successful business has a set of immutable laws that bring with it the values, mores, and experiences of the owner. They are the same laws found in life. So it is appropriate to share this next blog with you.

Life Paid Me Back

When I was six months pregnant with my little daughter, my husband received a catastrophic diagnosis that would change the dynamic of our family. My little daughter was born in a time of turbulence where I became a single parent never being able to give her the kind of devotion and adoring attention that my eldest daughter received.

Reality and survival got in the way and I often felt my baby was cheated out of the white picket fence scenario that allows Mommy to stay home. In my mind every child deserved to have that experience as they come into this world. Now, twenty six years later, as my baby embarks upon her own independence, I realize that life does pay back what it took in the first place.

Catastrophic experiences have a way of reshaping long held beliefs and perceptions. It opens the door to uncharted possibilities. For both my daughters it resulted in them becoming young women of courage and tenacity that I not only respect and admire but they grew into these amazing people.

As I face the prospect of an empty nest, I am blessed that my little daughter decided to come back home from college and spend the past few years inviting me happily into her adventures. It includes the current one which involves helping her find her first apartment.

With my eldest daughter married, the last three years has given my youngest and I a joy that can only be shared by bonds born from a journey resulting in the reshaping of three lives - her sister’s, hers, and mine. Looking back I realize the decisions I made then were the right ones even if they were the scariest. I learned that courage is the not absence of fear but the ability to strive and thrive despite it. The commitment took desire and perseverance over a 10 year period of time that included overcoming the severe economic disaster from my first husband’s illness, with a dose of goals and strategic planning.

It’s a lesson that seemed to play out over and over again last year in front of my now grown daughters as we watched three close family members experience catastrophic disasters one after the other. Two out of the three survived. It also played out in my baby not making career decisions based upon fear but pushing past them to embark on better career paths.

As my little daughter searches Manhattan for that right mix of neighborhood, space, and amenities for a particular price, it not only allows me the chance to emotionally let her go, but it fulfills a wish from so long ago. To give my baby the opportunity to embark upon a world equipped not only with the tools to build a happy life but the unconditional gift of love, joy, and adoration every person deserve as they stand on the thresholds of a new beginning. Life paid me back what it took. This time my baby gives it to me.

ID Theft Happens Even to Me

Those that know me have often heard me say “stuff happens”. I was at the Israeli Consulate in New York City on June 2, 2010 for a meeting. A journalist from a local Jewish paper was also at the consulate the same time. We never met each other but our identities were switched.

When I arrived at the 3rd check point on the 16th Fl of the Consulate, there is a security booth in the lobby area. It is caddy corned with two blacked out security windows on each side and there is a security gate, identical to what we walk through at the airport, next to the booth between the windows. Using a draw that pulls in and out exactly like the bank drive up window, you place your ID in one end and walk through the gate. Your ID is held until you are ready to leave. It is then handed back to you from the opposite window.

In the time that it took to give my license, walk through the gate, and receive my license on the other side it was switched. I placed the license into my bag without ever checking that it wasn’t mine. Why would I suspect that a highly secure environment like the Israeli Consulate would expose me to identity theft? If anything security was so high that day due to the intense protest they experienced the day before. Police were everywhere. So it never occurred to me I would have a problem…… (hindsight is 20-20). But that wasn’t the half of it. Learn what happen next by emailing a request for the full story. You would never believe it in your wildest dreams. I am just so glad I had the best protection in the world backing me up. Do you? www.m2secure.com in case you are wondering.

Growth: Distinctiveness Double the Pleasure Triple the Growth

Would you ever open an identical fast food restaurant down the block from a famous one? No? It happens all the time and we wonder why business failures are at an all time high. The economy may have some responsibility but there are many businesses out there that are flourishing despite the economy yet have the same economic realities. What sets these companies apart is the distinctiveness they created in their business and about there business. These companies changed the experience for the better thus attracting customers easier. Learn what distinctiveness does and how it works. Request a copy of the article "Distinctiveness: Double the Pleasure Triple the Growth.

Hello and Welcome

Hello and welcome to my new blog. This is the place where we'll discuss client acquisition and then how to protect them and you. Many people ask me why I chose to get involved in what appears to be two very different disciplines. It confuses them understandably so.

To answer it succinctly, in professions like medicine, accounting, law, finance, and banking the ability to grow is predicated on the ability to meet a large amount of regulatory requirements. Developing new business, expanding old business, bringing in new clients can't be accomplished without first making sure the organization legally can. So that means we must protect what we grow. That's how it all started.

In other industries the ability to accept credit cards, to cater to customers and expand purchases, means you must also be able to follow PCI compliance. To sell cars you must follow privacy laws such as Sarbane Oxley or Graham, Leech, Bliley. So as you can see, it's not so far fetch to think that what you grow you must protect. They may be two different activities but in a lot of cases they must also be enacted simultaneously.

It's my desire to offer you information on both subjects. So for now, on Mondays we'll spotlight growth and on Thursdays we'll focus on protection.

Right now my activities center on identity theft and fraud. Even though identity theft is about someone's personally identifiable information, it affects businesses, the community, and individuals alike. So I have two questions for you.

1) How do you value your personal identity? and 2) What do you value about your personal identity?