Rules and Regulations that pertain to sensitive data destruction:
FACTA Final Disposal Rule requires the destruction of all consumer information before it is discarded. Covered entities must monitor compliance of any organization contracted to destroy consumer records.
- The FACTA Red Flags Rule requires audits of data-related vendors with access to personal information of customers.
- Under HIPAA, covered entities may be subject to civil penalties for the misconduct of its business associates that lead to a security breach. Working with a reduces the risk.
- Business associates of covered entities must comply with technical, administrative and physical safeguard requirements under the HIPAA Security Rule.
Compliance standards for Texas businesses:
All businesses in Texas are expected to implement and maintain reasonable procedures, including taking any appropriate corrective action to protect from unlawful use or disclosure any sensitive personal information collected or maintained by the business or in the regular course of business.
A business shall destroy or arrange for the destruction of customer records containing sensitive personal information within the custody or control that are not to be retained by the business by:
- Shredding
- Erasing
- Otherwise modifying the sensitive personal information in the records to make the information unreadable or indecipherable through any means.
What personal information is considered protected and needing to follow compliance regulations?
- General information such as name, address, phone number, email address, date of birth and signature.
- Personal ID information such as Social Security number, Driver’s license number, passport number and Tax ID.
- Security information such as PINs, passwords, security Q & A’s and access codes.
- Medical and Biometric information such as medical information, DNA, physical description, fingerprint, voice, facial map and insurance information.
- Additional protected information includes origin, place of birth, ethnicity, religion and orientation.
What documents should be shredded for security reasons?
- Bank statements
- Bidding and sales strategies
- Blueprints
- Checks
- Credit card and loan applications
- Contracts
- Estate records
- Financial records
- Legal contracts
- Manuals
- Medical records
- Payroll information
- Tax documents
- CDs
- Hard drives
- Media tapes
How long should I keep financial records?
