Preventing Identity Theft

Posted on February 27, 2010 by admin

Security has always been an essential aspect of records management, particularly among organizations that handle personally identifiable information or other sensitive data. The advent of the digital age has only reinforced the need for tight security with regard to records management, as evolving technology has increased unscrupulous individuals’ opportunities to commit identity theft and gain unauthorized access to sensitive information.

Identity theft is, as the name suggests, the theft of another person’s identity for financial or other gain. The leading type of identity theft is credit card identity theft, which happens when some one expropriates another person’s credit card number and information in order to make unauthorized purchases. This is a very serious problem that has caused great financial turmoil for countless victims who have had their credit accounts overspent by identity thieves. Other common forms of identity theft include driver’s license and Social Security number identity theft. Another increasingly prevalent form of identity theft is medical identity theft, the theft of someone’s medical identity through physician’s records for the purpose of obtaining health insurance.

The advent of electronics records management has made maintaining an appropriate level of security for records more difficult. According to records management experts, it is much harder to make sure that the structure, context and content of records is kept intact and protected when the records are not in a hardcopy format. In 2009, more than 200 million data files were compromised by hackers. Hacking for profit is estimated to be a multi-billion dollar business world wide, adding to legitimate businesses costs because of losses and increased costs with regard to security.

One major problem in records management is the low priority level it is given in many organizations. Many companies and organizations give their least skilled and lowest paid workers records management duties. This practice has come back to haunt many of these organizations in embarrassingly public security breaches. For instance, in 200x, LexisNexis had to contact more than 32,000 customers and inform them that criminals had used the company’s information retrieval services to commit identity theft. If more priority had been assigned to reviewing and securing records, this costly — in both money and prestige — breach may not have occurred.

How you can secure your organization’s records

To increase the security of your electronic records protocols, keep these precepts in mind when implementing or changing a plan:

  • Make sure your electronic records management policies incorporate dynamic encryption. By constantly changing your encryption keys, you stay one (or hopefully several) steps ahead of hackers.
  • Fragmentation is another key element of providing security to your electronic records. Each data component should be split up into pieces and stored in multiple databases in a randomized order. Because there’s no central database, your records are secure. Adding to the security is the fact that even if someone stole all of the databases, the data within would be incoherent.
  • You can also add to the security of your electronic records by maintaining these fragmented databases on a number of different networks. This reduces the chance of a security breach and also makes hackers work much harder and longer to crack your network, making it more likely that they’ll get caught.
  • Compartmentalization of records is another key element of electronic records management security. By requiring that your database functions must be accessed from several authorized points, this gives protection to each function of your records and also makes it likely that unauthorized attempts to gain access will be noticed.
  • Setting multiple challenge points that require more than one password or entrance criteria, such as biometrics, helps you ensure that the person accessing your data is actually who they’re claiming to be. It’s also advisable to set up defragmentation and decryption control points in your electronic records management program. By limiting points where your data can be decrypted, you reduce the number of vulnerable spots in your electronic records management system.
  • Another key aspect of electronic records security is having a real time access denial. This is essentially a system that freezes access to the system if a party unsuccessfully attempts to access it more than a set number of times during a time period. This reduces a hacker’s opportunity to get access to your system.
  • Lastly, having a reliable system for the destruction of electronic records is key to preserving sensitive information. Make sure the system you use eliminates the records so they can’t be dredged up from discarded media storage or other equipment.

By following these precepts, you can increase the security of your electronic records and reduce the chance that your organization endures a costly loss as a result of hacking or identity theft.

Posted in Basics | Leave a comment

SOX and Enterprise Record Management

Posted on February 27, 2010 by admin

The Sarbanes-Oxley Act of 2002 has had a number of impacts on records management at corporations both major and minor, some of which are still have yet to be fully realized.

Records management is essentially the creation, maintenance and retention of data by organizations. Records management is a key operation in any business or organization, and in some cases, is subject to legal and regulatory requirements.

The Sarbanes-Oxley Act’s main intent was to set better standards for U.S. public companies, as well as management and public accounting companies. Privately held companies are not subject to SOX. The act includes 11 titles which set regulations for a number of functions, including corporate board responsibilities and accounting practices.  While passed in 2002, it was not until 2005 that most of the components of the act were implemented.

Proponents of the act say it has strengthened public accounting and increased investor confidence in the integrity of corporate accounting practices. The act was proposed in response to the Enron and Arthur Andersen accounting scandals of the early 2000′s. Critics of the act argue that it has greatly increased the cost of doing business in America as a public company, pointing to a decrease in private companies going public in the years after SOX’s passage. To these critics, SOX has put American companies at a major competitive disadvantage in relation to foreign firms who are not subject to the Sarbanes-Oxley Act.

While the overall thrust of SOX is to better regulate corporate accounting, the act also has significant impact on records management. According to the act, all business records, including electronic records and messages must be preserved for at least five years. The act has some pretty sharp penalties for non-compliance, including fines and imprisonment. The act defines records as business records and communications, including electronic communication such as e-mail.

The provisions of SOX relating to records management have created some big responsibilities — and big costs — for public companies. According to the law firm Foley and Lardner, SOX has increased the cost of being a public company by about 130 percent. For companies who deal primarily with electronic records, specialized systems for handing these records are necessary. Many companies have hired “compliance officers” just for this purpose alone.

Enterprise Record Management

Dealing efficiently and effectively with the electronic records management aspect of SOX can help companies mitigate the costs involved with complying with the act, and avoid possible penalties involved with non-compliance. One good solution is an Enterprise record management system. ERM is essentially the tools and technologies used in the storage and retention of records.

When implementing an ERM program, companies must consider a number of key factors including size, storage media, security and longevity. Making the right choices with regard to these factors can help companies avoid big headaches and fines later.

How large your ERM system needs to be depends on the size of your company and how many and what kind of transactions it makes. Nevertheless, your ERM needs are certain to require large amounts of data storage because of the lengthy periods SOX requires for records retention. When choosing an ERM system, it’s important to make sure it has plenty of storage — and then add some more.

Picking the right media format is also important. Under SOX, audits of records are more likely, so having your records in a format that’s well-organized and easily accessible is important. The media storage industry is undergoing frequent changes, so it’s important to choose storage products that are likely to be easy to maintain and service well into the future.

Your data must also be secure. Your organization must be able to not only provide the information to auditors or federal investigators, you must also be able to prove that the records are accurate and tamper-proof. WORM media is a good program that uses a secure index and audit log to protect the security of your records. There are also several other good products on the market for these puorposes.

Complying with the retention requirement of SOX may be the most difficult aspect of the records management requirements of the act. Records stored in your system need to be organized and tagged with a specific retention period.

SOX is here and it’s highly unlikely that the act will be repealed any time in the near future. Dealing with the records management responsibilities enacted by SOX can be done in an efficient manner that reduces the cost of SOX compliance to your firm.

Posted in Types | Leave a comment

Personnel Records Management

Posted on June 19, 2008 by admin

Keeping and Managing Personnel Records

Throughout your day at work, you will be producing all sorts of paperwork.  You’ll write up paperwork for a new customer, or perhaps a recent for a company purchase.  With all of this paperwork, you need a way to keep track of it all.

In the past, some companies have gone through their time without worrying about this.  While it saves them the trouble at the time, they find that it actually hurts their business in the end when they don’t keep good records.  Keeping track of records is all a part of good business.  This is called records management, and you should be sure to keep track of it if you want to keep everything in your business on the up and up.

As mentioned above, you will encounter all sorts of records throughout the day.  Some of the most common are the personnel files that you have for all of your employees.  If you want to create legal records management, you will need to store all of the paperwork involved with each person.  This starts at the time of hire.  You should keep their application on file so that you know who you are talking about and so you can be sure that they followed all the rules in the application and didn’t lie.  Also, when you first hire someone, you have them fill out a lot of paperwork.  It is a good idea to store all of this as well.

As time goes on, you will still be adding more and more records to your employees’ files.  Keep all of the time records there.  Every time your employee works, record it and keep it in your storage.  This way, if your employee disputes their pay, you can prove them wrong with the time stamps that you saved.  You should also keep any communications with the employee as well.  If you have to reprimand them for something, keep this paperwork.  This is also the case if they get a raise as well.  As you can see, not all of the paperwork you keep will be negative.  This is all important when it comes to legal records management.

Records manage can seem a bit complicated at first.  In reality, it isn’t.  All you need to do is make sure that you have adequate storage for the paperwork and records.  Many companies use standard filing cabinets for this.  While this is a classic method of records management, there are some downsides to this.  It can often be hard to find what you need when you have to go through dozens of filing cabinets.  Even if everything is alphabetical, it can get misfiled.  Because of this, it is often a better solution to use electronic records management for your business instead.  While this is more expensive, it will take up less space.  It will also be easier to search the files for exactly what you need.  If you need a paper version, you can always print off a copy of what you need.

While it can be a bit of a hassle, keeping good records is an important part of running a business.  The better your records management is, the better your business will be.  Some companies even get in big trouble when they don’t keep good records.  Avoid this by finding some way to manage them.  If you don’t have the time to do it yourself, you could hire a company to do it for you.  There are plenty of companies out there that specialize in records management.  Although it costs more, they do provide a good, valuable service.

Posted in Types | Leave a comment