In a recent post, we highlighted the need for a privacy and cybersecurity training program, one not solely focused on spotting phishing attempts (although that is quite important as well). A primary reason, quite simply, is that employees continue to be a leading cause of data breaches. This fact was reaffirmed for the Wyoming Department of Health (WDOH) when an employee mistake resulted in the disclosure of nearly 165,000 Wyomingites. And, the risk is only amplified in the current remote work environment.

The WDOH announced on April 27, 2021, that it had inadvertently exposed 53 files containing COVID-19 and Influenza test data and 1 file containing breath alcohol test results. Some of the files had been exposed as early as November 5, 2020, but WDOH did not discover the incident until March 10, 2021. According to WDOH, the files included name or patient ID, address, date of birth, test result(s), and date(s) of service, but did not contain social security numbers, banking, financial, or health insurance information.

The breach resulted from an “inadvertent exposure” of the files by a WDOH workforce employee who mistakenly and impermissibly uploaded the files to private and public GitHub.com repositories, resulting in disclosure to unauthorized individuals. Notably, WDOH intended GitHub.com, internet-based software development company, be used by its employees only for software code storage and maintenance.

It is not clear why the WDOH employee uploaded 54 files containing patient test result data, including COVID-19 test results, to a service intended for storage of coding data. And, we do not know whether the employee in this case received training on the purpose and use of GitHub.com. However, according to WDOH’s announcement, the files were promptly removed from GitHub.com, the employee was sanctioned, and WDOH retrained its workforce on data privacy and security best practices.

Certainly, mistakes processing personal information are going to happen and no amount of training will prevent all data incidents and breaches. There is no silver bullet. An important question for an organization to ask, however, is whether reasonable steps are being taken to minimize the risk to data, even with regard to inadvertent errors in handling and with regard to use of company systems, among other things.

Training can be one of a number of tools organizations use to create a culture of privacy and security. Increased awareness can help to minimize, even if not eliminate, inadvertent errors. The white paper we provided in our earlier post outlines several considerations for developing a robust program designed to continually remind employee of the vigilance needed to protect personal information from unauthorized access, acquisition, modification, and disclosure. It is and will continue to be an ongoing challenge, particularly in the current environment with workplaces shifting as we emerge from the harshest effects of the pandemic.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Joseph J. Lazzarotti Joseph J. Lazzarotti

Joseph J. Lazzarotti is a principal in the Tampa, Florida, office of Jackson Lewis P.C. He founded and currently co-leads the firm’s Privacy, Data and Cybersecurity practice group, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP) with the…

Joseph J. Lazzarotti is a principal in the Tampa, Florida, office of Jackson Lewis P.C. He founded and currently co-leads the firm’s Privacy, Data and Cybersecurity practice group, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP) with the International Association of Privacy Professionals. Trained as an employee benefits lawyer, focused on compliance, Joe also is a member of the firm’s Employee Benefits practice group.

In short, his practice focuses on the matrix of laws governing the privacy, security, and management of data, as well as the impact and regulation of social media. He also counsels companies on compliance, fiduciary, taxation, and administrative matters with respect to employee benefit plans.

Privacy and cybersecurity experience – Joe counsels multinational, national and regional companies in all industries on the broad array of laws, regulations, best practices, and preventive safeguards.

Benefits counseling experience – Joe’s work in the benefits counseling area covers many areas of employee benefits law.

Joe speaks and writes regularly on current employee benefits and data privacy and cybersecurity topics and his work has been published in leading business and legal journals and media outlets, such as The Washington Post, Inside Counsel, Bloomberg, The National Law Journal, Financial Times, Business Insurance, HR Magazine and NPR, as well as the ABA Journal, The American Lawyer, Law360, Bender’s Labor and Employment Bulletin, the Australian Privacy Law Bulletin and the Privacy, and Data Security Law Journal.