CORPORATE SHREDDING SERVICES

Health Insurance Portability and Accountability Act of 1996 (HIPAA)

HIPAA addresses medical record security and patient privacy and was the primary piece of legislation regarding data security in the healthcare industry for many years.

Health Information Technology for Economic and Clinical Health Act of 2009 (HITECH)

HITECH widened the scope previously provided by HIPAA and established a system of incentives for healthcare providers who opted to use electronic health records, in addition to providing a financial budget for providers to cover training and development. Aimed at containing information relating to patients to authorized users, HITECH mandated that all healthcare providers must switch to electronic health records by 2015, after which penalties would apply.

Fair and Accurate Credit Transactions Act of 2003 (FACTA)

While HIPAA and HITECH relate to the medical industry, FACTA provides regulations for financial institutions and creditors, including savings institutions and banks. FACTA aims to ensure that all financial institutions are aware of potential “red flags” which could indicate potential misuse of financial data and that they know how to respond accordingly.

Sarbanes–Oxley Act of 2002 (SOX)

SOX applies to all public companies in the United States and was enacted largely as a reaction to highly publicised data security scandals including Enron and WorldCom. The legislation sets out specific provisions to mandate secure methods of destruction of financial records and other confidential information. It is due to this legislation that businesses – especially small- to medium-sized businesses – came to the realization that they were unwise to continue to attempt to deal with the destruction of confidential paperwork in-house, ultimately leading to the rise of corporate shredding services.

Gramm-Leach-Bliley Act (GLB), aka Financial Services Modernization Act of 1999

This legislation specifically targets the protection of consumer information within the power and control of financial organizations.

As a result of the legislation, companies must enact:

• Policies that disclose the information being collected and how that information is to be used;
• Policies that give individuals the right to opt out of having their personal data on sold to third parties; and
• Policies that prevent confidential information being accessed by unauthorized users.

A company in violation of this legislation faces regulatory enforcement actions including substantial fines.