Privacy Statement - Penton Media, Inc.

Penton Media, Inc. considers your privacy important. We are committed to protecting the privacy of all those who provide us with their contact information while using our information, products, events, or services. This policy describes the ways that personally identifiable and anonymous information about our publication subscribers, online media product users, and event registrants is collected, how that information might be shared, and how someone can request changes to the way their personal information is used or shared.

This privacy statement applies to websites operated by or on behalf of Penton Media, Inc. and its subsidiaries, affiliates, divisions and related companies (“Penton”).
 

Information You Volunteer

Personally identifiable information is information that can identify you, such as your full name, email address, postal address, telephone number, and fax number.

We collect personally identifiable information that you choose to provide to us when you subscribe to our magazines (either directly or through another company such as a subscription agency); sign up for email newsletters; enter a contest; participate in surveys; register for a web site, webcast, or tradeshow; or otherwise communicate with us. When you provide this information to us, you are no longer anonymous.

We also may receive information about you from other sources and add it to the information you have provided to us.

If you purchase products or services on our website or through one of our printed forms, you may choose to provide us with your credit card information.

Penton is not responsible for the information you volunteer about yourself in discussions in our forums or in publicly accessible interactions, or the information that you choose to make public in your member profile. To view or change your member profile, please return to the Penton business site where you registered.
 

Anonymous Information We Collect

We use cookies and other Internet technologies to enrich your online experience by managing our website and email programs. Our cookies do not contain any information, in itself, that is personally identifiable.
 

Cookies

If your browser is set to allow cookies, we may store small amounts of information on your computer about what parts of our websites you have visited and what features you like best. We may then tailor the content you see to match your interests. We also may use cookies to identify members so that they don't have to re-enter their usernames and passwords. Cookies may also be used to limit the number of advertisements you see while on our site. By allowing us to understand how you use our site over time, cookies can help us provide you with a better, more relevant online experience.

The cookies we store on your computer are not accessible on any other companies' websites.
Some ads on our site are provided by outside companies. If these ads contain cookies, they can be accessed only by those advertisers; we do not have access to them.
Most browsers allow you to modify your security to accept or reject cookies. You need not have cookies turned on to visit our sites, but without them, your access to some areas may be limited and custom navigation may not be available to you.
 

Pixel Tags

Like many websites, Penton’s sites may use pixel tags, also known as web beacons, clear gifs, or web bugs. Pixel tags help us improve our understanding of our web traffic and visitor behavior, as well as gauge the response to our promotional efforts. This information is non-personally identifiable and is used for an aggregate picture of how visitors use our site.

If you wish, you may disable pixel tags by setting your browser to omit images and disable Javascript.
 

Online Ad Serving

We use industry-standard, third party advertising service companies to serve advertisements when you visit our sites or open our emails. These companies may use cookies, pixel tags, and other methods to collect information (typically not including your name, address, email address or telephone number) about your visits to our and other web sites to provide you with relevant advertisements about products, services, and events during your visit to our website. They can also provide us with aggregate pictures of traffic patterns, help us improve site experience, help advertisers better understand our services, and monitor advertising efforts. You can learn how to opt out of third-party advertisers' tracking methods in conjunction with links, online ads, etc. by visiting the advertisers' sites.
 

How We Use Your Contact Information

We may use your contact information for any of the following reasons:

• To send you notices for subscription renewal.
• To provide you with information about products or services you've ordered, including web events and tradeshows.

We may also use your contact information to ask for your input to help in our research about our services, events, or products or to provide you with additional information about this site and about other Penton Media products, services, or events that we think might be of interest to you.

All promotional and research email messages you receive from us will include an option to opt out of future email communications from that particular Penton business.

We may also send you e-newsletters with targeted, relevant content. Each e-newsletter will provide you with an opportunity to opt out of that particular e-newsletter.

In some cases, we may send you relevant, carefully-screened offers from reputable third party businesses or organizations. Many of our customers appreciate receiving these offers because they relate to their business or occupation. However, you will always be able to opt out of receiving future third party offers.
 

Information We Share with Third Parties

We provide contact lists to third party companies that we have employed to provide us with specialized services, including customer service, subscription fulfillment, research, statistical analysis, list cleansing, postal mailings, email and fax deployment, telemarketing, and other information services. In compliance with privacy laws, we also provide our opt out lists to those third party companies so that they can be suppressed from the communications those companies send on Penton's behalf. We only deal with third party companies whom we believe share our commitment to privacy and who will keep your information secure.

From time to time our sponsors wish to contact our subscribers who have indicated an interest in the products, services or events provided by such sponsors. If you opt-in to permit us to share your personally identifiable information with any sponsors or third parties, then you may receive communications directly from such sponsors or third parties. In addition, we may share your personally identifiable information with sponsors who appear in a particular e-newsletter of ours if you click on their link in the e-newsletter.

If you do NOT wish to have your email address shared with that e-newsletter's sponsors, you will be given an opportunity within the e-newsletter to opt-out or you may contact our customer service department at the number/email listed below.

If you provide information on a co-branded site or while using a co-branded service, you grant us permission to share the information you have provided with that service or site partner. Their use of your information is subject to their privacy policies.

Certain information, such as your password and credit card information, is never disclosed in any form whatsoever to any outside party.

Content Quality Control

Penton uses a third-party to monitor user-generated content posted on our websites. When you submit a comment on a Penton website, our third party service provider, Mollom BVBA (“Mollom”), may collect, analyze, and store information about you and the content you submit for anti-spam and quality monitoring purposes as set forth in Mollom’s privacy policy available at http://mollom.com/web-service-privacy-policy.
/>

Information Transfer

Penton is based in the United States of America. Any information you provide may be stored and maintained in a secure database in the United States or transferred to a secure database outside the United States.

In the case of a change of ownership or a merger involving Penton or any business that is part of Penton, your contact information associated with that business would be one of those transferred assets. 
 

How We Keep Your Information Secure

We use reasonable precautions, including appropriate technical, administrative, and physical procedures, to protect personal information from loss, misuse, or alteration.

When we contract with other companies to provide us with services, we only share personal information with those that we believe share our commitment to privacy and information security. However, we are not responsible for any breach of security or for the actions of these parties.

Due to the design of the Internet and other factors outside our control, we cannot guarantee that communications between you and our servers will be free from unauthorized access by third parties.
 

Children's Privacy

Penton's web sites are not intended for use by children, especially those under the age of 13. No one under the age of 13 should provide any personal information or participate in any forums, chats, or online discussions. Minors under the age of 18 are prohibited from making purchases, including subscriptions, on our sites. Please discourage your children from providing any personal information about themselves to anyone in any public discussion areas.
 

Terms of Use

By using any of our websites, you consent to our use of your contact information as it is outlined in this privacy statement.

Penton reserves the right to access and disclose personally identifiable information to comply with applicable laws, lawful government requests and court orders, or to investigate alleged fraud or violations of the Terms of Use of Penton’s websites.

If we decide to change our privacy statement, we will post the changes on this page. Users are encouraged to review this page for any changes. Your continued use of this site constitutes your acceptance of this entire privacy statement.
 

How to Reach Us

If you wish to update your print magazine subscription contact information, please go to the magazine's home page. If you wish to opt out of receiving email, faxes, or phone calls from any Penton business, please send an email to privacy@penton.com.

If you wish to contact Penton's Corporate Privacy Manager, please send your specific questions to: privacy@penton.com.

September 29, 2010

via penton.com

LOLL

Taking Interest-Based Advertising – and Self-Regulation – into Mobile Environments | Mobile Marketing content from Chief Marketer

One of the most important tech developments for 2013 will happen in the area of interest-based advertising, and its adaptation to mobile applications.

Studies show that interest-based ads in the United States and elsewhere generate more than twice the revenue of non-targeted “run of network” advertising. A Network Advertising Initiative study also shows that behaviorally-targeted ads – primarily on the desktop – are more than twice as effective at converting users who click on such ads. So, taking such ads to the mobile Web and mobile apps is a priority for many brands.

During the past year, the Digital Advertising Alliance, which manages the self-regulation program for interest-based ads, the “Advertising Options” icon which accompanies such ads, and interest-based advertising’s governing principles, has taken huge strides to increase consumer awareness, education and understanding regarding their choices in receiving interest-based ads. In tandem, we worked diligently with the advertising community to expand industry adherence to the Principles, and enforcement through third parties (Council of Better Business Bureaus and the Direct Marketing Association) to see them implemented and adhered to effectively.  Such efforts enable brands to gain this high level of consumer and user engagement in a trusted, transparent and increasingly global manner.

As a result, the “Advertising Options” icon has become a familiar sight:  The icon is delivered more than a trillion times across the Internet every month – today, mostly on desktops. As a result of consumer outreach, traffic to our education and choices pages on our two sites overall (www.aboutads.info and www.YourAdChoices.com) increased 10-fold over 2011.  There have been 14 million unique visits recorded at www.YourAdChoices.com in just 12 months’ time. That’s a clip of 1.3 million per month, which demonstrates both interest and traction.

With this success comes the need to capitalize on Principles’ adherence in the next realm of the internet, namely within mobile app environments where interest-based ads also can be served.

Specifically,

•      How do we clarify how the existing DAA principles apply within mobile apps & sites and across mobile apps & sites where interest-based ads are served?

•      How do we ensure the principle of consumer control expressed via the DAA Consumer Choice Mechanismscan be honored in mobile apps, sites and devices?

•      How do DAA participants deliver enhanced transparency such as the Advertising Options icon on mobile interest-based ads? Where’s the real estate?

•      How do we extend such notice and choice through all mobile environments? How do we ensure it is honored?

Achieving these aims is not simply a matter of policy, it is also a matter of technology which facilitates the Principles being honored – so that policy is adhered to in the real world. Mobile technology platforms can differ by carrier, operating system and device.  And applications within these environments also add a level of complexity, so to honor user choices about interest-based ads, whenever and wherever a consumer or business user employs a mobile device or application is a current challenge we are seeking to address.  Although the Principles will be consistent across systems, the technology must adapt to the challenges of the current mobile environment.

The DAA has a current working group addressing these challenges with stakeholders across the ecosystem.  This group in conjunction with other DAA participants is assessing technological options that will allow consumers to exercise their choices under the DAA Principles in the mobile environment.  Among other challenges, we are working to identify a solution that will perform effectively across the wide variety of mobile platforms, account for the small screen size of most mobile devices, and provide integrated choice per device despite the separation between the mobile Web and mobile app ecosystems.  Satisfying these aims is not easy, but we believe that a solution is within reach.

 Just as the Advertising Options icon has proven a transformative new way to implement online notice and choice, we expect that the DAA’s forthcoming solution will do the same in the mobile environment.

Lou Mastria is the managing director of Digital Advertising Alliance.

via chiefmarketer.com

FBI gives police free tool to convert photos for facial recognition - Trapwire

FBI gives police free tool to convert photos for facial recognition

Thinkstock

Within weeks, police nationwide should be able to obtain free software for matching photos of unidentified suspects against the FBI’s biometric database of 12 million mug shots, according to an Office of the Director of National Intelligence agency.

The FBI and Homeland Security Department are experimenting with facial recognition to determine the real names of illegal immigrants, identify persons of interest in candid photos, and fulfill other law enforcement responsibilities. To make that happen, however, law enforcement agencies at every level of government must share images with compatible technology that they can afford, former FBI officials say.

So, the bureau is offering agencies some of the equipment at no cost.

“Later this summer the FBI will deploy the Universal Face Workstation software, a free-of-charge client application that will provide users with the tools for conducting and managing facial/photo searches with a minimal resource investment,” Kshemendra Paul, program manager for the Information Sharing Environment within the Office of the Director of National Intelligence, wrote in his annual report to Congress.

The document notes the FBI database under development, the $1 billion Next-Generation Identification system, recently began testing facial recognition on images of alleged perpetrators uploaded by several state agencies. Currently, only governments with operational facial recognition technology can participate in the trial.

Those states now have access “to a national gallery of more than 12 million legally collected mug-shot photos to be searched in aid of investigations,” Paul wrote. Facial searches could one day be faster and more accurate than police lineups, advocates say.

This is not the first time the bureau has offered free biometric software to law enforcement partners.

“We provided universal latent workstations for palm prints,” Thomas E. Bush III, who helped develop NGI's system requirements while assistant director of the FBI’s criminal justice information services division between 2005 and 2009, said earlier this summer. “And we’ll probably do the same thing for face and iris.”

The existing workstation software codes images in a standard format so that authorities can cross-check their photos against pictures in any biometric ID system “from around the neighborhood and around the state to around the nation,” note the software download Web page.

The application accepts scanned images, photos from digital cameras or pictures saved as digital files. The tool then translates each copy into a new file that can be matched against images in NGI, or deposited there for others to search.

Authorized users only need a computer and email connection to the FBI’s database, according to the product specifications.

Related Stories

ACLU sues for FBI GPS tracking guidelines

FBI is on track to book faces, scars, tattoos in 2014

What does your tattoo say about you? The FBI wants to know.

Eye on crime: The FBI is building a database of iris scans

via m.nextgov.com

Tracking Big Foot: Why GPS Location Requires a Warrant | Center for Democracy & Technology

Filed under Security & Surveillance, More Issues in Security & Surveillance

Tags:

• 4th Amendment
,
• gps
,
• location data
,
• third party doctrine
,
• warrant

In a case that raises as many questions as the average sighting of Big Foot, a panel of the Sixth Circuit Court of Appeals ruled earlier this week that law enforcement officers didn't need a warrant to obtain GPS location information generated by his cell phone.

The court’s analysis has been roundly criticized as legally incorrect, lazy, shallow, and vague. I’d like to focus on one aspect of the case that the court missed:  the Department of Justice recommends that police obtain warrants in the scenario presented by this case, does so for good reason, and there were sufficient facts for the government to obtain the warrant that the Department of Justice recommends investigators obtain.

In this case, U.S. v. Skinner law enforcement officers obtained an order that allowed them to monitor for 60 days the location of a pre-paid cell phone they had good cause to believe was being used by Big Foot, the nickname given trucker eventually identified as Melvin Skinner, who they alleged was transporting marijuana.  They obtained a court order under which the provider, Sprint/Nextel, acting at the behest of law enforcement, pinged the phone repeatedly so it would reveal its location over a three-day period and eventually activated the phone’s GPS functionality to locate the phone’s GPS coordinates.   (Sprint/Nextel recently developed a web portal through which law enforcement can do this automatically for the duration of the court authorization, without contacting the provider each time officers ping the phone.)

The court found that there was "… no Fourth Amendment violation because Skinner did not have a reasonable expectation of privacy in the data given off by his voluntarily procured … cell phone."  But, as Jennifer Grannick points out cell phones don’t normally "give off" the kind of GPS location data that law enforcement used to locate Skinner.  Unless the user is employing location services – and Skinner wasn’t – the GPS location data has to be created.  In this case, the provider, under court order, remotely activated the GPS function of Skinner's phone so the police could track him.

There's a critical difference between GPS location information and cell tower location information a mobile phone creates during normal use.  The GPS data in this case is created at the request of law enforcement for tracking purposes and not through the normal use of the mobile phone. The GPS data doesn’t even exist until the provider prompts the device to deliver its GPS location to the provider so law enforcement can access it.  In contrast, providers maintain cell tower location information for business reasons.  Because providers do not normally maintain GPS location information and because it was not voluntarily conveyed to the provider, it is not a "business record" and does not fit into the third party records doctrine, which says that a person has no Fourth Amendment interest in information that is voluntarily revealed to, and held by, a third party.  While the third party doctrine should probably be re-examined, for now we have to live with it, but not for GPS data created by providers at the behest of law enforcement.  For that data, we retain our Fourth Amendment rights against warrantless GPS tracking.  

Blind Eye to Justice

Apparently recognizing that GPS is different, the Justice Department recommends that prosecutors obtain a warrant to get GPS location information from mobile communications service providers.  For example, in this power point presentation the Associate Director of the Justice Department Office of Enforcement Operations recommends that prosecutors use search warrants to get prospective GPS location information (referred to as “lat/long data” or latitudinal and longitudinal data) for constitutional, not statutory reasons, and because "anything less presents significant risks of suppression."  In addition, the Justice Department Associate Deputy Attorney General, testified in April last year that when the government seeks to compel disclosure of prospective GPS coordinates generated by cell phones, it relies on a warrant.

The Sixth Circuit missed this point entirely.  It blithely rejected Skinner's Fourth Amendment claims and implicitly bought into the government's argument that orders under the Stored Communications Act provision at 18 USC 2703(d) can be used to obtain prospective location information that has never been stored.  It did not consider whether the information sought was within the third party records doctrine and it cited no statutory authority for the proposition that the government can compel a provider to create the GPS information for the government to seize.  

Perhaps most ironically, it seems pretty clear that the government had facts establishing probable cause and could have obtained a warrant if it had applied for one.  As the concurring opinion in Skinner noted, law enforcement officials were watching the drug operation for months, had recorded conversations about an upcoming drug run, learned that the courier was carrying a particular phone that they could track, and that a half ton of marijuana was in transit.  

A warrant requirement for location information, as advocated by the Digital Due Process coalition, would still mean a drug courier like Skinner would get caught.  If followed, a statutory warrant requirement decreases the chances a criminal would elude jail because the seized evidence would not be at risk of suppression, as it is now for Big Foot if he appeals this decision. 

For updates, follow us on Twitter at @CenDemTech.

Issues

-> Free Expression

• Online Child Safety
• Intermediary Liability and Section 230
• Internet Neutrality
• International Free Expression
• More Issues in Free Expression

-> Consumer Privacy

• Behavioral Advertising
• Spyware
• Location
• Identity Management
• Baseline Privacy Law
• Data Security/Breach
• More Issues in Consumer Privacy

-> Health Privacy

• Privacy Framework
• Consent
• De-Identified Data
• HIPAA
• Privacy Enforcement
• Personal Health Records
• HITECH/ARRA Implementation
• State Privacy Protections

-> Security & Surveillance

• ECPA
• PATRIOT Act
• Cybersecurity
• Terrorism Information Sharing
• FISA and NSA Warrantless Snooping
• CALEA and Tech Mandates
• Location Privacy
• Government Identity
• More Issues in Security & Surveillance

-> Digital Copyright

• 3 Strikes / Graduated Response
• Secondary Liability
• Filtering/Watermarking/DRM
• International Copyright
• More Issues in Digital Copyright

-> Internet Openness & Standards

• Internet Governance
• Technical Standards
• Internet Neutrality

-> International

• Global Internet Freedom
• Jurisdiction
• Internet Governance
• International Copyright

-> Open Government

• Congressional Research Service
• Federal Digital Identity
• The Freedom of Information Act
• The Privacy Act
• Access to Government Information
• Privacy and Open Government

Related Posts

It Takes a Village to Defend a Network

Defending networks from malicious hacking exploits depends in large part on the voluntary, cooperative efforts of network operators, device makers, and Internet users.Today the Broadband Internet Technical Advisory Group (BITAG) -- a group of technical experts dedicated to building consensus about broadband network management -- has released a series of targeted, balanced recommendations to help stifle an emerging type of network attack. That attack has been used in recent years by the hacker...

Cybersecurity Amendments Would Modernize 25-Year-Old Privacy Law

[Editors Note: This is one in a of series of blog posts from CDT on the Cybersecurity Act, S. 3414, a bill co-sponsored by Senators Lieberman and Collins that is slated to be considered on the Senate floor soon.]Two amendments to the Senate cybersecurity bill now being debated would require government agents to get a warrant before reading a person's email or secretly tracking someone through their mobile phone.  The amendments, if adopted, would be a huge privacy gain and address a long-...

What’s Wrong With the Third Party Doctrine and Einstein 3.0

In a new book, CDT experts debate some of the most pressing issues in surveillance law today.Patriot Debates: Contemporary Issues in National Security Law features CDT’s Greg Nojeim in a debate on the third-party records doctrine and its application to criminal investigations in the digital age. The doctrine holds that law enforcement does not need a warrant to search and seize information lawfully held by third parties, such as online file hosting services like Dropbox or online email...

Why Fibbing About Your Age Is Relevant to the Cybersecurity Bill

[Editors Note: This is one in a of series of blog posts from CDT on the Cybersecurity Act, S. 3414, a bill co-sponsored by Senators Lieberman and Collins that is slated to be considered on the Senate floor soon.]   Congress is about to decide whether it is a crime to violate terms of service governing your use of Gmail, Facebook, Hulu, or any other on-line service. One of the amendments to the Cybersecurity Act that the Senate is likely to take up this week would substantially increase...

• Most Read
• Most Emailed

Tracking Big Foot: Why GPS Location Requires a Warrant

'Safe Data' Strategies for Health Info on Mobile Devices

Better Policies for De-Identified Health Data

Buliding Public Trust in De-Identified Health Data

Tracking Big Foot: Why GPS Location Requires a Warrant

Better Policies for De-Identified Health Data

'Safe Data' Strategies for Health Info on Mobile Devices

Buliding Public Trust in De-Identified Health Data

• Donate
• Contact
• Events
• Feeds
• Privacy

Copyright © 2012 by Center for Democracy & Technology.

via cdt.org

https://www.cdt.org/blogs/greg-nojeim/1708tracking-big-foot-why-gps-location-...

Oversight of Government Privacy, Security Rules for Health Data Questioned | Center for Democracy & Technology

Filed under Health Privacy, HITECH/ARRA Implementation

Tags:

• Health Privacy
,
• hipaa
,
• HITECH

Oversight and accountability for following federal privacy and security rules is critical if the public is going to trust that the next generation of electronic health care providers, insurers, and billing services can protect the privacy of their medical information.  A recent report by the Government Accountability Office questions whether sufficient work is being done to build that public trust.

The GAO report says the Department of Health and Human Services has failed to issue new rules for protecting personal health information and lacks a long-term plan for ensuring that those new rules are being followed.  The HHS Office for Civil Rights (OCR), which is responsible for overseeing these efforts, acknowledged these concerns but noted that rules are winding their way through government channels and that they have "taken the necessary first steps towards establishing a sustainable" oversight program.   

The report's two main concerns are: (1) the urgent need for guidance on de-identification methods, and (2) lack of a long-term plan for auditing covered entities and business associates for compliance with federal privacy and security rules (specifically, HIPAA and HITECH).

De-Identification Guidance

De-identification is a tool that enables health data to be used for a broad range of purposes while minimizing the risks to individual privacy.  Under HIPAA, there are two methods that can be used to de-identify health data. The first is the safe harbor method, which merely requires the removal of 18 specific categories of identifiers, such as name, address, dates of birth or health care services, and other unique identifiers.  The second is the expert determination method that certifies that the data, in the hands of the intended recipient, raises a very small risk of re-identification. The safe harbor method is static and presumes that the removal of the 18 categories of identifiers translates into very low risk of re-identification in all circumstances.

In HITECH, Congress directed HHS to complete a study of the HIPAA de-identification standard by February 2010.  Though covered entities rely more on the safe harbor method because it is easier to understand and more accessible, OCR aimed to produce guidance that would "clarify guidelines for conducting the expert determination method of de-identification to reduce entities reliance on the Safe Harbor method," according to the report.  Two years later and notwithstanding its good intentions, OCR has not released this guidance.  

CDT has met with industry and consumer stakeholders about how to improve federal policy regarding de-identified health data since 2009. CDT also recently published an article in JAMIA proposing a number of policies to strengthen HIPAA de-identification standards and ensure accountability for unauthorized re-identification.  

The OCR should issue the required guidance on de-identification without further delay and continue seeking public feedback on how to build trust in uses of de-identified data.  Foot dragging on this issue risks impeding progress on the ability to monitor the public's health in ways that go far beyond mere notification and routine reporting of symptoms, diagnoses, etc.  With these new capabilities in place, public health officials can move beyond traditional detection and response to outbreaks, enabling earlier disease detection, allowing public health officials to take a more active role monitoring health issues from cancer screening to adult immunizations to HIV.

Ensuring Compliance

Routine audits help ensure that covered entities and business associates comply with HIPAA and HITECH regulations.  Audits also provide OCR with important information about how entities covered by HIPAA and HITECH are implementing critically important privacy and security protections, and potentially surface issues needing further regulatory guidance and helping OCR better determine when penalties for noncompliance are warranted.  

HITECH directed HHS to audit entities covered by HIPAA for compliance with HIPAA and new HITECH requirements; OCR officials began those audits earlier this year. The report states that OCR has no plan to sustain these audits beyond 2012; the report also notes that HHS does not have a defined plan for including HIPAA business associates in its audits. HHS responded that OCR plans to review the pilot audit program at the end of this year and move forward with an audit program after that step is complete.

If the public is to trust that the privacy of their health information is well protected, it must know where that information is going and how it's being used. The report highlights the importance of audits as an effective mechanism for accountability. CDT is encouraged by the progress OCR has made to date in its pilot audit program, and we are pleased to see HHS commit to learning from the pilots to developing and implementing a sustained plan for auditing compliance with federal privacy and security regulations. 

For updates, follow us on Twitter at @CenDemTech.

via cdt.org

https://www.cdt.org/blogs/suchismita-pahi/1607oversight-government-privacy-se...

'Safe Data' Strategies for Health Info on Mobile Devices | Center for Democracy & Technology

iled under Health Privacy, Personal Health Records

Tags:

• Health Privacy
,
• mobile technology
,
• project healthdesign

Consumer use of mobile technologies to stay healthy or manage a chronic health condition is increasing; likewise, an increasing number are using these technologies as a digital link to their doctors.  Yet, unlike health care providers who must follow federal privacy and security rules when using mobile technologies to share a patient's health information, no such rules apply to consumers or their devices.

Building and maintaining consumer and patient trust in the use of mobile devices is key to delivering on the promise that these mobile tools can bring to improving patient care.  And a key to cultivating that trust is building basic security safeguards into those devices.
 
CDT teamed up with the law firm of Manatt, Phelps & Phillips LLP to develop "Strategies for Safeguarding Patient-Generated Health Information Created or Shared Through Mobile Devices."1 The paper comes from CDT and Manatt's work with the Robert Wood Johnson Foundation's Project HealthDesign, which is exploring patients' use of personal health applications to promote better health decision-making by both patients and providers.

The paper discusses what factors should be considered when protecting patient-generated health information created on or shared through mobile devices, including:

•    The complexity and cost of the security measure;
•    The ability (or willingness) of the patient or consumer to deploy the security measure;
•    The effect the security measure will have on the health or health care management; and
•    The probability of potential risks to the information, and the potential consequences of a breach of information.

The paper also recommends specific strategies for securing information on patient mobile devices; such strategies include providing patients with clear information on privacy and security risks and providing them with technical tools to help them manage those risks.

1. 1. The article was originally published in the Journal of Health Information Management (JHIM), vol. 26, no. 3, by the Health Information Management Systems Society.

For updates, follow us on Twitter at @CenDemTech.

via cdt.org

https://www.cdt.org/blogs/deven-mcgraw/1608safe-data-strategies-health-info-m...