IT Security and Compliance Consultation

The Health Insurance Portability and Accountability Act (HIPAA) is a United States federal law to protect the privacy, security, and confidentiality of individuals’ health information. HIPAA establishes national standards for how protected health information (PHI) may be used, disclosed, stored, and transmitted by covered entities— such as healthcare providers, health plans, and healthcare clearinghouses— and their business associates. 

The Family Educational Rights and Privacy Act (FERPA) is a United States federal law that protects the privacy and confidentiality of student education records. FERPA grants eligible students and parents specific rights regarding access to, amendment of, and control over the disclosure of education records maintained by educational institutions. Educational institutions and authorized third parties with access to education records are required to safeguard this information and use it only for legitimate educational purposes in compliance with FERPA requirements.

The Gramm–Leach–Bliley Act (GLBA) is a U.S. federal law that governs how financial institutions protect the privacy and security of consumers’ nonpublic personal information. It requires covered organizations to explain their information sharing practices through privacy notices, give consumers limited rights to opt out of certain data sharing, and implement safeguards to protect sensitive data. 

The Payment Card Industry Data Security Standard (PCI DSS) is a global security standard designed to protect credit and debit card information throughout the payment lifecycle. PCI DSS sets baseline requirements for securing card data, including maintaining secure networks, protecting stored cardholder information, implementing strong access controls, regularly monitoring and testing systems, and maintaining an information security policy. Compliance helps reduce the risk of data breaches, financial fraud, and penalties from payment card companies.

The General Data Protection Regulation (GDPR) is a comprehensive data protection law enacted by the European Union that governs how organizations collect, use, store, and protect personal data of individuals located in the EU and European Economic Area. It applies to organizations worldwide if they process EU residents’ personal data and emphasizes transparency, accountability, and individual rights. GDPR grants individuals rights such as access to their data, correction, deletion (the “right to be forgotten”), data portability, and the ability to restrict or object to processing.