Data Breaches, a 3-part Series Breaking Breach Secrecy, Part 2

Data breaches are escalating. Many organizations still do not encrypt their data. If they do, many still use the vulnerable 56-bit "Data Encryption Standard." And breach notification guidelines are still vague. U.S. federal and state legislation need to catch up with the circumstances.

In September, a medical privacy breach led to the public posting on a commercial website of data for 20,000 emergency room patients at Stanford Hospital in Palo Alto, Calif. According to "Patient Data Posted Online in Major Breach of Privacy," by Kevin Sack in the Sept. 8 edition of The New York Times, the hospital has been investigating how a detailed spreadsheet made its way from one of its vendors to a website called Student of Fortune. Just in 2010, more than 5.4 million have been affected by U.S. health data breaches, according to a recent report from the U.S. Department of Health and Human Services.

Most American states and the U.S. federal government have reacted quickly to consider new legislation to address data breach problems in all sectors and possibly provide some protection to consumers and businesses.

One of the main issues that state and federal legislators address when they write new data breach notification legislation is the timely notice of breaches to consumers.