So what if you have a data breach?

Last week I posted about a data breach at the HHC (http://www.phiprivacy.net/?p=5884) in which a tape with data on approximately 1.7 million people was stolen. I want to make another point that this event brings up.

Have you thought about the possible effects of such a data breach on your organization? The HHC got lucky in that it didn't get as much coverage as some other breaches have gotten. Besides, even if it did get lots of bad publicity, the HHC doesn't have to care.

Would you be able to say the same thing if your organization were the one losing all that data? Could you really expect to have the loss fly under the radar? And even if it only hit the local news circuit, could you really afford not to care? Or could it mean that people will stop coming to you for the help you try to give them?

And think about this. The HHC may not need to worry about bad publicity. But they DO need to worry about their budgets. And, they will be taking a financial hit over this. Yes, they intend to sue the vendor who lost the tapes for some of the cost of the measures they now need to take. But, the very best that the HHC can expect is that they will have to extend a large amount of money to deal with the problem and only get paid back in the future. That's not a good thing, financially speaking.

What would it cost your organization to deal with a data breach? Could you afford it? Keep that in mind when yo make decisions about the measures you take to insure that your private date STAYS private.