Information Security and Privacy in HRIS CHAPTER 16 Information Security and Privacy in HRIS

INTRODUCTION A Great Deal Of Confidential Information Employees are Captured and Stored by Organizations Employee Personal Details Pay And Benefits History Medical Records Disciplinary Records Data Are Stored Electronically And Transmitted Across Networks. Increasing Integration Of HRIS Has Made Information Security Management A Complex And Challenging Undertaking

Information Security in HRIS Protecting Information In The HRIS From Unauthorized Access, Use, Disclosure, Disruption, Modification, and estruction Objectives of Information Security Protect Confidentiality, Integrity And Availability Of Information.

COMPONENTS OF INFORMATION SECURITY Three Main Principles Of Information Security Confidentiality Integrity Availability The HRIS Is Composed Of Three Components Hardware Software Communications

COMPONENTS OF INFORMATION SECURITY SOURCE: Wikipedia (2007)

LEGAL REQUIREMENTS FOR INFORMATION TECHNOLOGY Personal Information Protection And Electronics Document Act (Canada) Supports And Promotes Electronic Business By Protecting Personal Information That Is Collected, Used Or Disclosed Security Breach Notification Law (California, USA) Requires Organizations To Notify Customers Or Employees When Unencrypted Personal Information May Be Compromised, Stolen Or Lost. Computer Misuse Act 1990 (UK) Proposed To Make Computer Crime (e.g. Hacking Or Cyber-terrorism) A Type Of Criminal Offense.

LEGAL REQUIREMENTS FOR INFORMATION TECHNOLOGY (Cont.) The European Union Data Protection Directive (EUDPD) Requires That All EU Members Must Adopt National Regulations To Standardize The Protection Of Data Privacy For Citizens Throughout The European Union. Health Insurance Portability And Accountability Act (USA) Sets National Standards for Electronic Healthcare Transactions and Requires Healthcare Providers, Insurance Companies And Employers To Safeguard The Security Of Health Information Of Individuals.

THREATS TO INFORMATION SECURITY Human Errors In Data Entry & Handling Damage By Employee Disgruntled & Ill-informed Employees: Critical Role Of HR Misuse Of Computer Systems: Unauthorized Access To Or Use Of Information Computer-based Fraud Viruses, Worms & Trojans: Cyber Terrorism Hackers Natural Disasters

BEST PRACTICES IN HR INFORMATION SECURITY Adopt A Comprehensive Privacy Policy Store Sensitive Personal Data In Secure Computer Systems And Provide Encryption Dispose Of Documents Properly Or Restore Computer Drives And CD-ROMs Build Document Destruction Capabilities Into The Office Infrastructure Conduct Regular Security Practice Training (Canavan, 2003; David, 2002; Tansley & Watson, 2000)

ADDITIONAL BEST PRACTICES IN HR INFORMATION SECURITY The Careful Selection Of Staff with Regard to their Honesty and Integrity Raise Information Security Awareness and Ensure Employees Understand Corporate Security Policies Institute Measures To Address The Personal Problems Of Staff, Such As Gambling And Drug Addictions, Which Might Lead Them Indulge In Abuse For Financial Gains Provide Access To Effective Grievance Procedures Since The Motivation For Much Computer Abuse Is Retaliation Against Management Kovach, Hughes, Fagan, and Maggitti (2002) Grundy, Collier, and Spaul (1994)

INFORMATION PRIVACY Privacy Is A Human Value Consisting Of Four Elements (Kovach & Tansey, 2000): Solitude: The Right To Be Alone Without Disturbances Anonymity: The Rights To Have No Public Personal Identity Intimacy: The Right Not To Be Monitored Reserve: The Right To Control One’s Personal Information Including The Methods Of Dissemination Of That Information.

CONTROLLING ACCESS TO HR DATA Administrative Controls Logical (Technical) Controls Physical Controls Security classification for Information Access control

INFORMATION PRIVACY AND HRIS Concerns Types Of Employee Information that Can be Collected And Stored In The System Who Can Access And Update The Information Considerations Collect and store information Based On Sound And Valid Business Reasons Collect only information which is Necessary, Lawful, Current, And Accurate

HRIS SECURITY BEST PRACTICES Train Users On How To Securely Use And Handle The Equipment, Data, And Software. Train Employees To “Log Off” Personal Computers After They Are Through Using Them. Do Not Allow Passwords To Be Shared. Change Passwords Frequently. Run Software Through A Virus-detection Program Before Using It On The System. Ensure That Backup Copies, Data Files, Software, And Printouts Are Used Only By Authorized Users. (Noe et al., 1994; Pfleeger, 2006)

HRIS SECURITY BEST PRACTICES Make Backup Copies Of Data Files And Programs. Ensure That All Software And Mainframe Applications Include An Audit Trail (A Record Of The Changes And Transactions That Occur In A System, Including When And Who Performed The Changes). Use Edit Controls (Such As Passwords) To Limit Employees' Access To Data Files And Data Fields. Employees Take Responsibility For Updating Their Employee Records Themselves Via The Self-service System. (Noe et al., 1994; Pfleeger, 2006)