Institutional Privacy Challenges Jeff Gassaway, Information Security and Privacy Officer Sarah Morrow, HIPAA Privacy Officer, HSC Chief Privacy Officer

Agenda Privacy & Security Alphabet Soup UNM Opportunities The Horizon

Privacy & Security Mutually Supporting Principles with Differing Missions Privacy is the ability to exercise control over the collection and use of your personal private information including, to some degree, your personal protected health information Personally Identifiable/ Sensitive and Protected Information (PII/SPI) Security is the physical, technical and administrative methods we implement to keep that information private and protected

Alphabet Soup of Regulations FERPA GLBA HIPAA/ HITECH/Omnibus FTC Red Flags FCRA Privacy Act of 1974 Et al. Unfair and Deceptive Practices CAN-SPAM TSR ECPA COPPA PCI Et. al.

Alphabet Soup of Policies You May know of these … UNM 2500 Acceptable Computer Use Policy UNM 2520 Computer Security Controls and Access to SPI But, did you know … Regents Policy 3.7 Health Information Compliance Regents Policy 5.14 Human Subjects in Research UNM 2030 Social Security Numbers UNM 2040 Identity Theft UNM 2300 Inspection of Public Records UNM 2580 Data Governance UNM 7215 Credit Card Compliance

UNM Current Practices for PCI HIPAA/ HITECH SSN FERPA

The Land of … Opportunities! Could, Should, Will, Shall, Must, Strives UNM-wide Privacy Policy Program Statement(s)

The Horizon OCR HIPAA Audits Privacy Impact Assessments

Preguntas? privacy@unm.edu smorrow2@unm.edu