Reference no: EM133801345
Part 1: Research the Gramm-Leach-Bliley Act (GLBA)
Note: This is a research exercise. You may conduct research using your textbook or resources on the internet.
Conduct an internet or library search on the Gramm-Leach-Bliley Act (GLBA). Read one or two articles that you find interesting.
2. Identify the article(s) you read, including a link to the article(s).
3. Explain the main security and privacy requirements of GLBA. What data elements does GLBA protect? What are the main privacy requirements of the law? What are the main security requirements of the law? Who enforces the law?
Part 2: Research the Health Insurance Portability and Accountability Act (HIPAA)
Note: This is a research exercise. You may conduct research using your textbook or resources on the internet.
Conduct an internet or library search on the Health Insurance Portability and Accountability Act (HIPAA). Read one or two articles that you find interesting.
2. Identify the article(s) you read, including a link to the article.
3. Explain the main security and privacy requirements of HIPAA. What data elements does HIPAA protect? What are the main privacy requirements of the law? What are the main security requirements of the law? Who enforces the law?
Part 3: Compare and Contrast GLBA and HIPAA
Note: This is a research exercise. You may conduct research using your textbook or resources on the internet.
1. Describe what the GLBA and HIPAA security rules have in common. List three to five elements or concepts that are similar in the security provisions of both rules.
2. Describe the differences between the GLBA and HIPAA security rules. List three to five elements or concepts where the security provisions of both rules diverge.
Challenge Exercise Note: The following exercise is provided to allow independent, unguided work-similar to what you will encounter in a real situation.
Both the Gramm-Leach-Bliley Act (GLBA) and the Health Insurance Portability and Accountability Act (HIPAA) contain numerous provisions that an organization that is subject to the legislation must follow. In some instances, an organization will have business activities that place its information technology systems under the regulatory requirement of both laws. Both GLBA and HIPAA require subject organizations to create written information security plans/policies for their IT operations and provide employee training on each law's regulatory requirements.
1. Which law gives an organization more instruction and insight into the type of information security plans/policies required?
2. Which law gives better instruction and insight into training practices?
3. How would you advise an organization that has to follow both laws on its information security plans/policies activities and training activities?
4. Why would you advise that course of action?