Legal

Ask a Lawyer and Get Answers to Your Legal Questions

Ask a Lawyer,
Get an Answer ASAP!

Legal

I am conducting a breach risk assessment and would like some

Customer Question
guidance. Pertinent details: 1) Successful...
I am conducting a breach risk assessment and would like some guidance. Pertinent details:
1) Successful phishing attack of employee led to a 30 minute unauthorized access to email and file store by perpetrator.
2) Forensics prove no action take by perpetrator in the data store (no files copied, downloaded, opened, etc.)
3) Forensics prove no synchronization of email or forwarding of email
4) Perpetrator could have 'seen' emails.
5) Mailbox contained 5200 emails - of which 34 contained PHI
6) PHI included only Pt. Name, Address, Date of Birth
7) Forensics indicate that the perpetrator used the 30 minutes to perpetuate their phishing campaign by sending 895 additional phishing emails to other persons.
In performing a LOPROCO we have concluded that given the above - there is a low probability that PHI was compromised. This conclusion is largely based on the evidence that the perpetrator had an opportunity to copy/download/synchronize both the data store (which contained immense amount of PHI) but did not do so. Therefore, we conclude it is highly unlikely that the perpetrator would have sifted through over 5000 emails to 'read' and or 'retain' the 34 items in question.
Given the information we have provided, do you believe we are in a position that warrants our conclusion? I can certainly provide more detail if warranted.
Submitted: 1 year ago.Category: Legal
Show More
Show Less
Ask Your Own Legal Question
Answered in 50 minutes by:
6/14/2016
Lawyer: Delta-Lawyer, Attorney replied 1 year ago
Delta-Lawyer
Delta-Lawyer, Attorney
Category: Legal
Satisfied Customers: 3,546
Experience: 10 years practicing IP law and general litigation
Verified

I hope this message finds you well, present circumstances excluded. I am a licensed attorney with over a dozen years of employment law experience, including development of policy relative to these issues. It is a pleasure to assist you today.

The standard in handling breaches like the one you are dealing with is one of reasonableness and due diligence. Basically, are the measures that you have taken reasonable in light of the breach and have you entertained all due diligence in determining the information accessed and potentially at risk.

Based on what you have shared with me, I believe that you have met that burden and should be secure in your position should there be a legal issue as to your efforts down the line. That said, I would certainly inform, in writing, the individuals of the 34 emails that contained PHI. The letter should roughly state what has happened and the information contained in the emails as it pertains to that individual. Since this information is not related to their social or their tax ID, they should feel pretty secure in the maintenance of their privacy. However, they need to maintain heightened observation of their credit score and other areas typically associated with identity theft. Your letter should also state that you are making efforts to assure this does not happen again, though these types of attacks are growing more complicated and frequent in all business areas.

You have done a great job here though and are to be commended.

Let me know if you have any other questions or concerns. Please also rate my answer positively (THREE OR MORE STARS) on the ratings bar on your end so I can receive credit for my response from the site.

Thank you and best wishes!

Ask Your Own Legal Question
Customer reply replied 1 year ago
The question is whether my entity needs to report the breach and provide notice. While you indicate that I've "met the burden", you also suggest I provide notice. This is somewhat confusing to me. If you feel I've met the burden in determining that there is a "low probability of PHI being compromised", no notice or reporting is required. See 78 FR 5643 - 5645Are you advising that we provide notice to the patients, but not report this as a breach? Or are you saying that we've properly mitigated the situation, yet a notification and reporting of the event is still warranted. Our focus is on whether or not we have significant evidence to support a 'low probability of compromise".
Lawyer: Delta-Lawyer, Attorney replied 1 year ago

I am sorry for the confusion...you have met the burden of due diligence in your investigation of the breach. However, it is a good business practice to, at a minimum notify the affected or potentially affected employees of the breach in writing. The reason it should be in writing is that it then becomes repeatable in the event of litigation.

You need to provide notice to the patients and report the breach, out of an abundance of caution. There is no harm in reporting this and providing information to those that can be affected. The greater harm is not providing this information, from a litigation standpoint, because it makes you appear to be culpable.

Your investigation does appear to provide significant evidence to support low probability of compromise. That is undeniable, in my opinion based on what you have shared with me. So, there is very little legal exposure as to how you responded to the breach and investigated the breach. The other side of the coin in informing those potentially affected. That is the next step here and that is what should be done in view of your investigation.

Let me know if that helps or if there are other concerns. I apologize for the confusion.

Ask Your Own Legal Question
Lawyer: Delta-Lawyer, Attorney replied 1 year ago

Did you have any other questions or concerns?

Ask Your Own Legal Question
Lawyer: Delta-Lawyer, Attorney replied 1 year ago

Just checking to see if you have any other questions or concerns here. I want you to be as comfortable as possible as you move forward. Thanks

Ask Your Own Legal Question
Ask Delta-Lawyer Your Own Question
Delta-Lawyer
Delta-Lawyer
Delta-Lawyer, Attorney
Category: Legal
Satisfied Customers: 3,546
3,546 Satisfied Customers
Experience: 10 years practicing IP law and general litigation

Delta-Lawyer is online now

A new question is answered every 9 seconds

How JustAnswer works:

  • Ask an ExpertExperts are full of valuable knowledge and are ready to help with any question. Credentials confirmed by a Fortune 500 verification firm.
  • Get a Professional AnswerVia email, text message, or notification as you wait on our site. Ask follow up questions if you need to.
  • 100% Satisfaction GuaranteeRate the answer you receive.

JustAnswer in the News:

Ask-a-doc Web sites: If you've got a quick question, you can try to get an answer from sites that say they have various specialists on hand to give quick answers... Justanswer.com.
JustAnswer.com...has seen a spike since October in legal questions from readers about layoffs, unemployment and severance.
Web sites like justanswer.com/legal
...leave nothing to chance.
Traffic on JustAnswer rose 14 percent...and had nearly 400,000 page views in 30 days...inquiries related to stress, high blood pressure, drinking and heart pain jumped 33 percent.
Tory Johnson, GMA Workplace Contributor, discusses work-from-home jobs, such as JustAnswer in which verified Experts answer people’s questions.
I will tell you that...the things you have to go through to be an Expert are quite rigorous.

What Customers are Saying:

Mr. Kaplun clearly had an exceptional understanding of the issue and was able to explain it concisely. I would recommend JustAnswer to anyone. Great service that lives up to its promises!

Gary B.Edmond, OK

My Expert was fast and seemed to have the answer to my taser question at the tips of her fingers. Communication was excellent. I left feeling confident in her answer.

EricRedwood City, CA

I am very pleased with JustAnswer as a place to go for divorce or criminal law knowledge and insight.

MichaelWichita, KS

PaulMJD helped me with questions I had regarding an urgent legal matter. His answers were excellent.

Three H.Houston, TX

Anne was extremely helpful. Her information put me in the right direction for action that kept me legal, possible saving me a ton of money in the future. Thank you again, Anne!!

ElaineAtlanta, GA

It worked great. I had the facts and I presented them to my ex-landlord and she folded and returned my deposit. The 50 bucks I spent with you solved my problem.

TonyApopka, FL

Not only did he answer my Michigan divorce question but was also able to help me out with it, too. I have since won my legal case on this matter and thank you so much for it.

LeeMichigan

< Previous | Next >

Meet the Experts:

Tina

Tina

Lawyer

8,775 satisfied customers

JD, BBA Over 25 years legal and business experience.

Ely

Ely

Counselor at Law

24,353 satisfied customers

Private practice with focus on family, criminal, PI, consumer protection, and business consultation.

INFOLAWYER

INFOLAWYER

Attorney

20,727 satisfied customers

Licensed attorney helping individuals and businesses

JPEsq

JPEsq

Attorney

2,132 satisfied customers

Experience as general attorney, in house counsel, SSDI, Family Law attorney, and law professor

Law Educator, Esq.

Law Educator, Esq.

Attorney

42,358 satisfied customers

JA Mentor -Attorney Labor/employment, corporate, sports law, admiralty/maritime and civil rights law

Ellen

Ellen

Lawyer, Consultant

8,238 satisfied customers

25 years of experience helping people like you.

Guillermo J. Senmartin, Esq.

Guillermo J. Senmartin, Esq.

Attorney

292 satisfied customers

7+ years of experience handling various legal matters.

< Previous | Next >

Related Legal Questions
This is a question for a litigation lawyer. my question is i
This is a question for a litigation lawyer. Hi my question is i have a open lawsuit with the city DEP my business was in the sandy storm and lost a lot of our merchandise. It was an online business. T… read more
Asad Rahman
Asad Rahman
Attorney
J.D.
2,300 satisfied customers
My car insurance policy was canceled because I was
Hi, my car insurance policy was canceled because I was ill-informed is there something I can do? … read more
Law Educator, Esq.
Law Educator, Esq.
Attorney
Doctoral Degree
42,358 satisfied customers
A life insurance policy which was cancelled in October,
a life insurance policy which was cancelled in October, November, and December, and on auto-pay has still not ceased. what to do? … read more
Legal Eagle
Legal Eagle
Attorney
Doctoral Degree
7,403 satisfied customers
I need a few recommendations for trust breach litigation
I need a few recommendations for trust breach litigation representation in or near Aurora Illinois. Thank you … read more
Barrister
Barrister
Attorney/Landlord/Realtor
Doctoral Degree
35,370 satisfied customers
I am a Pro Se Litigant. I filed an affidavit in opposition
I am a Pro Se Litigant. I filed an affidavit in opposition and a Cross Motion in Response to an OSC. I filed on time and included all the necessary information - however in the caption I wrote "Affida… read more
Lori
Lori
Juris Doctor
312 satisfied customers
I have just been notified by a litigation office that I will
I have just been notified by a litigation office that I will be served for a non-payment of a personal check from me that so called happened over 15 yrs. ago. The amount was said to be for 800. Now th… read more
Lori
Lori
Juris Doctor
312 satisfied customers
Is there ever a med pay deductible on a homeowners policy?
Is there ever a med pay deductible on a homeowners policy? … read more
Legal Eagle
Legal Eagle
Attorney
Doctoral Degree
7,403 satisfied customers
If public policy bars a plaintiff from recovering on a
If public policy bars a plaintiff from recovering on a contract, would that be an issue on appeal?… read more
LegalGems
LegalGems
Juris Doctorate
10,720 satisfied customers
I am the beneficiary of a life insurance policy and the
I am the beneficiary of a life insurance policy and the insurance company won't make the check out to me.they keep sending it to the estate of Don Sergott so the bank won't cash it. I called them and … read more
LawGuy
LawGuy
Juris Doctor
123 satisfied customers
This is a litigation question. I represent a woman who fell
This is a litigation question. I represent a woman who fell in an elevator accident in October or 2011. Her primary injury was to her ankle including tendon. She has extensive problems with other part… read more
INFOLAWYER
INFOLAWYER
Attorney
Doctoral Degree
20,727 satisfied customers
Can a judge adjudicate a litigation between someone who is
can a judge adjudicate a litigation between someone who is under his supervision and that person's probation officer ? … read more
Legal Eagle
Legal Eagle
Attorney
Doctoral Degree
7,403 satisfied customers
Can a policy owner borrow against a life policy without the
can a policy owner borrow against a life policy without the signature of an irrevocable beneficiary … read more
INFOLAWYER
INFOLAWYER
Attorney
Doctoral Degree
20,727 satisfied customers
I am a litigation secretary at a law firm and started on
I am a litigation secretary at a law firm and started on August 14, 2017 and was told verbally that I would need to go online and enroll in my medical benefits by September 7, 2017. At the end of Augu… read more
Legal Eagle
Legal Eagle
Attorney
Doctoral Degree
7,403 satisfied customers
Can I sue the court appointed forensic psychologist in small
Can I sue the court appointed forensic psychologist in small claims court if he is family, creating conflict of interest and wont recuse himself nor will the judge remove him? … read more
Law Educator, Esq.
Law Educator, Esq.
Attorney
Doctoral Degree
42,358 satisfied customers
Civil litigation: building contractor, mechanic lien, 2009.
Civil litigation: building contractor, mechanic lien, 2009. Multiple court dates extended, fired my attorney, filed pro se to dismiss for lack of prosecution after 2 1/2 yrs no communication after agr… read more
Legal Eagle
Legal Eagle
Attorney
Doctoral Degree
7,403 satisfied customers
I was a trustee/defendant in a probate litigation. The
I was a trustee/defendant in a probate litigation. The plaintiff's attorney accused me of staging a burglary. The police in that jurisdiction conducted a thorough investigation and found that the burg… read more
Olivia Kent
Olivia Kent
Managing Partner
Doctoral Degree
1,969 satisfied customers
On account of the active litigation between yourself and my
On account of the active litigation between yourself and my client, please stop sending email, faxes, or other correspondence to New York Life employees and agents.It is inappropriate for you to attem… read more
Asad Rahman
Asad Rahman
Attorney
J.D.
2,300 satisfied customers
If your in litigation with a company and your have an
If your in litigation with a company and your have an employee related to the head of said company.Do you have to sever ties with your employee. … read more
Dwayne B.
Dwayne B.
Juris Doctor
28,693 satisfied customers

DISCLAIMER: Answers from Experts on JustAnswer are not substitutes for the advice of an attorney. JustAnswer is a public forum and questions and responses are not private or confidential or protected by the attorney-client privilege. The Expert above is not your attorney, and the response above is not legal advice. You should not read this response to propose specific action or address specific circumstances, but only to give you a sense of general principles of law that might affect the situation you describe. Application of these general principles to particular circumstances must be done by a lawyer who has spoken with you in confidence, learned all relevant information, and explored various options. Before acting on these general principles, you should hire a lawyer licensed to practice law in the jurisdiction to which your question pertains.

The responses above are from individual Experts, not JustAnswer. The site and services are provided “as is”. To view the verified credential of an Expert, click on the “Verified” symbol in the Expert’s profile. This site is not for emergency questions which should be directed immediately by telephone or in-person to qualified professionals. Please carefully read the Terms of Service (last updated February 8, 2012).

DISCLAIMER: Answers from Experts on JustAnswer are not substitutes for the advice of an attorney. JustAnswer is a public forum and questions and responses are not private or confidential or protected by the attorney-client privilege. The Expert above is not your attorney, and the response above is not legal advice. You should not read this response to propose specific action or address specific circumstances, but only to give you a sense of general principles of law that might affect the situation you describe. Application of these general principles to particular circumstances must be done by a lawyer who has spoken with you in confidence, learned all relevant information, and explored various options. Before acting on these general principles, you should hire a lawyer licensed to practice law in the jurisdiction to which your question pertains.

The responses above are from individual Experts, not JustAnswer. The site and services are provided “as is”. To view the verified credential of an Expert, click on the “Verified” symbol in the Expert’s profile. This site is not for emergency questions which should be directed immediately by telephone or in-person to qualified professionals. Please carefully read the Terms of Service (last updated February 8, 2012).

Show MoreShow Less

Ask Your Question

x