The House Subcommittee on Commerce, Manufacturing and Trade heard from Sony and Epsilon about breaches that adversely affected consumer information. Both companies support a national data security and breach notification law.
House Cybersecurity Caucus Co-Founder Jim Langevin, D-R.I., says President Obama's cybersecurity legislative package is a step in the right direction, but lacks the stricter regulation needed for businesses that run critical IT infrastructures.
The recent Sony and Epsilon breaches sent a strong reminder that companies lack transparency and aren't prepared to respond to a breach once it occurs, says Kirk Herath, Chief Privacy Officer at Nationwide Insurance Companies.
Federal authorities have issued a detailed notice of proposed rulemaking that sets out guidelines for how patients must be provided with an accounting of who has viewed their protected health information.
"The administration has concerns about this provision and wants to work with Congress to ensure that any such legislation adds clarity and value to our efforts in cyberspace," a statement on policy administration says.
Sen. Susan Collins faults part of the administration plan she says could give those who would do harm a roadmap to attack the nation's critical IT infrastructure. DHS's Phil Reitinger says he doubts that would happen.
The federal list of major healthcare information breaches that have occurred since September 2009 didn't grow much in the past month. The list now includes 272 cases affecting a total of almost 10.9 million individuals.