Links to additional information

This section will provide links to further research on compliance and security topics.  In each case, a new browser page will be generated.  To return to this site, just minimize or delete the new link.

Basic Reference

For the text of the applicable laws:

Gramm-Leach-Bliley – Financial Modernization Act of 1999 - http://frwebgate.access.gpo.gov/cgi-bin/getdoc.cgi?dbname=106_cong_bills&docid=f:s900enr.txt.pdf

HIPAA  - Health Insurance Portability and Accountability Act  http://aspe.hhs.gov/admnsimp/pl104191.htm

Sarbanes-Oxley - Public Company Accounting Reform and Investor Protection Act.  http://news.findlaw.com/hdocs/docs/gwbush/sarbanesoxley072302.pdf

Patriot Act – Provide Appropriate Tools Required to Intercept   and Obstruct Terrorism.  http://www.fincen.gov/hr3162.pdf

California SB 1386 – Notification of Security Breaches - http://info.sen.ca.gov/pub/01-02/bill/sen/sb_1351-1400/sb_1386_bill_20020926_chaptered.html

 Articles  

For various articles of interest are linked here.  This section will be updated on a monthly basis.  Each law will have its own set of relevant articles.

Gramm-Leach-Bliley

• A thoughtful discussion of the implications of GLBA by a law professional - http://www.gigalaw.com/articles/2002-all/ftc-2002-01-all.html

• A summary of the GLB Security requirements and implications from SANS, which is the premier source for security professionals - http://www.gigalaw.com/articles/2002-all/ftc-2002-01-all.html

• Clearly a marketing publication from Verisign, but a good overall description of the requirements - http://www.verisign.com/resources/datasheet/solutions/GLBA.pdf

• Summary of requirements - http://www.itsecurity.com/papers/recourse1.htm

HIPAA

• HIPAA Advice for Physicians from the American Medical Association - http://www.ama-assn.org/ama/pub/category/4234.html

• Link to HIPAA Advisory.com, with several onward links to helpful information - http://www.hipaadvisory.com/action/

• A brief but complete overview at the 50,000 foot level - http://www.unixreview.com/documents/s=2427/uni1022692292633/0205l.htm

• Summary of implications for medical software developers of the HIPAA Security Rules - http://builder.com.com/5100-6387-5096817.html

• Results of a Fall 2003 Survey of HIPAA compliance - http://www.hipaadvisory.com/action/surveynew/fall2003.htm

Sarbanes-Oxley

•  A summary by the AICPA - http://www.aicpa.org/info/sarbanes_oxley_summary.htm

•  Interesting article from CFO Magazine - http://www.cfo.com/Article?article=8878

•  Another article from CFO – outlines some of the issues companies face, and alludes to the role of IT - http://www.cfo.com/Article?article=8878

•  Surveys by Information Week - Executives depend on technology to keep their companies in line with the Sarbanes-Oxley Act.  http://www.securitypipeline.com/story/showArticle.jhtml?articleID=15201988

California SB 1386

•  For advice and counsel on what to do to comply - http://www.questsys.com/images/SB1386.pdf

• An example of a security breach, and a description of the new California law - http://www.scmagazine.com/scmagazine/2003_06/feature_1/

• Case Study:  One Company’s Response to the Law - http://www.giac.org/practical/GSEC/Gordon_Bass_GSEC.pdf

Research and White Papers

• The definitive list of HIPAA links - http://pweb.netcom.com/~ottx4/HIPAA.htm

• Interesting set of whitepapers on complying with GLBA - http://www.stillsecure.com/index.jsp?sector=papers_briefs&rf=overtureglba

•  White Paper by Protiviti (ex: Arthur Anderson) on the issues and requirements of Sarbanes-Oxley – http://www.protiviti.com/downloads/CFOSurvey.pdf

•  Sarbanes-Oxley Resource Center of AMR Research - http://www.amrresearch.com/SOA/default.asp

• Home site for Sarbanes-Oxley - http://www.sarbanes-oxley.com/index.php

• The cost of compliance – research report by Information Week - http://www.securitypipeline.com/story/showArticle.jhtml?articleID=15201368

• White Paper on the META Security Group Command Center™ - http://www.metasecuritygroup.com/library/whitepapers/CCWhitePaper4.2.2.pdf

• Send in the Chief Risk Officer – Information Week - http://www.securitypipeline.com/story/showArticle.jhtml?articleID=15202156

• Price Waterhouse Cooper’s interpretation of the HIPAA security rules - http://www.pwchealth.com/cgi-local/hcregister.cgi?link=pdf/securityrules.pdf

Totally Compliant, LLC provides these links as a service and is not responsible for their content.