5 Ways To Protect Employee Data During Open Enrollment

Organizations across industries continue to experience healthcare data breaches. Protecting sensitive employee and health information remains a significant ongoing concern.

Data breaches can occur via paper, laptops, desktop computers, servers and portable electronic devices. However, email is the most common technology for accidental data breaches.

Employee mistakes remain one of the most common causes of data exposure incidents, particularly involving email, file sharing, and document handling. Some of the most common accidents include:

Forwarding sensitive data to the wrong email address.
Sharing attachments with hidden content that should have been removed.
Forwarding data to personal email accounts.

In most cases, these breaches are compounded by a lack of data encryption before being shared.

You have a legal and moral obligation to keep employee information safe. That is never more evident than during open enrollment.

Employees are sharing personal information like Social Security numbers, dates of birth and dependent information. Depending on the benefits being offered, sensitive health information may be handled by insurers, third-party administrators or enrollment vendors. Your organization should understand what information is collected and how it is protected.

Here are five ways to meet your responsibility and help keep everyone’s information secure.

1. Keep files confidential

All employee files should be kept confidential. This should go without saying, but it bears repeating given how busy you can get during open enrollment. If you have an online portal for employees to enroll:

Limit administrative access to only those with a business need. For example, you may want to limit access to human resources management and benefit administrators. Unless it is necessary for an individual to perform their job, employees should not have access to other employees’ information.
Password-protect access to the system. Use strong, unique passwords or passphrases, and consider a password manager to securely generate and store credentials.
Never access the system on a public computer. This goes beyond not wanting anyone to track your history and access the site. You do not want anyone looking over your shoulder or snapping a picture of your login credentials.

If you do not have an online portal for employees to use, keep paper copies locked in a filing cabinet. Never leave information out on a desk or in a copy machine.

Also, keep open enrollment information separate from personnel information. While management outside of human resources may need access to personnel files, they should not require access to open enrollment forms.

2. Establish internal protocols and data flow

Before open enrollment even begins, evaluate your internal policies and procedures. The first step is identifying where and when you interact with employee information. Map out these touchpoints and track how data flows through your organization. Also define:

How long and where documents are stored
When and how documents are destroyed

Establishing privacy and security policies for anyone handling this data is just as important. In addition to ensuring compliance with all laws, install a firewall between those with access to the information and those without.

Protect your network: Firewalls and anti-virus software are essential. You should also consider segregating networks. Store employee information on a separate server, and ensure it’s accessed only through a secure network.
Protect all portable devices: Encrypt devices that store sensitive information, including tablets, cell phones, laptops, and portable storage devices such as USB drives. Implement security controls such as remote-wipe capabilities, access controls and device-management tools.
Protect your data: Encrypt any data stored on your systems. This makes it unintelligible to anyone without the necessary codes to decrypt the information. And it provides you with a second or third layer of protection.

You may also want to use secondary verification or multifactor authentication. This asks users with access to the system to provide a password and a second form of authentication, providing another layer of protection.

3. Work with your vendor to map external data flow

Similar to verifying processes and policies internally, work with your vendors to ensure they keep your employees’ open enrollment information safe as well. Ask for documentation on each vendor’s best practices as they pertain to federal and local privacy laws.

How long and where is employee data stored? Is there a secure server with off-site backup? If employees send documents directly to the vendor, how are those documents destroyed?
Is open enrollment data encrypted? Are servers encrypted? Is your employee data segregated from other employers’ data?
Who has access to open enrollment data? How are they identified? How do they access the data?

If any of your vendors work with third-party vendors, verify that they follow proper security procedures.

4. Educate employees about security protocols

Anyone with access to employee information should be intimately familiar with internal security policies and procedures. Be transparent about security risks and how you safeguard against them.

Make sure your training includes general instruction about phishing, social engineering and other attacks that target employee information. Educate employees on how to create a secure password, or provide access to software that generates a random one.

Remember, you are only as strong as your weakest link. Training should be ongoing, and no one should ever take employee data security for granted. Security violations should be addressed promptly and consistently in accordance with company policies and the nature of the incident.

5. Be prepared if there is a breach

Part of being prepared for a security breach is having an emergency response plan. Establish a crisis management team to direct communications after a breach is discovered. Make sure everyone knows their part, and be clear about who should be the first to know. You may even want to draft potential messaging for employees, clients, suppliers and the media to let them know what happened and how you are handling the situation.

Similarly, you need to understand the repercussions if you fail to comply with local and federal regulations. Be sure to conduct routine audits of procedures and documentation to ensure compliance with all laws.

If you are not sure exactly what applies to your organization, contact us. We can help you audit your plan, or you can hire an external agency to assist you.

We can also help you design and implement internal security protocols that protect you during open enrollment and beyond. Let’s ensure your employee information stays safe, no matter the time of year.