Today, we take action against two companies that collected names, addresses, Social Security numbers, driver's licenses, and other proprietary information (PI) belonging to low-income Americans and stored them on unprotected Internet servers that anyone in the world could access with a search engine and basic manipulation. The companies stored such consumer PI in two publicly accessible folders on the Internet without password protection or encryption. By not employing appropriate or even reasonable    security measures, the companies exposed their customers to an unacceptable risk of identity theft and other serious consumer harms.[4]

The Companies' privacy policies assure those persons submitting"[c]ustomer specific information" through their website that they will protect that information and, in fact, inform such applicants that"[b]y providing us with your information, you acknowledge that you have read this privacy policy, understand it, agree to its terms and consent to the transfer of such information outside your resident jurisdiction.[11]

• Storing the information in plain text thereby enabling it to be read by search engines - "the PI hosted by Vcare on its server was widely available on public websites online through a simple Google search," at least two applications were cached by the Google search engine, and these applications remained cached until the FCC contacted Google to have them removed.[14]

• Failing to properly secure the server directories storing the PI and using applicant names in the URLs -

• "The Companies knew or should have known that the use of random URLs without more (e.g., encryption) to protect applicant records provided inadequate security and left the documents vulnerable to exposure via search engines-which operate by visiting websites, indexing all or much of the content available on them, and then delivering links to the indexed results to anyone that queries the engine."[15]

• "[T]he Companies' URL naming convention for one of the folders containing PI that was stored on Vcare's server also exposed the names of the applicants or customers directly in the URL, further demonstrating the lack of security of the records."[16]

• Failing to use encryption - "We do not hold here that encryption without more would satisfy a carrier's duty under Section 201(b); however, given the state of technology, we believe the lack of encryption clearly evidences the unjust and unreasonable nature of the Companies' data security practices."[17]

Until at least July 2011, Accretive failed to provide reasonable and appropriate security for consumers' personal information it collected and maintained by engaging in a number of practices that, taken together, unreasonably and unnecessarily exposed consumers' personal data to unauthorized access. Among other things, Accretive Health created unnecessary risks of unauthorized access or theft of personal information by:

a. Transporting laptops containing personal information in a manner that made them vulnerable to theft or other misappropriation;

b. Failing to adequately restrict access to, or copying of, personal information based on an employee's need tor information;

c. Failing to ensure that employees removed information from their computers for which they no longer had a business need; and

d. Using consumers' personal information in training sessions with employees and failing to ensure that the information was removed from employees' computers following the training. [6]

[E]stablish and implement, and thereafter maintain, or continue to maintain a comprehensive information security program reasonably designed to protect the security, confidentiality, and integrity of personal information collected from or about consumers. Such program ...shall contain administrative, technical, and physical safeguards appropriate to respondent's size and complexity, the nature and scope of respondent's activities, and the sensitivity of the personal infonnation collected from or about consumers, including:

(1) The designation of an employee or employees to coordinate and be accountable for the information security program;

(2) The identification of material internal and external risks to the security, confidentiality and integrity of personal information that could result in the unauthorized disclosure, misuse, loss, alteration, destruction, or other compromise of such information, and the assessment of the sufficiency of any safeguards in place to control the risks. At a minimum, this risk assessment should include consideration of the risks in each relevant area of operations, including but not limited to: (a) employee training and management; (b) information systems, including network and software design, information processing, storage, transmission, and disposal; and (c) prevention, detection, and response to attacks, intrusions, and other system failures;

(3) The design and implementation of reasonable safeguards to control the risks identified through risk assessment and regular testing and monitoring of the effectiveness of the safeguards' key controls, systems, and procedures;

(4) The development and use of reasonable steps to select and retain service providers capable of appropriately safeguarding personal information they receive from respondent, and requiring service providers by contract to implement and maintain appropriate safeguards; and

(5) The evaluation and adjustment of the information security program in light of the results of the testing and monitoring required by [this Order], any material changes to operations or business arrangements, or any other circumstances that Defendant knows or has reason to know may have material impact on the effectiveness of the information security program. [7]

• The FTC Consent Order requirements may track HIPAA requirements, including undertaking a risk assessment.

• The FTC appears to be requiring Accretive to undertake some sort of vetting process of subcontractors to ensure that they are "capable of appropriately safeguarding personal information they receive from" Accretive, in addition to entering into business associate agreements.
  

• In some respects, it would have been better for Accretive if it was OCR that brought an action because OCR's resolution agreements are generally for about 5 years. But, the FTC's agreement is for 20 years.