How to Move to Remote Work and Comply with U.S. Privacy and Cybersecurity Laws

Determining whether a worker or particular portion of the business is “essential” requires a case-by-case analysis under each state’s order, and Orrick has a dedicated team helping businesses determine exactly which parts of their operations can remain open.

In the meantime, even where a business is technically allowed to remain open, many are considering moving to remote work arrangements to address potential health concerns and to plan for continued business operation given the growing pandemic. This blog post examines a sampling of the major U.S. data privacy and security laws, standards and frameworks implicated by remote work arrangements and offers practical considerations for how businesses can make the move to remote work arrangements in a way that meets these legal requirements while minimizing privacy and cybersecurity risks.

1. U.S. REGULATORY ENVIRONMENT
   1. 1. GLBA

   The Gramm-Leach-Bliley Act (“GLBA”) governs the processing of “nonpublic personal information” (“NPI”) by: (i) financial institutions that collect, process or disclose NPI about their consumers or customers; and (ii) persons who receive NPI from financial institutions with whom they are not affiliated.  The GLBA “Safeguards Rule” requires financial institutions to develop, implement and maintain reasonable administrative, technical and physical safeguards to protect the security, confidentiality and integrity of customer records containing NPI.[1]  While the Safeguards Rule imposes fairly general obligations on financial institutions and does not explicitly address remote working or remote access, regulated entities and their third-party service providers that receive NPI should consider the minimum security requirements set forth in the implementing regulations and guidance from applicable federal agencies, for example:

   1. 1. 1. Interagency Guidelines: Under the GLBA, federal financial regulators (the Office of the Comptrollers of the Currency (“OCC”), the Federal Deposit Insurance Corporation (“FDIC”) and the Federal Reserve Board (“FRB”) have promulgated guidelines regarding security, including the Interagency Guidelines Establishing Information Security Standards.[2] The Security Guidelines do not explicitly address remote working, but they set forth a number of security measures that are highly relevant to remote access, including, among other things:
            1. Access controls,
            2. Access restrictions at physical locations, and
            3. Encryption of electronic customer information while in transit or in storage.
         2. FFIEC Examination Handbook: The Federal Financial Institutions Examination Council (the “FFIEC”) is an interagency body empowered to prescribe uniform principles, standards, and report forms for the federal examination of financial institutions of the Board of Governors of the Federal Reserve System, the FDIC, the National Credit Union Administration (the “NCUA”), the OCC, and the Consumer Financial Protection Bureau (the “CFPB”). The FFIEC’s Information Technology Examination Handbook on information security addresses the “regulatory expectations regarding the security of all information systems and information maintained by or on behalf of a financial institution, including a financial institution’s own information and that of all of its customers”.[3] The Handbook states that institutions should implement the following measures specifically related to remote access:
            1. Disable remote communications if no business need exists.
            2. Tightly control remote access through management approvals and subsequent audits.
            3. Implement robust controls over configurations at both ends of the remote connection to prevent potential malicious use.
            4. Log and monitor all remote access communications.
            5. Secure remote access devices.
            6. Restrict remote access during specific times.
            7. Limit the applications available for remote access.
            8. Use robust authentication methods for access and encryption to secure communications.
         3. FTC. The Federal Trade Commission (“FTC”) has also provided guidance for covered financial institutions to comply with the Safeguards Rule.[4] The FTC’s guidance states that, to support remote working, financial institutions should develop policies for employees who telecommute, for example by considering “whether or how employees should be allowed to keep or access customer data at home” and requiring “employees who use personal computers to store or access customer data to use protections against viruses, spyware, and other unauthorized intrusions.”
      2. SEC OCIE

   The Office of Compliance Inspections and Examinations of the Securities and Exchange Commission (“SEC” and “OCIE”) administers the SEC’s nationwide examination and inspection program of SEC-registered entities, including broker-dealers, transfer agents, investment advisers, investment companies, private funds, the national securities exchanges, clearing agencies, the nationally recognized statistical rating organizations, the Financial Industry Regulatory Authority, the Municipal Securities Rulemaking Board, and the Public Company Accounting Oversight Board.

   OCIE has emphasized its focus on cybersecurity issues over the years, and in January 2020 it released cybersecurity and resiliency-related examination observations based on “thousands of examinations of broker-dealers, investment advisers, clearing agencies, national securities exchanges and other SEC registrants.”^[5] OCIE’s observations focused on many key areas that implicate remote access arrangements, including governance and risk management, access rights and controls, data loss prevention, incident response and resiliency, vendor management, training and security, and mobile security. For example, OCIE identified measures that organizations have implemented to address concerns relating to the “additional and unique vulnerabilities” from mobile devices and applications, including: (i) establishing appropriate policies and procedures for the use and security of mobile applications; (ii) creating mobile device management programs that can be integrated with employees’ personal devices when used for company business; (iii) implementing security measures, including multi-factor authentication and the ability to remotely clear data from mobile devices; and (iv) training employees on the use of mobile technology.

   Please note that the SEC continues to provide updated guidance to market participants affected by COVID-19, which can be found on its COVID-19 response page here: https://www.sec.gov/sec-coronavirus-covid-19-response.

   1. 1. HIPAA

   The Health Insurance Portability and Accountability Act and its Privacy and Security Rules (“HIPAA”) do not explicitly address remote working arrangements, but require covered entities and business associates to implement appropriate safeguards to ensure the privacy and security of protected health information (“PHI”), including electronic protected health information (“ePHI”).[6]

   The U.S. Department of Health and Human Services (“HHS”) has developed guidance to provide HIPAA-regulated entities with general information on the risks and possible mitigation strategies for remote use of and access to ePHI[7], including:

   1. 1. • Completing an analysis of the potential risks and vulnerabilities associated with remote access to, and offsite use of, ePHI, and developing risk management measures to reduce such risks and vulnerabilities to a reasonable and appropriate level in compliance with the HIPAA rules.
         • Conducting a workforce awareness and training program that specifically addresses any vulnerabilities associated with remote access to ePHI.
         • Considering appropriate risk mitigation strategies, such as prohibiting or preventing download of ePHI onto remote systems or devices without an operational justification; requiring that all portable or remote devices that store ePHI employ encryption technologies of the appropriate strength; and installing virus-protection software on all portable or remote devices that store ePHI.

   HHS has issued multiple sets of guidance relating to COVID-19 that may be relevant for covered entities.[8]

   1. 1. New York Department of Financial Services

   The New York Department of Financial Services (“NYDFS”) imposes cybersecurity reporting requirements on covered entities, which may include banks, consumer lenders, money transmitters, insurance companies, and certain other financial service providers required to be licensed by the Department.[9]

   NYDFS requirements contemplate remote working arrangements, and require that regulated entities implement and maintain a comprehensive cybersecurity program that identifies and assesses internal and external cybersecurity risks, uses defensive infrastructure and policies and procedures, and detects and responds to cybersecurity events. For example, NYDFS requires that multi-factor authentication “be utilized for any individual accessing the Covered Entity’s internal networks from an external network, unless the Covered Entity’s CISO has approved in writing the use of reasonably equivalent or more secure access controls.”

   NYDFS has issued guidance to regulated financial institutions and requested assurances of the institutions’ operational preparedness relating to the outbreak of COVID-19.[10] In particular, NYDFS is seeking information about each institution’s plans to address how they will manage the potential effects of the outbreak and assess potential disruptions and other risks to their services and operations, including:

   1. 1. 1. Preventative measures tailored to mitigate the risk of operational disruption;
         2. A documented strategy addressing the impact of the outbreak in stages;
         3. Assessment of all facilities (including alternative or back-up sites), systems, policies and procedures necessary to continue critical operations and services if members of the staff are unavailable for long periods or are working off-site;
         4. An assessment of potential increased cyber-attacks and fraud;
         5. Employee protection strategies;
         6. Assessment of the preparedness of critical outside-party service providers and suppliers;
         7. Development of a communication plan to effectively communicate with customers, counterparties and the public;
         8. Testing the plan to ensure the plan policies, processes and procedures are effective; and
         9. Governance and oversight of the plan.

   In addition, the Superintendent of the NYDFS issued an order providing relief from certain New York Banking Law and New York Financial Services Law notice requirements (including with respect to office closures or relocations), as well as extensions regarding certain NYDFS regulatory reporting requirements.[11] Notably, the order emphasizes that regulated entities that move to remote working arrangements are expected to continue to remain appropriate safeguards and controls relating to data protection and cybersecurity: “individuals that are employed by or working for regulated entities or persons and are conducting licensable activities from their personal residences or other temporary location due to the outbreak of COVID-19 shall remain subject to the full supervision and oversight of such regulated entities and persons, and such regulated entities and persons shall maintain appropriate safeguards and controls, including but not limited to those related to data protection and cybersecurity, to ensure continued safety and soundness of such regulated entities and persons.”

   The NYDFS COVID-19 guidance refers out to the FFIEC’s recently updated interagency statement on pandemic planning, which can serve as a resource for organizations seeking to minimize the adverse effects of the pandemic.[12]

   1. 1. PCI-DSS

   The Payment Card Industry Data Security Standard (“PCI-DSS”) is a standard developed and maintained by the Payment Card Industry (“PCI”) counsel to secure and protect payment card data.[13] PCI-DSS requirements apply to organizations where “account data” is stored, processed or transmitted. The PCI-DSS requirements expressly contemplate remote access and provide explicit guidance as to how remote access should be set-up from a security standpoint, including requiring that organizations have the following controls relating to remote access in place, among others:

   1. 1. 1. Install and maintain a firewall configuration to protect cardholder data.
         2. Incorporate multi-factor authentication for remote access.
         3. Track and monitor all access to network resources and cardholder data.
         4. Tightly manage remote administrative privileges and remote access by third party service providers.
         5. Manage automatic disconnect of remote sessions after specific periods of inactivity, and after specific access windows afforded to vendors
         6. Develop usage policies for remote access

   Thus, to the extent remote workers will be processing payment card information, those remote work environments must be treated as part of the cardholder data environment, and the risks to the information must be evaluated and addressed according to the PCI-DSS requirements.

   1. 1. NIST Controls

   The National Institute of Standards and Technology (“NIST”) provides standards for recommended security controls for information systems at federal agencies. These standards are endorsed by the government, and companies comply with NIST standards because they encompass security best practices controls across a range of industries.

   Remote working is contemplated under various NIST standards, for example:

   1. 1. • General remote access security under SP 800-46 Rev2 – Guide to Enterprise Telework, Remote Access, and Bring Your Own Device (BYOD) Security.
         • Using virtual private networks under SP 800-77 – Guide to IPsec VPNs.
         • Securing remote access devices under SP 800-114 Rev1 – User’s Guide to Telework and Bring Your Own Device (BYOD) Security and SP 800-111 – Guide to Storage Encryption Technologies for End User Devices.
         • Wireless networking security concerns under SP 800-97 – Establishing Wireless Robust Security: A Guide to IEEE 802.11i.

   Because NIST frameworks and standards are often considered best practices across industries, companies are well advised to consider the foregoing in reviewing and updating their remote access plans.

2. PRACTICAL CONSIDERATIONS FOR REMOTE WORK ARRANGEMENTS
3. The bottom line is that these federal and state law requirements clearly contemplate cybersecurity controls in the context of remote access (even though the pandemic presents an unforeseen scope and magnitude of workers accessing corporate networks from home).  In sum, they generally require (1) assessment of risk, (2) implementation of reasonable policies, procedures and technical safeguards designed to mitigate those risks, and (3) effective ongoing monitoring, review and enforcement of such safeguards for continued effectiveness.

   Even where a business is not directly subject to these laws or standards, they nevertheless can provide a “reasonable” framework for evaluating the move to a remote work arrangement in a way that complies with privacy and security requirements while mitigating cybersecurity risks. Accordingly, taking the guidance as a whole, we suggest considering the following framework for such a move:

   • Work with information security to conduct a risk assessment that considers risks created by new working environment and what are appropriate controls designed to mitigate those risks
   • Implement a remote working policy or refresh existing policies that address remote work
   • Tightly control remote access through management approvals and subsequent audits
   • Have remote employees sign a remote working agreement and provide appropriate training
     • Consider employment law issues https://blogs.orrick.com/employment/2020/02/03/employer-readiness-plans-in-the-wake-of-the-coronavirus-outbreak/
     • Consider staffing up the remote help desk to address IT or other technical issues
   • Implement technical controls designed to meet any specific legal requirements (e.g., GLBA, PCI or NYDFS) such as:
     • Robust controls over configurations at both ends of the remote connection to prevent potential malicious use (e.g., firewalls, consider limiting screen captures and ability to download, etc.)
     • Log and monitor all remote access connections and actions
     • Secure remote access devices — offer company issued laptops, or allow personal devices with compensating controls such as an MDM (mobile device management) solution
     • Restrict remote access during specific times
     • Limit the applications available for remote access
     • Use robust authentication methods for access (e.g., multi factor authentication) and encryption to secure communications
     • Consider supplying privacy screens and secure headsets
     • Consider how to ensure strong and secure Wi-Fi connections, such as by providing mobile Wi-Fi hotspots or Wi-Fi Signal boosters that extend Wi-Fi signal coverage space by boosting or amplifying existing signals to use at home
   • Have in place effective overall monitoring, logging and auditing of all remote access
   • Review key contracts (e.g., from customers or otherwise) to confirm whether they impose special remote work requirements

In the ever-changing COVID-19 environment, businesses should also continue to monitor for guidance from state and federal regulators relating to remote working arrangements and remain vigilant about employees’ network access and actions while working remotely.

[1] 15 U.S.C. 6809, Section 509(4)(A).

[2] 12 C.F.R. Pt. 364, App. B (FDIC Codification).

[3] FFIEC, Information Technology Examination Handbook – Information Security, (Sept. 2016), https://ithandbook.ffiec.gov/media/274793/ffiec_itbooklet_informationsecurity.pdf.

[4] See FTC, Financial Institutions and Customer Information: Complying with the Safeguards Rule, (April 2006), https://www.ftc.gov/tips-advice/business-center/guidance/financial-institutions-customer-information-complying.

[5] See SEC, Cybersecurity and Resiliency Observations, (Jan. 27, 2020), https://www.sec.gov/files/OCIE%20Cybersecurity%20and%20Resiliency%20Observations.pdf.

[6] See the HIPAA Security Rule, 45 CFR Part 160 and Subparts A and C of Part 164, and the HIPAA Privacy Rule, 45 CFR Part 160 and Subparts A and E of Part 164.

[7] See HIPAA Security Guidance – Remote Use (December 2006) at https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/administrative/securityrule/remoteuse.pdf?language=es.

[8] OCR has published a bulletin advising covered entities of further flexibilities available to them as well as obligations that remain in effect under HIPAA as they respond to crises or emergencies at https://www.hhs.gov/sites/default/files/february-2020-hipaa-and-novel-coronavirus.pdf . In addition, OCR has published a notification of enforcement discretion for telehealth remote communications during the COVID-19 nationwide public health emergency at https://www.hhs.gov/hipaa/for-professionals/special-topics/emergency-preparedness/notification-enforcement-discretion-telehealth/index.html.

[9] 23 NYCRR 500.

[10] Emami, Shirin, Industry Letter – Guidance to New York State Regulated Institutions and Request for Assurance of Operational Preparedness relating to the Outbreak of the novel Coronavirus, (Mar. 10, 2020), https://www.dfs.ny.gov/industry_guidance/industry_letters/il20200310_risk_coronavirus

[11] NYDFS Superintendent Lacewell Order on COVID-19 (Mar. 12, 2020), https://www.dfs.ny.gov/system/files/documents/2020/03/ea20200312_covid19_relief_order.pdf.

[12] FFIEC, Interagency Statement on Pandemic Planning, https://www.csbs.org/sites/default/files/2020-03/2020%20FFIEC%20pandemic%20guidance%20TFOS%20Approved%2003-06-2020%20FINAL%20FINAL.pdf, (last accessed, Mar. 20, 2020)

[13] Payment Card Industry – Data Security Standards v3.2.1, https://www.pcisecuritystandards.org/document_library (last accessed Mar. 22, 2020).