Uncategorized

For broker-dealers registered with the Securities and Exchange Commission, records retention is not just a good business practice — it is a strictly enforced regulatory obligation. SEC Rule 17a-4, issued under the Securities Exchange Act of 1934, specifies in precise detail how long broker-dealers must retain different categories of books and records, how those records […]

The Sarbanes-Oxley Act of 2002 (SOX) fundamentally changed how public companies manage, retain, and destroy corporate records. While SOX’s core provisions target public companies directly, its document destruction requirements have significant implications for subsidiaries — operating companies, wholly owned entities, and other corporate affiliates that operate under the umbrella of a publicly traded parent. A

In many healthcare settings, the journey of a patient record does not end at the electronic health record system — it continues onto paper. Encounter summaries, referral letters, prescription printouts, lab result printouts, and billing statements are all forms of printed protected health information (PHI) that flow through medical offices, hospitals, and other healthcare facilities

If your healthcare organization, medical practice, or other HIPAA-covered entity works with a shredding vendor to destroy protected health information (PHI), you need to understand the role of the Business Associate Agreement in your compliance program. A HIPAA shredding vendor business associate agreement is a legally required contract that governs how your shredding company may

Every year, millions of employers across the United States run background checks, credit reports, and consumer reports as part of their hiring process. Under the Fair and Accurate Credit Transactions Act (FACTA), businesses that use these consumer reports have a legal obligation to dispose of them properly when they are no longer needed. The FACTA

Insurance agencies across New York handle volumes of sensitive customer information every day — applications, policy documents, claims files, medical histories, and financial records. Under the Gramm-Leach-Bliley Act (GLBA), financial institutions — including many insurance companies and agencies — are required to protect this information throughout its lifecycle, including at the point of disposal. GLBA

When most financial firms think about New York’s Department of Financial Services (DFS) Cybersecurity Regulation — officially 23 NYCRR 500 — they focus on firewalls, encryption, and multi-factor authentication. But the regulation’s requirements extend beyond digital assets. If your firm maintains nonpublic information (NPI) in paper format — client account statements, loan documents, insurance applications,

The Federal Trade Commission’s Red Flags Rule is one of the most important—and most commonly misunderstood—identity theft prevention regulations affecting businesses in the United States. Originally enacted under the Fair and Accurate Credit Transactions Act (FACTA), the Red Flags Rule requires certain creditors and financial institutions to develop, implement, and administer written identity theft prevention

When most healthcare administrators think about the Health Information Technology for Economic and Clinical Health (HITECH) Act, they focus on electronic health records, meaningful use requirements, and digital breach notification. But HITECH’s reach extends significantly beyond the digital realm—and its implications for paper record disposal are profound and often misunderstood. For healthcare organizations in New

Political campaigns are among the most information-intensive operations in any election cycle. From candidate exploratory committees to full-scale congressional or state-level campaigns, political organizations collect and process enormous volumes of sensitive information: donor contribution records, volunteer contact lists, voter canvassing data, internal strategy documents, opposition research files, and payroll records for campaign staff. When a