Speaker 1: The number one point when it comes to data privacy and security and breach response is really having a plan in place, an incident response plan, an IRP, really a way to think about and document what the organization is going to do when we discover that something, something has happened. We're not quite sure what it is, but something. Having that plan in place, having a team behind that plan that will effectuate what we need to do when we discover a potential breach makes all the difference in the world. Really, breach response is about timing. These are all time-sensitive deadlines. We need to act quickly, but we need to act sensibly. And having a plan in place on that point really makes all the difference in the world. To some extent these days, breaches are really a matter of when, not if, and that plan in place, building that out makes all the difference because in the heat of the moment, we don't want to have to scramble. We don't want to have to think about what we're going to do, particularly maybe if key staff members are out, they're on vacation, they're away. We want to have that all neat, compiled in one step that anyone can refer to and know this is what we need to do. Now, second to that, there are certainly IT controls, there are very robust technologies out there that we can implement from an organizational perspective to mitigate some of this risk. A good example is encryption, end-to-end encryption. Encryption not being the same thing as password protecting, but often, and some of the largest breaches in history have really resulted from individuals losing IT assets, meaning laptops, smartphones that have a variety of information stored on them, and the easiest way to mitigate against that risk is really encryption for those portable devices. If you can implement that type of control and you lose that type of device, smartphone, laptop, what have you, if it is encrypted, particularly past a certain standard of encryption, you're not looking at a notification obligation. Most of the state laws out there have a safe harbor for encrypted data assets, encrypted IT assets. So, a very cost-effective means at times of dealing with this risk is end-to-end encryption. The other aspect is training, is routine training of employees. Having the folks that work for you realize what this risk is, what they need to do if they notice something, making it clear that the goal here is to protect the information, protect the patients who provide the information, routinely training employees on that type of risk, documenting that training, having a record of it, is very, very important for purposes of protecting against this risk. Another component here would be risk transfer. There is a now increasingly developed set of insurance products that speak to this type of risk. Really, it becomes at times a challenge to make sure that you have the right product, you want to have the right insurance coverage built in that really foresees the aspects that can happen when a breach occurs, speaks to the various types of costs that you will have to incur to investigate and respond to this type of incident. For more information, visit www.FEMA.gov