Issuu

Volume 16, Issue 2

SUMMER 2019

Security Shredding News Serving the Security Shredding & Records Storage Markets

Visit us online at www.SecurityShreddingNews.com

A Look Inside The Bale New technology to measure the quality of recovered fiber bales can give mills and MRFs data for more informed business decisions.

he U.S. paper manufacturing sector is one of the world’s biggest consumers of recovered fiber, with more than three-quarters of domestic mills using recovered fiber in some or all of their products. The United States is also a huge contributor to the recovered fiber supply, achieving 65.8 percent recovery, nearly 51 million tons, in 2017, according to the American Forest & Paper Association (Washington, D.C.). Despite that strong domestic supply and demand, quality measurement in recovered paper has not been as effective as it could be. Times are changing, however, and new technologies are offering more detailed and reliable methods to measure and report bale quality and yield, data that can provide more growth and opportunity for today’s buyers and suppliers.

A Look Back

he recovered fiber sector’s lack of T fundamental quality-control measures that are consistent, thorough, and reproducible has been a significant liability for fiber buyers. Up until a few years ago, quality measurement relied primarily on what’s called “ocular technology”—a visual assessment of the exterior of the bale. While experienced mill operators can tell a lot about a bale’s quality simply by looking at it, this approach has significant drawbacks: Results will vary from person to person, and you’re only seeing the exterior of the bale. The first systematic approaches to measuring bale quality were aimed at moisture. Visual observations of a bale’s exterior can identify very high moisture content, roughly 20 percent or more, whereas 12 percent is what the preamble of ISRI’s scrap specifications for paper stock declares is the maximum acceptable moisture content. That substantial gap between

By Michael McSween and Bill Moore Near-infrared spectroscopy can measure multiple quality factors in recovered fiber bales in addition to moisture. Here, the operator has drilled a roughly 1-inch-diameter hole into the bale and inserted the NIR probe to take a reading, which takes about one minute. the acceptable moisture limit and what the naked eye can see could be costly to a mill that ends up purchasing excessive moisture when it expects to be buying fiber. The first commonly used moisture measurement tool was a moisture probe, a long and narrow metal rod that can penetrate a few inches into a bale at best. It’s certainly an improvement over visual examination, but the inspector must do multiple insertions to get a sense of moisture variation throughout the bale. This measurement device takes away some of the person-to-person variation of visual inspection, but it is not widely known for its accuracy. Plate-style devices were the next advancement in bale moisture measurement. These devices are an improvement over probes in that they can read moisture levels deeper into a bale and evaluate much more of a bale’s content, and they’re still in wide use by U.S. paperboard mills. T h e m o s t a dva n c e d approach to moisture measurement available today is a microwave frame, which is prevalent in some parts of Europe and China. This technology can evaluate the moisture content in an entire bale or a whole shipment of bales while it’s on the truck—but only if the shipment is on an open-sided or soft-sided truck. The microwave technology’s inability to work with metal truck

or container bodies, which are by far the most common in the United States, explains why it has not been adopted in North America despite its distinct advantage over older technologies.

Seeking More and Better Quality Analysis

hile the industry has certainly experienced W progress, all the above approaches, short of those overseas, have only been aimed at moisture, with no systematic way to measure the other important compositional components of recovered fiber that could greatly impact quality and yield, such as plastic and ash content. To date, the only reliable way for mills to measure those other factors has been to break open the bales and weigh the different contaminants, which is a very laborious and expensive endeavor. It was a routine practice at U.S. newsprint mills, but few recycled newsprint mills remain in North Amer-ica. The practice has been less common at paperboard and tissue mills. Moore & Associates believes recovered paper buyers could benefit from a better analysis of the entire composition of the bale to understand how the shipment conforms to the grade’s specification in terms of prohibitives and outthrows—not just moisture—and to calculate the total amount of usable fiber. Having access to this type of information would provide valuable quantitative data to buyers for claim management as well as serve as inputs for buyers looking to normalize the true landed cost of fiber. It can also be useful for a mill’s papermakers to determine what recipe of recovered paper to use. Continued on page 3

Have you started shredding hard drives and SSD’s yet?

The future is here. Everything needs to be destroyed. No better time than now to create new revenue stream for your business

LLEGHENY MANUFACTURES a complete line of powerful hard drive shredders, providing everything from 3 HP shredders for those companies just entering into this thriving business, to 20 HP fully automated E-scrap destruction systems. All of our Hard Drive Shredders can be equipped for mobile on-site shredding, giving you the option to shred at your place…or theirs!

Securely Shred SSDs and Rotary HDs

well as cell phones, USB drives, CD’s, and many other e-scrap products to be destroyed on the SAME machine.

We’ll help get you started!

Don’t fall behind the times! Our experts will help you launch your own hard drive destruction service right away, so you can reap the benefits of this growing and critical niche in information destruction.

Don’t forget about Allegheny’s SelecShred™ Hard Drive Shredder! Manufactured with a split head cutting assembly, this shredder allows for solid state drives and rotary hard drives, as

call us today

800-245-2497

alleghenyshredders.com

12HD20 SELECSHREDTM HARD DRIVE SHREDDER

Old William Penn Hwy E, Delmont, PA 15626 ■ 800-245-2497 toll free alleghenyshredders.com Old William Penn Hwy East, Delmont PA 15626 ■

2 Security Shredding News Summer 2019

Security Shredding News

A Look Inside The Bale

Continued from page 1

If buyers can calculate purchase costs as they relate to measured fiber percentage, then they can obtain the true cost per ton of the fiber alone. Furthermore, by understanding how each supplier’s bale yield contributes to a paper mill’s overall yield, buyers can quantify yield improvements through the supply base while normalizing costs. Moore & Associates has calculated that a typical U.S. paperboard mill could save approximately $400,000 a year for each 1-percent increase in fiber it purchases rather than moisture or contaminants. Those are not the only drivers that have the

industry seeking better recovered fiber quality measurement. The strict 0.5-percent prohibitives level China instituted on imports of recovered fiber in 2018 has suppliers very cautious about the quality of scrap paper shipments to that country. At the same time, tissue mills and other producers of paper products are seeking better ways to adjust their papermaking recipes for the various fiber compositions in the high-grade recovered fiber they use.

Europe Pioneers A New Approach

the past five years, the European paper Ithatnindustry has started to embrace equipment uses near-infrared technology that can

PUBLICATION STAFF Publisher / Editor Rick Downing Contributing Editors / Writers Michael McSween and Bill Moore Sandy Woodthorpe Production / Layout Barb Fontanelle • Christine Mantush Advertising Sales Rick Downing Subscription / Circulation Donna Downing Editorial, Circulation & Advertising Office 6075 Hopkins Rd., Mentor, OH 44060 Ph: 440-257-6453 Fax: 440-257-6459 Email: downassoc2@oh.rr.com www.securityshreddingnews.com For subscription information, please call 440-257-6453 Security Shredding News (ISSN #15498654) is published bimonthly by Downing & Associates. Reproductions or transmission of Security Shredding News, in whole or in part, without written permission of the publisher is prohibited. Annual subscription rate U.S. is $19.95. Outside of the U.S. add $10.00 ($29.95). Contact our main office, or mail-in the subscription form with payment.

more accurately measure moisture, outthrows and prohibitives, ash content, fiber composition, and even the brightness of recovered fiber bales. Early on, Spanish paperboard producer SAICA (Zaragoza, Spain) pioneered NIR systems that mechanically extract bale cores and analyze them. More recently, systems installed in Europe along with a few in China have used a manual core drilling approach with insertable NIR probes. While still an emerging technology in recovered paper, other industries, such as those producing animal feed, have used NIR spectroscopy to understand sample composition for years. As a solutions and services provider for traders of recovered paper, merQbiz (Los Angeles) believes the data and analytics NIR technology can provide will change the industry’s operations. A quality measurement system should provide a road map for improvement by using consistent, quantitative values that connect to the business’s key performance indicators. It must give users the ability to take action based on the information they have and to ultimately get predictive as they repeat measurements over time. The quality and composition data the system can provide, in addition to existing data on paper grade, price, and transportation expenses, can reveal hidden opportunities or reduce the likelihood of buyers making bad decisions based on incomplete information. It can also add teeth to mill buyers’ claims or downgrades—and protect suppliers who provide high-quality material against unwarranted claims or downgrades—by providing an objective standard against which they’re measuring. NIR bale quality-measurement systems require less manpower compared with bale breaking, measure more bales, and remove the variability of visual inspection for better accuracy and reproducibility. These systems also measure deep inside the bale, not just the outer surface. This is especially true for the core drilling approach with insertable NIR probes. Users of these systems are gaining confidence as more

Paper mills in some parts of Europe and China have implemented a microwave frame that can read moisture levels in recovered fiber bales while they’re on the truck. The technology will not work with metal-walled trucks or containers, however, which limits its potential for use at North American mills. tests of the technology are underway in North America, including tests that correlate NIR measures to existing quality checks performed by manually breaking bales. While some limitations exist—NIR systems don’t separate and measure the plastic in a recovered paper bale by resin type, for example—offsetting those limitations are the benefits of its precise fiber and nonfiber measures along with the overall portability of the equipment. Throughout the past year, merQbiz has started to bring NIR bale-quality analysis technology to recovered paper suppliers and mills with the BaleVision business tool. BaleVision can create baseline audits of a mill’s existing supply base and provide predictive fiber yield analyses. The reporting system, which launched just over a year ago, gives supply chain managers the information they need to make informed purchasing decisions while also helping mills assess desired fiber types. Thus far, more than a half-dozen companies in North America have used the technology to evaluate moisture content, plastic prohibitives, and overall fiber bale yield. They are comparing the results to the grade specifications and using the data to identify pass/fail criteria for arriving loads. Then they are combining the quality and yield information with bale price and transit costs to determine the true landed cost of delivered fiber. The data have shown the positive and negative contributions of each supplier and quantified if the benefit is due to cost, transportation, or quality, ultimately providing transparency on how buyers can better manage their supply costs. Continued on page 4

Security Shredding News Summer 2019

Security Shredding News

A Look Inside The Bale

Data Protection Association (DPA) Rolls into i-SIGMA

How It Works

Continued from page 3

o perform the BaleVision bale-quality analysis, trained inspectors arrive on site at the mill or warehouse with appropriate safety gear and all necessary equipment, including a cordless drill, auger bits, and an NIR probe measuring approximately 4 feet long and a little less than 1 inch in diameter. They randomly select up to five bales from an inbound shipment to analyze. (Bales in storage are less ideal subjects for analysis as characteristics such as moisture and brightness can change over time.) The inspectors drill a hole approximately 1 inch in diameter and 2 feet in depth into each selected bale, either manually or by using an automated system equipped with the NIR measuring device. In the manual system that merQbiz uses, the inspectors insert the NIR probe in the bale, which measures the entire surface area of the hole. Measurement outputs include moisture, plastic, ash, and ratio of mechanical to chemical pulp. The reading takes approximately one minute per hole, and the inspectors conduct multiple measurements per hole to ensure a representative bale average. The overall inspection takes between five and 15 minutes per bale depending on customer criteria. The inspectors can test samples from 20 to 25 trailers in a typical fourday baseline inspection period. They then review supplier information to determine the resulting measured volume. To date, merQbiz has found that the 80/20 rule applies to most mill supplier bases: 20 percent of a mill’s suppliers provide 80 percent of the value and vice versa. The BaleVision system organizes the collected data on NIR measures, which establishes a baseline of key metrics. This allows the customer to compare those metrics to the grade specification as well as to the larger merQbiz quality database, which aggregates the results across the North American recovered paper supply base. The system stores the customer’s bale inspection data with procurement information to normalize all data relative to price and logistics costs. MerQbiz recommends that each company wait until it has at least six months of procurement data for comparative averages. This establishes baseline key performance indicators for the true landed cost of fiber. Normalized data not only help paper mills determine the real cost of the fiber they purchase, but also allow mills to stack rank all of their suppliers. Customers set the bale inspection frequency according to the volume captured per inspection period and the data points they need to gain statistical confidence for each supplier or supplying location. Consider a paper mill with an incoming volume of 40,000 tons of recovered fiber per month. It’s likely the system could capture baseline data for 60 percent or more of its supplier locations in a six- to eight-day inspection period. The merQbiz R&D team believes the near-infrared technology it’s using to assess the quality of recovered paper bales, along with the other features of the BaleVision system, could ultimately change the way mills and suppliers conduct business. Its accuracy and in-depth analytics give suppliers and buyers a true, comprehensive measure that allows predictive, data-driven business decisions. Market participants can now use quality algorithms to offset market fluctuations and assess important variations in bale quality due to issues such as seasonality. Being able to build a reliable supplier base and drive more informed and smarter purchasing decisions will positively impact a mill’s bottom line and reward suppliers who consistently provide high-quality products. Michael McSween is head of research and development and quality at merQbiz, a Los Angeles–based solutions and services provider for traders of recovered paper that’s a joint venture of Voith (Heidenheim, Germany) and Boston Consulting Group Digital Ventures (Boston). Bill Moore is president of Moore & Associates, an Atlanta-based paper recycling consulting firm. For more information about BaleVision, e-mail info@merqbiz.com; for more information about Moore & Associates, visit www.marecycle.com.

4 Security Shredding News Summer 2019

he i-SIGMA and Data Protection Association (DPA) Boards of Directors have voted to accept a proposal for the DPA to formally become a part of the larger organization. As a result, the mission of the DPA to represent the interests of tape backup and storage vendors will be embedded in the overall mission of i-SIGMA in representing all records and information management service providers. According to DPA President Michael Payton the decision to throw in with i-SIGMA came after observing the recent NAID/PRISM International merger. “Associations need strong infrastructure and horsepower to be effective,” said Payton. “Once we saw how both NAID and PRISM International benefited by combining their resources and expertise, we wanted those same benefits for our members.” As part of the roll-up, the i-SIGMA board has provided assurances to the DPA, all largely focused on ensuring data vaulting and tape backup would receive its share of attention and resource in the larger organization. Such reassurances included specified involvement in the PRISM International Leadership Committee, allocation of resource to education and advocacy, and development of programs dedicated to marketing and research. “We are both humbled and appreciative of the DPA’s decision,” said i-SIGMA Co-President Christopher Jones. “i-SIGMA is emerging as a collaborative community of secure records, media and information management service providers. It was the vision from the beginning, and it is heartening to see it coming to fruition.”

Proposed Bill Would Close HIPAA Gaps, Lower Health App Privacy Risks

proposed bipartisan bill introduced in the U.S. Senate would direct Health and Human Services to create regulations for health tech apps and direct-to-consumer genetic tests, to help ensure patient privacy, according to a statement released by Sen. Lisa Murkowski (R-AK). Sen. Murkowski, along with Sen. Amy Klobuchar (D-MN) wrote the legislation to reduce the privacy risks associated with data collected from health tracking devices and apps, as well as DNA testing kits. The new legislation would bring HIPAA rules into closer alignment with new technologies to make sure guidelines are created for security and privacy protections of modern health information. The Protecting Personal Health Data Act (S. 1842) addresses these health privacy concerns by requiring the Secretary of Health and Human Services to develop regulations for new health technologies such as health apps, wearable devices like Fitbits, and direct-to-consumer genetic testing kits that are not regulated by existing laws. The bill proposes appropriate standards for consent that account for differences in sensitivity between genetic data, biometric data, and general personal health data, and that complement existing regulations and guidance. It strengthens consumers’ ability to navigate their heath data privacy options, and to access, amend, and delete a copy of the personal health data that companies collect or use. In addition, the bill calls for creation of a National Task Force on Health Data Protection that would evaluate and provide input to address cybersecurity risks and privacy concerns associated with consumer products that handle personal health data, and the development of security standards for consumer devices, services, applications, and software. The Task Force also would study the long-term effectiveness of de-identification methodologies for genetic and biometric data and advise on the creation of resources to educate consumers about directto-consumer genetic testing.

Est. 1991

YOU BUY IT, WEâ€™LL HELP YOU FINANCE IT

WE PROVIDE A CONVENIENT AND COST-EFFECTIVE SOLUTION! Lease or Loan Financing Simple Application Process Low Initial Investment

Financing new or pre-owned equipment Serving the US & Canada Competitive Rate Structure

FINANCING THE WORLD OF TRANSPORTATION TERRY LEE

DOUG FERRANTE

Eastern States 303-301-7651 tlee@transleaseinc.com

Western States 509-389-1267 doug.ferrante@transleaseinc.com

WWW.TRANSLEASEINC.COM www.transleaseinc.com Security Shredding News Summer 2019

Security Shredding News

Allshred Services Acquires All Shred Document Solutions

aumee, Ohio-based Allshred Services, one of the nation’s largest independent providers of secure shredding services, recently announced its acquisition of All Shred Document Solutions. All Shred Document Solutions, with locations in Indianapolis, Indiana and Louisville, Kentucky, had been in the secure document shredding business for twenty years and had four mobile shredding trucks. The company was owned by Sheila and Curt Camp. Jarret Silagyi, COO of Allshred Services, says, “The decision to acquire All Shred Document Solutions was an easy one to make. All Shred’s customer base fits perfectly into our plan for growth in strategic markets – particularly in Indianapolis, Indiana and Louisville, Kentucky. Curt Camp, Vice President of All Shred Document Solutions, says, “Combining forces with Allshred Services was the smart thing to do. Allshred’s footprint and breadth of services will only improve the relationship we have with our customers.” Camp, who started All Shred Document Solutions in 1999, along with his wife, Sheila, will be staying on board as a Business Development Specialist. “I can now focus on what I love most about this industry – the customers.” This is Allshred Services’ fourth acquisition in the last decade. “We would like to continue to grow through strategic acquisitions,” Silagyi said, “As we expand within and beyond our existing seven-state (Michigan, Ohio, Pennsylvania, West Virginia, Kentucky, Virginia and Indiana) footprint.”

Humans Are the Weakest Link in Information Security

ccording to the latest data protection report compiled by information security service Shred-It, 53 percent of all C-suite executives and 28 percent of small business owners who have experienced a data breach say that human error or accidental loss by an external vendor/source was the cause. Deliberate sabotage by both employees and external partners accounted for significant number of breaches. Employee/insider was the cause of data breach for 21 percent of the executives and 28 percent of small business owners responding to the Shred-It survey, while 43 percent of executives and 31 percent of SBOs indicated an external vendor or source caused the breach. In addition to legal, financial and reputational damage, data breaches can affect employee retention, the report showed. A third of the US workforce say they would likely look for a new job if their employer suffered a breach of customer (31 percent) or employee (35 percent) data. What’s more, while nearly half of all consumers (47 percent) indicated they would wait to see how a business reacts to a data breach before they decided what to do, 23 percent indicated they would stop doing business with the company and 31 percent would tell others about the breach. The full report is available from the Shred-It site. https://www.shredit. com/en-us/data-protection/home

Advertise here and reach over 3,000 businesses involved in ...

Document & Product Destruction • Records & Media Storage • Medical / Pharmaceutical Waste Transporting For more information, contact Rick at 440-257-6453 or email rickdowning@oh.rr.com.

HIGH PERFORMANCE SHREDDERS

Let us design a shredding system to meet your specific needs. Solving problems and creating opportunities processing a wide range of materials is what we do best. Everything from e-waste, metals, tires, confidential documents, medical waste, plastics, wood and packaged products can be destroyed, size reduced and separated. Contact us today:

Research & Development Engineering Manufacturing Parts and Service

www.shred-tech.com

1.800.465.3214

6 Security Shredding News Summer 2019

Security Shredding News

Nearly 12 Million Patients Affected by Collections Agency Breach

uest Diagnostics and LabCorp revealed that they were among the entities whose customers’data was part of a larger cyber breach of American Medical Collection Agency (AMCA), according to Washington Post and BenefitPro.com articles. An estimated total of 11.9 million patients’ personal and medical information may have been exposed in the breach of the Elmsford, NY company. For eight months, an unauthorized user had access to personal information at AMCA including customer’s birth dates, Social Security Numbers, addresses, phone numbers, date of service, and health provider and balance information, credit card numbers and bank accounts. AMCA notified Quest and Optum360 – a Quest contractor – about the potential intrusion on May 14 and then reported on the scope of the breach. AMCA issued a statement that the Social Security numbers and insurance IDs remained unaffected since AMCA did not store this data for LabCorp. According to its website, AMCA was founded in 1977 and is a leading recovery agency for patient collections, managing over $1BN in annual receivables for a diverse client base.

Medical Informatics Engineering, Inc. Pays $100,000 to Settle HIPAA Breach

edical Informatics Engineering, Inc. (MIE) has paid $100,000 to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) and has agreed take corrective action to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules, according to an OCR statement. On July 23, 2015, the Indiana company, which provides software and electronic medical record services to healthcare providers, filed a breach report with OCR following discovery that hackers used a compromised user ID and password to access the electronic protected health information (ePHI) of approximately 3.5 million people. Medical Informatics Engineering Inc. (MIE) was sued by 16 states following the 2015 data breach of data that included sensitive medical and financial information such as Social Security numbers, lab results, medical conditions and health plan records. Eleven of MIE’s clients and 44 radiation centers were affected, along with nearly 200 provider clients of MIE subsidiary NoMoreClipboard (NMC), which markets personal health records to health care providers, to employers and directly to consumers. The company notified all affected individuals of the breach, but some employer and health care provider clients reached out to their employees and patients as well, in part to minimize confusion. In their lawsuit, the plaintiff alleges that MIE and NMC had violated HIPAA rules on privacy, security, and breach notification with regard to the electronic protected health information (e-PHI) they held. The HIPAA law had been amended in 2009 to enable state attorneys general to enforce HIPAA on behalf of state residents, and to make HIPAA-covered entities’ “business associates” directly liable for many types of HIPAA violations. All 16 states also alleged violations of their respective state laws on deceptive trade practices, and 12 of the states alleged violations of their data breach laws. Eight of the states also alleged violations of their laws on protecting personal information. OCR’s investigation revealed that MIE did not conduct a comprehensive risk analysis prior to the breach. The HIPAA Rules require entities to perform an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of an entity’s electronic protected health information.

www.keithwalkingfloor.com

Security Shredding News Summer 2019

Security Shredding News

Hospitality Leaders Say Hacking Hype Causes Unnecessary Fear

hile the overwhelming majority (93 percent) of hotel owners feel like they need to do more to show employees and consumers how they are protecting personal information, many feel that data breaches are blown out of proportion, according to the latest annual data protection report compiled by information security service Shred-It. Businesses in the hospitality sector affected by data breaches included the Starwood reservation system, Hyatt Hotels Corp., InterContinental Hotels Group, Hilton and the Pyramid Hotel Group, which includes among its 90 properties several Marriott, Sheraton and Hilton locations. Just over one third (36 percent) of hospitality business leaders responding to the Shred-It survey indicated that breaches are “no big deal” and are “blown out of proportion.” Additional findings show that: • 17 percent of hospitality industry respondents said they have a policy for storing and disposing of confidential information, but not all employees are aware of it • 19 percent of hotel business leaders indicated their organization has no policy for disposing of paper documents, and 31 percent said their business has no policy for disposing of information on end-of-life electronic devices The hospitality survey included 100 C-suite executives, 1,000 small business owners and 2,000 members of the general public across the U.S. Eight percent of the 1,100 C-suite and small business owners were in the hospitality industry. The research uncovered that the priority for hotel owners is improving staff training. With the amount of personal and confidential information that guests travel with (i.e. passports, boarding passes etc.), hotels need to ensure that proper employee training is being done in order to mitigate potential information security risks and ensure that guests feel safe and secure during their stay, the report authors emphasized.

DocuVault Announces New Alliance with Guardian Document Destruction Company to Expand Records Management Services in Northeast

ocuVault, one of the nation’s fastest growing document storage, shredding services and records management businesses, recently announced a new alliance with Guardian Document Destruction Company, a veteran-owned secure mobile paper shredding and document destruction company based in Mt. Holly, NJ. “We’re very pleased to bring secure, expert document storage and record retention offerings to our valued clients,” said Herb Webb, Owner of Guardian Document Destruction Company. “Keith and his team understand our approach to business and share our commitment to providing outstanding customer service to our dedicated customers, which is what makes this partnership the right next step for Guardian.” “Herb and his brother Harold are very respected in the shredding services industry and have built a successful, clientfocused business,” said Keith DiMarino, CEO of DocuVault. “Through this new alliance, DocuVault will deliver costeffective, secure, and efficient document storage services to more businesses throughout New Jersey.”

Advertise in all 4 issues of Security Shredding News and $AVE !! For more information, contact Rick Downing at 440-257-6453 or email rickdowning@oh.rr.com.

We’re in Your Corner There’s more to NAID than its widelyrecognized data destruction operational certification. Revenue from annual dues, its successful conference, and global certification program are used to:

We are Member-Owned & Member-Accountable. Association Dollars are Controlled and Spent to Benefit Members & the Industry.

• Engage in Regulatory Advocacy for Laws that Promote and Protect Secure Data Destruction Services

• Conduct Research to Help Members and

Join NAID today! Let us fight for you too!

• Educate Organizations on the

www.naidonline.org

Customers Make Better Decisions

Importance of Using a Service Provider

8 Security Shredding News Summer 2019

Security Shredding News

Google, UChicago Medicine Sued for Alleged Patient Privacy Violation

hicago, IL – A class-action lawsuit brought by a former patient accuses the University of Chicago Medical Center (UChicago Medicine) and Google of sharing thousands of patient records without removing personal identifiers, according to a New York Times report covered on ChicagoMaroon.com. The patient bringing the suit, Matt Dinerstein, was admitted to UChicago Medicine in 2015. He claims the health center did not notify patients or obtain consent before sharing patient data with Google to jointly develop new healthcare technology, a violation of patient privacy under HIPAA rules. The suit also charges that the University breached contracts between UChicago and its patients by allegedly falsely claiming to patients that it would be protecting their medical records and charges UChicago for violating an Illinois law dictating that companies cannot engage in deceptive practices with clients. Personal identifiers such as provider notes and date stamps remained in the records, according to the suit. Google and UChicago have stated the shared research data was deidentified, but Dinerstein argued that Google could identify patients from the data shared by UChicago Medicine by combining it with other information Google gathers from its other arms, such as location data from Google Maps. “As a leading research institution, the Medical Center also pursues research partnerships to advance healthcare, improve patient outcomes and find cures for diseases,” a UChicago spokesperson said in a statement.

www.bomaccarts.com sales@bomaccarts.com

NAID Publishes Second-hand Device Study Principles

s a watchdog for proper data disposition and having conducted second-hand electronic device studies, the National Association for Information Destruction (NAID) has used its experience to create study guidelines others can now leverage for their second-hand device studies to ensure they are executed in a manner that upholds credibility to the study. It’s been twenty years since Dr. Simpson Garfunkel conducted the first study analyzing the extent to which personal information remained on second-hand hard drives. In the intervening decade, the study has been replicated many times by other universities and data recovery services. NAID itself has commissioned such studies twice; one several years ago in Australia and another almost two years ago in North America. The second NAID study was the largest ever conducted and incorporated solid state memory devices, including mobile phones. Invariably such studies have resulted in the discovery of personal information on second-hand electronic devices. Among the challenges faced by NAID and others in such investigations is credibility. It is no secret that the results of such studies have favored those having commissioned them. And, it is precisely because some could have a vested interest in the outcome that steps must be taken to assure the results are legitimate. “From the beginning, NAID publicized the methodology employed to ensure an uncompromised study,” said NAID founder Bob Johnson. “Though this process adds a layer of complexity and expense, it was absolutely necessary.” “Now that it is apparent such studies will be with us for a long time to come,” Johnson adds, “the i-SIGMA board of directors has decided to formally publish a set of principles by which NAID and others can establish the credibility of their processes and, therefore, their findings.” The principles will be freely available as a guide to those wishing to demonstrate they are conducting a fair and unbiased study.

BRINGING THE INDUSTRY TOGETHER

Networking • Paper & Plastics Recycling Conference • ISRI Convention • Market Summits

Get involved: join the PSI today. www.paperstockindustries.org PSI@isri.org PaperStockIndustries.org | Email: PSI@isri.org

Security Shredding News Summer 2019

Security Shredding News

Innovative Technique Opens the Door for Office-Based Paper Recycling

ew Brunswick, NJ – Rutgers University chemical engineers have developed a way to erase toner from coated paper so that consumers can use of the same paper up to five times, according to study findings published in the Journal of Cleaner Production. The “unprinting” technique uses Intense Pulsed Light (IPL) from a xenon lamp to weaken the bonds between toner and paper coating, removing the toner. The researchers tested the process starting with UV–Visible spectrophotometry, Scanning Electron Micrography and Fourier-Transform Infrared Spectroscopy analysis to characterize the paper type. Then, they overprinted with black toner and exposed the paper to the IPL. Afterward, they dabbed gently with an ethanol wipe. The process works for removal of black, green and red toner, they say. The Rutgers engineers are working to integrate unprinting with typical office and home printers. They say the method would reduce energy costs, pollution and greenhouse gas emissions that accompany large-scale paper recycling operations. Their next plan is to refine the method by testing additional toner colors on a wider range of paper types.

Iron Mountain Acquires InfoZafe, Bolstering Presence in Thailand

angkok – Iron Mountain Incorporated (IRM)®, recently announced the acquisition of InfoZafe in Bangkok, expanding the company’s presence and capacity for service delivery. The acquisition of InfoZafe gives Iron Mountain an additional facility in Bangkok, bringing the total number of facilities to five and total cubic feet of storage to four million, adding more than 210 customers, and 19 employees to Iron Mountain’s existing business. “Expanding our footprint and adding the services of InfoZafe’s storage and information management services are important steps forward for our Thai business,” said Peter Hwang, managing director, Iron Mountain Asia. “Acquiring InfoZafe’s level of operational and storage capacity and customer relationships, along with a talented team, allows us to strengthen our presence and serve both new and existing customers on a regional, national and international basis. We look forward to maintaining the high levels of service that InfoZafe’s customers expect for their information management needs.” InfoZafe is a comprehensive provider of document storage and information destruction to leading public and private organizations in Thailand. Their services include secure storage, shredding and degaussing/erasure of electronic media and devices.

PSI Supports Study on Fires in MRFs, Scrap Plants

ashington, DC – The Paper Stock Industries Chapter, a national chapter of the Institute of Scrap Recycling Industries, Inc., is working with the Environmental Research & Education Foundation on a study about fires at MRFs and scrap recycling facilities as well as in collection vehicles. PSI is a premier sponsor of the project, which has an overall cost of $34,000, and various PSI members may be selected to participate in the study at the researchers’ discretion. The study will compile information on the frequency of MRF and scrap recycling fires annually (as a percentage of the total number of facilities), the frequency of collection vehicle fires, the suspected cause(s) of the fires, strategies/technologies used to fight the fires, damage caused by the fires (including property damage, personnel injury/death, or lost operating revenue), preventive measures taken to minimize the potential for fires, and the likelihood of lithium-ion batteries to be discarded at MRFs or scrapyards and their potential to cause fires. To compile the above information, the researchers will review existing data sources, including but not limited to the U.S. Fire Administration, scientific/technical publications or data sets, and news reports on fire incidents. The researchers also will develop and conduct a fire survey in each of the three subcategories—MRFs, scrapyards, and collection vehicles-to assess the frequency of fires within the past one to three years, their suspected cause(s), strategies used to fight the fires, and damage caused by the fires. The part of the study on lithium-ion batteries will assess their possible contribution to fires in recycling facilities and collection vehicles, including evaluating the disposal- and/or recycling-related labeling on such batteries and the policy and safety concerns of transporting such batteries. The project timeline is 10 to 14 months, once fully initiated, with summer 2020 as the preliminary target date for a final report.

10 Security Shredding News Summer 2019

New HHS Fact Sheet on Direct Liability of Business Associates under HIPAA

he Office of Civil Rights (OCR) recently issued a new fact sheet that provides a clear compilation of all provisions through which a business associate can be held directly liable for compliance with certain requirements of the HIPAA Privacy, Security, Breach Notification, and Enforcement Rules (“HIPAA Rules”), in accordance with the Health Information Technology for Economic and Clinical Health (HITECH) Act of 2009. In 2013, under the authority granted by the HITECH Act, OCR issued a final rule that, among other things, identified provisions of the HIPAA Rules that apply directly to business associates and for which business associates are directly liable. OCR has authority to take enforcement action against business associates only for those requirements and prohibitions of the HIPAA Rules that appear on the following list. 1. Failure to provide the Secretary with records and compliance reports; cooperate with complaint investigations and compliance reviews; and permit access by the Secretary to information, including protected health information (PHI), pertinent to determining compliance. 2. Taking any retaliatory action against any individual or other person for filing a HIPAA complaint, participating in an investigation or other enforcement process, or opposing an act or practice that is unlawful under the HIPAA Rules. 3. Failure to comply with the requirements of the Security Rule. 4. Failure to provide breach notification to a covered entity or another business associate. 5. Impermissible uses and disclosures of PHI. 6. Failure to disclose a copy of electronic PHI to either the covered entity, the individual, or the individual’s designee (whichever is specified in the business associate agreement) to satisfy a covered entity’s obligations regarding the form and format, and the time and manner of access under 45 C.F.R. §§ 164.524(c)(2)(ii) and 3(ii), respectively. 7. Failure to make reasonable efforts to limit PHI to the minimum necessary to accomplish the intended purpose of the use, disclosure, or request. 8. Failure, in certain circumstances, to provide an accounting of disclosures. 9. Failure to enter into business associate agreements with subcontractors that create or receive PHI on their behalf, and failure to comply with the implementation specifications for such agreements. 10. Failure to take reasonable steps to address a material breach or violation of the subcontractor’s business associate agreement. The new fact sheet may be found at https://www.hhs. gov/hipaa/for-professionals/privacy/guidance/businessassociates/index.html along with OCR’s guidance on business associates.

Join July 1 to September 30, 2019. Get a special 6 month membership

Join ISRI today and take advantage of the many benefits membership provides: ISRI Membership Directory & Industry Guide • Safety Outreach and Resources • Market Data and Insights Regulatory Compliance Assistance • Networking and Education • Business Insurance • Scrap Magazine

Try Us Out!

ISRI Half-Year Membership Invest in your business and expand your contacts

Join Today www.ISRI.org/Join ISRI.org/Join

Security Shredding News Summer 2019 11

PRSRT STD U.S. Postage

PAID

Cleveland, OH Permit #1737

6075 Hopkins Rd • Mentor, OH 44060 • Ph: 440-257-6453 • Fx: 440-257-6459 • Email: downassoc2@oh.rr.com

Inside This Issue

VOL. 16 NO. 2

sUMMER 2019

A Look Inside The Bale PAGE 1 Proposed Bill Would Close HIPAA Gaps, Lower Health App Privacy Risks PAGE 4 Humans Are the Weakest Link in Information Security PAGE 6 Hospitality Leaders Say Hacking Hype Causes Unnecessary Fear PAGE 8 New HHS Fact Sheet on Direct Liability of 2019 Business Associates under HIPAA Security Shreddiong PAGE 10 & Storage News

Combo Half Horizontal - 8-3/8” x 5-1/8”

INDUSTRIAL PAPER SHREDDERS MOBILE SHREDDING SYSTEMS CDL • NON-CDL • PIERCE-&-TEAR • SINGLE-SHAFT

(336) 285-0021 • 5708 UwHARRIE ROAD, ARCHDALE, NC 27263 • www.vECOPLANLLC.COM