Ssn winter '16 final

Volume 13, Issue 4

y

winter

bu 201 ye 6r 2 iss s’ g 017 ue uid e

g

Visit us online at www.SecurityShreddingNews.com

ATTENTION: READERS !

Are you looking for Products, Equipment or Services for your business? If so, please check out these leading companies advertised in this issue: Equipment Financing TransLease Inc – pg 16 Lock & Locking Systems Lock America Intl. – pg 3 Mobile Truck Shredders Alpine Shredders Ltd – pg 12 Shred-Tech Limited – pg 13 Vecoplan LLC – pg 11 Moving Floor System Keith Manufacturing – pg 2 Stationary Shredders & Grinders Shred-Tech Limited – pg 13 Vecoplan LLC – pg 11 WEIMA America – pg 5

Trade Associations NAID (National Association of Information Destruction) – pg 4 RIOS™ (Certified Electronics Recycler) – pg 15

Security Shredding Year End Wrap

V

By Ken McEntee

PRSRT STD U.S. Postage

PAID

Mentor, OH Permit No. 2

endors serving the security shredding business reported strong business in 2016 with expectations for the trend to continue in 2017.

Guy Wakutz, sales manager at Alpine Shredders Ltd., Kitchener, Ont., said his company sold more shredder trucks in 2016 than ever before and, as of mid-December had new orders backlogged 10 weeks out – carrying deliveries into March.

“From the perspective of a shred truck manufacturer, it’s been an outstanding year for the shredding business,” Wakutz said. “We’re confident that business will remain strong in 2017. When we talk to our customers we hear a lot of optimism. Everybody is reporting strong business.”

Terry Lee, business development manager for Trans Lease Inc., of Denver, which leases and finances shredder trucks and other specialty vehicles, said 2016 brought an increase in shredding companies expanding their fleets and replacing older vehicles.

“In a recessionary time, businesses tend to hold off on replacing their trucks,” Lee said.

“When business comes back, all of a sudden you have an explosion in demand, and we’re seeing some of that exploding demand right now. It’s a very good sign and we’re confident that it is going to continue through the next year.”

Delmont, Pa.-based Allegheny Paper Shredders, which will celebrate it’s 50 th anniversary in business in 2017, had one of its best sales years in the company’s history this year, said Evelyn Jefferson, Allegheny’s vice president of sales. Jefferson said the company’s strongest growth during the year was driven by the need to destroy hard drives and other digital data devices.

“Our core competency business for many years was paper shredding, and while we are still selling a lot of paper shredders, it is the

Continued on page 3

Inside This Issue 4 Trump Administration Could Support Progressive Cyber Security Policy

5 FTC Issues Guidance on Protected Health Information Authorizations

11 UMass Settles Potential HIPAA Violations Following Malware Infection

12 European Paper Recycling Hits New High 14 OCR is Serious About Health Data

Security: More C-Level Engagement Needed

www.youtube.com/user/KeithMfgCo

www.keithwalkingfloor.com

2 Security Shredding News Winter 2016-2017

Security Shredding News

Security Shredding Year End Wrap Continued from page 1

PUBLICATION STAFF Publisher / Editor Rick Downing

Contributing Editors / Writers Ken McEntee Sandy Woodthorpe

Production / Layout Barb Fontanelle Christine Pavelka

Advertising Sales Rick Downing

Subscription / Circulation Donna Downing Editorial, Circulation & Advertising Office 6075 Hopkins Road Mentor, OH 44060 Ph: 440-257-6453 Fax: 440-257-6459 Email: downassoc2@oh.rr.com www.securityshreddingnews.com

For subscription information, please call 440-257-6453 Security Shredding News (ISSN #1549-8654) is published bimonthly b y D o w n i n g & A s s o c i a t e s.

Reproductions or transmission of Security Shredding News, in whole or in part, without written permission of the publisher is prohibited.

Annual subscription rate U.S. is $19.95. Outside of the U.S. add $10.00 ($29.95). Contact our main office, or mail-in the subscription form with payment. ©Copyright 2016 by Downing & Associates.

Printed on Post-Consumer Recycled Paper

digital world – the hard drives – that are driving our business growth today,” she said. “Every single device you have, whether it is your cell phone, your copy machine or your printer, has memory and there is so much information stored on those devices. You need to be able to destroy that data, and we manufacture a variety of equipment that shreds solid state drives and hard drives down to two millimeters.”

Document destruction in demand

A

lthough Jefferson said Allegheny’s growth has been driven by hard drive shredders, Wakutz and Lee said the document destruction business remains strong, with room left in the market for additional growth.

“What we’re seeing is that paper shredders and record storage companies are asking about adding hard drive shredders onto their shred trucks as an additional revenue source,” Wakutz said. “But the hard drive shredders account for only about 5 percent of our growth. The other 95 percent is still paper. You’re not going to find a lot of accounts that have 5,000 to 10,000 hard drives to shred. Typically they are going to have 40 or 50, and that’s only once or twice a year, so picking up accounts with a steady stream of hard drives to shred isn’t going to be easy to do. Paper, on the other hand, is an ongoing monthly service.”

Wakutz believes that the document destruction market has yet to be fully saturated.

“The market is maybe 7o percent covered and there is maybe 30 percent out there who still are not shredding their paper,” he said. “A lot of people we talk to are adding their third or fourth trucks to increase their routes. Some people are noticing that if they are willing to drive a little out of town it can be lucrative. Servicing rural areas takes away some of the challenges of working in the big city where you can’t find a place to park without getting a ticket.

Rural routes might increase your profit margins compared to the big city where you get beaten down on price.”

Robert Johnson, CEO of the National Association for Information Destruction (NAID), said the number of companies involved in data destruction is decreasing, but the overall volume of business is growing.

“Ten years ago there were new companies starting up every day,” he said. “That isn’t the case any more, but the amount of paper being shredded continues to steadily grow. That’s a very healthy scenario. The number of vendors has plateaued because customers are better able to tell the good vendors from the bad vendors. The bad ones are going out of the market.”

Lee also reported increased interest in mobile document destruction companies adding hard drive shredders to their trucks.

“We’re seeing more interest in hard drives,” he said. “In some cases people are asking about trucks that can do both paper and hard drives, and others want to run separate trucks with the capability of destroying the hard drives on site. We’ve been financing more and more of the trucks with dual capability.”

Jefferson said paper documents will never go away, but there is likely to be less of them in the future.

“I will never see a paperless office in my lifetime, that’s for sure,” she said. “For a very long time there will still be plenty of paper to shred. But a lot of old archives have already been destroyed over the years while companies are increasing storing records digitally.”

Giants driving the market

G

rowth in sales in the data destruction business is being driven by large corporations and government offices, Jefferson said.

“Smaller companies tend to use destruction companies, where the larger companies are doing their shredding in house,” she said. “It is a pendulum that swings back and forth. In the 1980s every insurance company and hospital wanted to do their own shredding in-house. In 1990s, more of them started to use document destruction vendors with mobile trucks. Now its swinging back to where the big companies are bringing it back in-house, and they are buying their own shredders, not only for paper but for hard drives as well.”

Creating trust

P

art of the reason for that may be a hesitance to turn sensitive data over to an outside vendor.

Continued on page 4

Now Even More Options for Customers Who Want Their Own Key Codes!

Lock America Adds More New Key Codes for Padlocks and Console Locks.

• Give your drivers and customers a single key that fits all the locks at a site.

• Ask your console or bin supplier for new available key codes, or contact Lock America directly.

One Key Can Now Operate All Your Locks!

Tel: (951) 277-5180 Fax: (951) 277-5170 www.laigroup.com

800-422-2866

9168 Stellar Court Corona, CA 92883 sales@laigroup.com

Security Shredding News Winter 2016-2017

3

In the News

Security Shredding Year End Wrap

Continued from page 3

Johnson said vendors who create trust and credibility among their customers will continue to be successful.

“This is a very good time for companies who are prepared to meet the increasing scrutiny of the marketplace,” Johnson said. “Customers are concerned both with data protection risks as well as the high profile that data and privacy protection is getting in the media. Ten years ago, if a box of records was found in your dumpster, nobody would have said anything. Today, it’s a headline in the newspaper because there is so much attention being paid to data theft. The public is outraged at any compromise of their privacy in today’s world. So companies are giving tighter and tighter scrutiny to the qualification of their service providers. For those companies that are prepared to meet that increasing data security scrutiny, 2017 is going to be another very good year.”

Although most new medical records are stored electronically, Johnson said 40 percent of all HIPPA security breach notifications stem from paper copies.

“Sometimes the breach is related to dumpster diving, but not always,” Johnson said. “It’s usually a case of lost or misplaced records.”

As the CEO of NAID, Johnson said most of the questions he gets from members concern ways that they can improve their service and value to their customers.

“In the first quarter of 2017, NAID is going to publish the first ever textbook on information disposition,” he said. “Many people don’t realize that you can graduate from a university with a degree in data security or a degree in data security or cyber security and never be taught anything about information disposition. People come out of college and they don’t know the difference between overwriting and degaussing a hard drive. They don’t know anything about HIPPA or writing a contract with a disposal company. This is a 400page, university-quality textbook made to educate people about information disposition. In today’s world, the data destruction companies that are able to meet the scrutiny of customers are in a position to do very well.”

Trump Administration Could Support Progressive Cyber Security Policy

A

rlington, VA – The Internet Security Alliance (ISA), an Arlington VAbased nonprofit which lobbies for corporate security interests, is hoping for a “very progressive” cyber security policy to emerge out of the Trump administration, reports ComputerWeekdly.com.

According to Larry Clinton, president and CEO of the ISA, President-elect Donald Trump has indicated that his administration wants to make great strides in Internet security by focusing on stronger laws and criminal penalties and infrastructure protection, particularly for military uses of the Internet.

Clinton advocates making compliance easier for business. For instance, streamlining multiple layers of government can lift some of the burdens on businesses, while also improving efficiencies at all levels of regulatory structures, he believes.

Specifically, this could mean eliminating redundant and inconsistent regulations, the lobbyist indicated in an interview with Computer Weekly.

The ISA briefed the Republican National Committee on cyber policy at its convention in July 2016, providing pre-publication editions of its book entitled, “Cyber Security Social Contract,” which analyzes cyber security needs on a sector by sector basis.

Clinton’s professional Linked-In profile summary describes the “Cyber Security Social Contract,” as “the first, and most often cited, reference in President Obama’s major policy paper on cyber security, and was also endorsed by the House GOP Task Force Report on Cyber Security. In 2013 President Obama issued an Executive Order on Cyber Security that reversed his previous, pro-regulatory policy, and instead adopted the principles of ISA’s market incentive based social contract model.”

Clinton expects the new administration to make cyber security a priority review item when Trump takes office. This may include replacing bureaucratic inefficiencies with streamlined operations and introducing cost cutting measures through incentivized solutions, via legislation or executive order.

Meanwhile, a Forrester report released this fall predicts the Trump administration will be the target of cyber attacks from both inside and outside the U.S., including increased leaks and other embarrassments, in addition to breaches by foreign countries.

www.naidconf.org

Taya Kyle

Keynote Speaker Wife of the late Chris Kyle of American Sniper fame.

Kirk Nahra, Esq. Renown HIPAA Compliance Attorney PRESENTS:

Annual Conference & Expo

Tropicana Las Vegas Conference Center

March 22-24, 2017

What HHS Audits Mean for Secure Destruction Services

Dawn Connelly, Esq. Industry Veteran, Leadership Coach PRESENTS:

Register before Dec. 31 for the best rate.

Conference room rate $99 per night.

4 Security Shredding News Winter 2016-2017

The Secret to Explosive Growth in Your Business

In the News FTC Issues Guidance on Protected Health Information Authorizations

W

ashington, D.C. – The Federal Trade Commission (FTC) has issued guidance to HIPAA-covered entities and their business associates on the requirements for protecting privacy and security of health information. Factors driving this guidance include increased use of mobile and portable computing devices, the rising number of security breaches and the proliferation of ways in which data can be shared.

The FTC is specifically targeting authorizations that healthcare consumers must sign before any of their protected health information (PHI) is shared or disclosed. In addition to HIPAA, the authorizations are covered by the FTC Act. The law extends to business associates who contract with covered entities and handle health information.

For business associates, there’s a crucial first step: the covered entity must grant explicit permission through a HIPAA business associate contract to use or disclose health information. This means you cannot ask a consumer to sign a HIPAA authorization if your business associate contract does not expressly permit you to do so.

The FTC Act

T

he FTC Act prohibits companies from engaging in deceptive or unfair acts or practices in or affecting commerce. Among other things, this means that companies must not mislead consumers about what is happening with their health information.

All statements to consumers must avoid creating a deceptive or misleading impression. Even if you believe your authorization meets all the elements required by the HIPAA Privacy Rule, if the information surrounding the authorization is deceptive or misleading, that’s a violation of the FTC Act. To make sure disclosures set forth in authorization documents is clear, the FTC guidance provides these pointers:

•

If people can’t understand it, then it isn’t effective. Think about who, what, when, where and why. Explain who is disclosing and receiving the information, what they are receiving, when the disclosure permission expires, where information is being shared, and why you are sharing it.

•

The authorization must include specific terms and descriptions.

For example, if you want consumers to authorize you to share their health information, you need to tell them specifically how it will be used – for example, by a pharmaceutical company for marketing purposes, a life insurer for coverage purposes, or an employer for screening purposes.

•

Review your entire user interface. Don’t bury key facts in links to a privacy policy, terms of use, or the HIPAA authorization. For example, if you’re claiming that a consumer is providing health information only to her doctor; don’t require her to click on a “patient authorization” link to learn that it is also going to be viewable by the public. And don’t promise to keep information confidential in large, boldface type, but then ask the consumer in a much less prominent manner to sign an authorization that says you will share it. Evaluate the size, color and graphics of all of your disclosure statements to ensure they are clear and conspicuous.

•

Take into account the various devices consumers may use to view your disclosure claims. If you are sharing consumer health information in unexpected ways, design your interface so that “scrolling” is not necessary to find that out. For example, you can’t promise not to share information prominently on a webpage, only to require consumers to scroll down through several lines of a HIPAA authorization to get the full scoop.

•

Tell consumers the full story before asking them to make a material decision – for example, before they decide to send or post information that may be shared publicly. Review your user interface for contradictions and get rid of them.

•

The same requirements apply to paper disclosure statements. Don’t give consumers a stack of papers where the top page says that their health information is going to their doctor, but another page requests permission to share that health information with a pharmaceutical firm.

SUSTAINABLE SOLUTIONS Choose the Experts.

SHREDDING AND BRIQUETTING TECHNOLOGY BY WEIMA. 888-440-7170



WEIMAAMERICA.COM www.weimaamerica.com



I N Finfo@weimaamerica.com O@WEIMAAMERICA.COM

ken@recycle.cc

www.recycle.cc Security Shredding News Winter 2016-2017

5

w o N ter

is g e R

30

th

Anniversary It may be a pain to get to, but once you are there you feel like you are at home!

30th Southeast Recycling Conference & Trade Show Conference: March 12-15, 2017 Trade Show: March 12-14, 2017 Venue:

Hilton San Destin Beach Golf Resort & Spa in Destin, Florida

Conference Features: 500-600 Recycling Industry Leaders 60+ Exhibitors Educational Sessions Business Networking Events If you are interested in Sponsoring or Exhibiting, please contact Nicki Mayfield at 850-558-0609 or by email at nicki@eicmllc.com

Website: www.SoutheastRecycling.com

6 Security Shredding News Winter 2016-2017

Security Shredding News

2016-2017 Buyers’ Guide Directory category listings

Baler Manufacturers

Advanced Equipment Sales Ameri-Shred Corp American Baler Co BACE Balemaster USA Harris International Baler Corp IPS Balers Mfg Maren Engineering Corp Waste Processing

Equipment, Inc

Baling Wire & Strapping Systems

Advanced Equipment Sales Cavert Wire Co, Inc Eastern Wire Products Wire Industries LLC

Business Consultants, Employment Services & Drug Screening K-2 Partners, LLC Lane-Link Group, Inc Shotgun Capital Advisors LLC

Conveyors & Moving Floor Systems

Advanced Equipment Sales Ameri-Shred Corp The C.S. Bell Co Cresswood Shredding Machinery HALLCO Industries, Inc Harris KEITH Mfg Co

Document & Product Destruction Services

Insurance Providers

Document Storage Containers / Collection Carts

Leasing Companies

AMS Store and Shred LLC

Big Dog Shred Bins USA Bomac Carts Jake, Connor & Crew Inc MOD-Meese Orbitron Dunne Co Schaefer Systems Intl

Dust Control Systems

Advanced Equipment Sales Ameri-Shred Corp Nordfab Ducting Ohio Blow Pipe

Electronics Recyclers

AMS Store and Shred LLC BCS Clover Environmental Solutions Dan-Mar Components Ex-It Technologies ZRG Inc

Fire Protection Systems, Vaults & Fire Prevention Services Advanced Equipment Sales Critical Systems Fire Protection Intl

Consortium Firelock Fireproof

Modular Vaults FLAMEX, Inc

Downstream Data Coverage EMPLOYERS

Intek Truck & Equipment Leasing Trans Lease, Inc

Marketing, Advertising, Website Development & Online Services Artwork Advertising & Design Chachka Group NetGain

Merger & Acquisition Firms

K-2 Partners, LLC Lane-Link Group, Inc Shotgun Capital

Advisors LLC Waterfront Capital, Inc

Rack Storage Systems

DACS, Inc Elite Storage Solutions Interlake Mecalux

Repair Services (Balers & Shredders)

Shred Truck Manufacturers & Dealers

Advanced Equipment Sales CMB Commercial

Shredder Repair, LLC Dun-Rite Tooling Pacific Coast Shredder Repair Co Shred Supply

Alpine Shredders Ltd Ameri-Shred Corp AXO Shredders Shred-Tech Shredfast, Inc ShredSupply UltraShred LLC Vecoplan LLC

Routing, Billing & Inventory Software

DHS Worldwide Software Solutions DocuData Software eRouteIt EZshred Software Systems RouteOptix Inc

Security Locks & Alarm Systems

Babaco Alarm Systems Lock America

International The Wilson Bohannan Lock Co

Security, Safety, Loss Prevention & Risk Management Specialists

Baker Security Group, LLC

Shredder Manufacturers (Plant-based)

Advanced Equipment Sales Allegheny Shredders Ameri-Shred Corp American Pulverizer Co Cresswood Shredding Machinery Cumberland Recycling Jordan Reduction

Solutions Schutte-Buffalo Hammer Mill, LLC Security Engineered Machinery Co Shred-Tech UNTHA America Vecoplan LLC WEIMA America, Inc

Shredder Wear Parts

Dun-Rite Tooling ShredSupply Tryco Manufacturing Co

X-ray Film Recycling & Processing

AMS Store and Shred LLC Commodity Resource & Environmental Inc Pyromet Security Shredding News Winter 2016-2017

7

2016-2017 Buyers’ Guide A

Advanced Equipment Sales Souderton, PA (215) 723-7200 www.advancedequipmentsales.com

Allegheny Shredders

Delmont, PA (800) 245-2497, (724) 468-4300 www.alleghenyshredders.com

COMPANY INDEX

Artwork Advertising & Design Jesup, GA (912) 427-0589 www.artworks-ads.com

AXO Shredders Philadelphia, PA 484-953-3580 www.axo.cc

B

C

D

Tiffin, OH (888) 958-6381 www.csbellco.com

Portsmouth, VA (757) 393-0704 www.dacsinc.com

The C.S. Bell Co

Cavert Wire Company, Inc Rural Hall, NC (800) 969-2601 www.cavertwire.com

BACE

Charlotte, NC (877) 506-2223 www.bacecorp.com

Balemaster USA Alpine Shredders Limited

30 Alpine Ct Kitchener, ON N2E 2M7 Canada (866) 246-5634 Guy Wakutz, Sales GWakutz@AlpineShredders.com www.AlpineShredders.com Alpine Shredders has engineered Mobile Shredding Equipment that is simple to maintain – with fewer moving parts than competitive equipment. Our low-RPM, hightorque shredder assembly increases the life of all hydraulics, pumps, gearboxes and shredder shafts. High tip force and aggressive hook profile ensures superior throughput even on the toughest dense paper. The end result is a shred truck that requires low maintenance and is ENGINEERED TO LAST. See ad on pg 12

Ameri-Shred Corp Alpena, MI (800) 634-8981 www.ameri-shred.com

American Baler Co Bellevue, OH

(800) 843-7512 www.americanbaler.com

American Pulverzier Co St. Louis, MO (314) 781-6100 www.ampulverizer.com

AMS Store and Shred LLC 13 Prosper Court Lake in the Hills, IL 60156 (800) 262-2344 Denise Hammer ams@amsstoreandshred.com www.amsstoreandshred.com

Crown Point, IN (219) 663-4525 www.balemaster.com

Chachka Group

459 NW Adler St Madras, OR 97741 (541) 475-7286 chachka@chachkagroup.com www.chachkagroup.com Chachka is a unique collection of artists, writers, designers, photographers and programmers who transform everyday advertising into something special.

S o m e t i m e s a m u s i n g. S o m e t i m e s thoughtful. Always effective.

See ad on pg 13

Clover Environmental Solutions Baker Security Group, LLC

PO Box 10279 State College, PA 16805 (814) 321-3102 Brian Baker brianbakercpp@comcast.net www.bakersecuritygroup.com B a ke r S e c ur i t y G ro u p, LLC, i s a n independent security management consultancy and Pennsylvania licensed professional investigation firm. We help our clients to solve problems and prevent future problems through careful assessment and individualized solutions.

Our services focus on the prevention of loss and the reduction of risk through the use of the best practices in the security industry.

BCS

Canoga Park, CA (888) 286-7188 www.scrapdr.com

Big Dog Shred Bins USA Lakeside, CA (855) 792.4050 www.bigdogshredbins.com

Bomac Carts

Darien, WI (262) 882-5000 www.bomaccarts.com

8 Security Shredding News Winter 2016-2017

Dan-Mar Components Deer Park, NY (631) 242-8877 www.dan-mar.com

DHS Worldwide Software Solutions

Babaco Alarm Systems Moonachie, NJ (800) 283-2222 www.babaco.com

DACS, Inc

Hoffman Estates, IL (815) 431-8100 www.clovertech.com

CMB Commercial Shredder Repair, LLC

Fuquay-Varina, NC (919) 577-6714 www.cmbcommercialshredderrepair.com

Commodity Resource & Environmental Inc (CRE) Burbank, CA (818) 843-2811 www.creweb.com

Cresswood Shredding Machinery Cortland, IL (800) 962-7302 www.cresswood.com

Critical Systems

Louisville, KY (502) 231-2402 www.critical-systems.net

Cumberland Recycling New Berlin, WI (262) 641-8600 www.cumberland-plastics.com

Orange Park, FL (800) 377-8406 www.dhsworldwide.com

Downstream Data Coverage

877-710-2498 Downstream@naidonline.org www.downstreamdata.com Downstream Data Coverage is professional liability insurance, developed exclusively for NAID members to address many of the shortcomings of standard professional liability coverage that leave service providers and their customers at risk.

DocuData Software Montreal, QC Canada (866) 789-2789 www.docudatasoft.com

Dun-Rite Tooling

Cortland, IL (800) 209-3145 www.dun-ritetooling.com

E

Eastern Wire Products Jacksonville, FL (800) 351-8138 www.eastern-wire.com

Elite Storage Solutions Irvine, CA (949) 757-1377 www.elitestoragesolutions.com

EMPLOYERS

Reno, NV (888) 682-6671 www.employers.com

Buyers’ Guide 2016-2017 COMPANY INDEX K

eRouteIt

Lincoln, NE (402) 261-4067 www.erouteit.com

K-2 Partners, LLC Villanova, PA (215) 690-1133

Ex-It Technologies

NetGain

Barrie, ON Canada (888) 797-2455 www.netgainseo.com

Nordfab Ducting

Harris PO Box 8 Chesterland, OH 44026 (877) 392-7123 Tiffanie Julian tjulian@ezshred.com EZshred is a simple to learn, yet extremely powerful software system to run your shredding and medical waste business.

From scheduling and routing using Google maps to invoicing and reporting, EZshred takes care of the details so that you have time to manage and grow your business. Ask about our cutting-edge Android and Apple smartphone apps, recycling, record storage solutions and cloud services as well!

315 W 12th Ave Cordele, GA 31015 (229) 273-2500 Holly Waters info@harrisequip.com www.harrisequip.com Harris offers the industr y ’s finest customer service, most advanced design and engineering capabilities. For more than 100 years, Harris has remained an industry leader in the manufacturing of ferrous and non-ferrous processing equipment. Harris equipment is backed by a well-trained, worldwide distribution organization, supported by a large staff of factory technicians, and large parts inventories at both distributor sites and the manufacturing plants.

F

I

Fire Protection Intl Consortium

Concord, CA (925) 825-4643 www.globalfireprotection.com

Firelock Fireproof Modular Vaults Kutztown, PA (610) 756-4440 www.firelock.com

FLAMEX, Inc

Greensboro, NC (336) 299-2933 www.sparkdetection.com

H

HALLCO Industries, Inc Tillamook, OR (503) 842-8746 www.hallcoindustries.com

Ashtabula, OH (800) 772-7659 www.meeseinc.com

N

Naples, FL (239) 596-2254 www.exittechnologies.com

EZshred Software Systems

MOD-Meese Orbitron Dunne Co

Interlake Mecalux

Melrose Park, IL (877) 632-2589 www.interlakemecalux.com

Intek Truck & Equipment Leasing

Reno, NV (866) 652-1588 www.nordfab.com

KEITH Mfg Co

PO Box 1 Madras, OR 97741 (800) 547-6161, (541) 475-3802 sales@keithwalkingfloor.com www.keithwalkingfloor.com The KEITH WALKING FLOOR unloading system increases efficiency in the mobile document destruction environment.

Installed in a shred truck, the moving floor system stores shredded documents and automatically unloads them once the truck reaches a secure location. Unloading time is under five minutes and no tipping is needed. See ad on pg 2

L

Lane-Link Group, Inc Heath, TX (972) 772-5680 www.lane-link.com

Roseland, NJ (973) 403-7788 www.intekleasing.com

IPS Balers Mfg Baxley, GA (800) 280-2313 www.ipsbalers.com

J

Jake, Connor & Crew Inc

Newark, CA (877) 434-9747 www.pcsrco.com

Pyromet

Aston, PA (610) 497-1743 www.pyromet999.com

R

RouteOptix Inc

Kitchener, ON N2R 1J3 Canada (866) 926-7849 www.routeoptix.com

S

Schutte-Buffalo Hammer Mill, LLC

Security Engineered Machinery Co Lock America International

9168 Stellar Court Corona, CA 92883 (800) 422-2866, (951) 277-5180 sales@laigroup.com www.laigroup.com For over 30 years, Lock America has been an innovative market leader in a wide range of industries that demand lock and security hardware. See ad on pg 3

Kitchener, ON N2E 1W9 Canada (877) 565-5253 www.jakeconnorandcrew.com

M

Jordan Reduction Solutions

South Holland, IL (800) 875-1038 www.marenengineering.com

Birmingham, AL (888) 733-8248 www.jordanreductionsolutions.com

Pacific Coast Shredder Repair Co

Buffalo, NY (800) 447-4634 www.hammermills.com

International Baler Corp Jacksonville, FL (800) 231-9286 www.intl-baler.com

P

Maren Engineering Corp

Westboro, MA (800) 225-9293 www.semshred.com

Shotgun Capital Advisors Southlake, TX (817) 421-5940 www.shotguncapital.com

Attention Advertisers !

Now is the time to schedule your 4-color logo/photo listing in next year’s Buyers’ Guide Issue.

For more information, contact Rick Downing at 440-257-6453.

Security Shredding News Winter 2016-2017

9

2016-2017 Buyers’ Guide COMPANY INDEX

S Continued

U

Waterfront Capital, Inc

UltraShred LLC Spokane Valley, WA (877) 468-5872 www.ultrashred.com

Fort Lauderdale, FL (954) 525-8448 www.waterfrontcapital.com

UNTHA America

Hampton, NH (603) 601-2304 www.untha-america.com

Shred-Tech

295 Pinebush Road Cambridge, ON N1T 1B2 Canada (800) 465-3214 shred@shred-tech.com www.shred-tech.com Shred-Tech® is globally recognized for designing and manufacturing firstclass reduction systems and shredding machinery to cost-effectively meet your waste reduction and recycling needs.

See ad on pg 13

V ShredSupply

13026 W McFarlane Road, Bldg C-2 Airway Heights, WA 99001 (866) 520-8762 Karl Ellwood info@shredsupply.com www.shredsupply.com At ShredSupply, our mission is to be your industrial shredding supply company. We provide quality pre-owned and refurbished mobile shredding equipment, parts, service and rentals. Our equipment is dependable due to our thorough reconditioning and testing process by our highly skilled mechanics and technicians.

T Shredfast, Inc

13026 W McFarlane Road, Bldg C-2 Airway Heights, WA 99001 (509) 244-7076 Karl Ellwood karl@shredsupply.com www.shredfast.com Shredfast builds the finest document shredding, secure collection and media destruction equipment in the industry. Our newest product, the 2016 PT-125, has the legendary Shredfast quality in a non-CDL hydraulic shredder - it will increase your productivity and decrease downtime. All of our products are designed, tested and manufactured in the U.S.

Attention

Advertisers !

Now is the time to schedule your 4-color logo/photo listing in next year’s Buyers’ Guide Issue.

WEIMA America, Inc

Vecoplan LLC

PO Box 7224 High Point, NC 27264 (336) 861-6070 Bob Gilmore info@vecoplanllc.com www.vecoplanllc.com Vecoplan engineers, manufactures, and provides parts and service on a range of shredders and systems for processing medical waste, destroying confidential records, and recycling scrap. An integral component in turnkey waste sterilization systems, our machines are used to shred sharps, textiles, plastics, and for red bag processing. AAA NAID compliant for secure destruction of paper, film, disks, and hard drives. See ad on pg 11

W Trans Lease, Inc

4475 E 74th Ave #103 Commerce City, CO 80022 (877) 600-6423, (303) 301-7651 Terry Lee, Business Development Mgr tlee@transleaseinc.com www.transleaseinc.com Our vision at Trans Lease is to provide you with the means to capture and grow expanding markets through our ability to provide financial choices and personal service. Since 1991, Trans Lease has expanded, doing business in all 50 states plus Canada and Puerto Rico, with a lease fleet of more than 5,000 units.

See ad on pg 16

Tryco Manufacturing Co Decatur, IL (217) 864-4541

For more information, contact Rick Downing at 440-257-6453.

10 Security Shredding News Winter 2016-2017

Waste Processing Equipment, Inc Rainsville, AL (256) 638-6355 www.maxpakbalers.com

3678 Centre Circle Fort Mill, SC 29715 (888) 440-7170 info@weimaamerica.com www.weimaamerica.com For more than 30 years WEIMA has remained focused on the art of shredding and briquetting. We are passionate about improving these technologies. We invite you to profit from this growing wealth of knowledge and experience by specifying a WEIMA solution to your next challenge the WEIMA team is ready. See ad on pg 5

The Wilson Bohannan Lock Co Marion, OH (800) 382-3639 www.padlocks.com

Wire Industries LLC Stockbridge, GA (770) 507-5700 www.wireindustriesllc.com

Z

ZRG Inc

Carlsbad, CA (760) 438-8825 www.zrginc.com

Advertise here and reach over 3,100 businesses involved in ...

•

Document & Product Destruction Contractors

•

Records & Media Storage Facility Owners

•

Medical/Pharmaceutical Waste Transporters

For more information, contact Rick Downing at 440-257-6453 or email rickdowning@oh.rr.com.

In the News UMass Settles Potential HIPAA Violations Following Malware Infection

W

OCR’s investigation indicated the following ashington, D.C. – According to the potential violations of the HIPAA Rules: Office of Civil Rights, the University • UMass had failed to designate all of its of Massachusetts Amherst (UMass) health care components when hybridizing, has agreed to settle potential violations of the incorrectly determining that while its Health Insurance Portability and Accountability University Health Services was a covered Act of 1996 (HIPAA) Privacy and Security Rules. health care component, other components, The settlement includes a corrective action plan including the Center where the breach of and a monetary payment of $650,000, which is ePHI occurred, were not covered components. reflective of the fact that the University operated Because UMass failed to designate the Center at a financial loss in 2015. a health care component, UMass did not On June 18, 2013, UMass reported to the implement policies and procedures at the U.S. Department of Health and Human Services, Center to ensure compliance with the HIPAA Office for Civil Rights (OCR) that a workstation in Privacy and Security Rules. (Note: The its Center for Language, Speech, and Hearing (the HIPAA Privacy Rule permits legal entities “Center”) was infected with a malware program, that have some functions that are covered which resulted in the impermissible disclosure of

by HIPAA and some that are not to elect to electronic protected health information (ePHI) become a “hybrid entity.” To successfully of 1,670 individuals, including names, addresses, “hybridize,” the entity must designate in social security numbers, dates of birth, health writing the health care components that insurance information, diagnoses and procedure perform functions covered by HIPAA and codes. The University determined that the assure HIPAA compliance for its covered malware was a generic remote access Trojan that health care components.) infiltrated their system, providing impermissible • UMass failed to implement technical security access to ePHI, because UMass did not-have a Security Shredding & Storage News 1/2 page, 4C measures at the Center to guard against firewall in place.

unauthorized access to ePHI transmitted over an electronic communications network by ensuring that firewalls were in place at the Center.

•

Finally, UMass did not conduct an accurate and thorough risk analysis until September 2015.

•

“HIPAA’s security requirements are an important tool for protecting both patient data and business operations against threats such as malware,” said OCR Director Jocelyn Samuels. “Entities that elect hybrid status must properly designate their health care components and ensure that those components are in compliance with HIPAA’s privacy and security requirements.”

•

In addition to the monetary settlement, UMass has agreed to a corrective action plan that requires the organization to conduct an enterprise-wide risk analysis; develop and implement a risk management plan; revise its policies and procedures, and train its staff on these policies and procedures.

Advertise in all 4 issues of Security Shredding News and $AVE !!

For more information, contact Rick Downing at 440-257-6453 or email rickdowning@oh.rr.com.

The

ience Of

hredding

It’s In Our DNA

Destruction Equipment - Mobile • General purpose, pierce & tear shred trucks • Non-CDL shred trucks • “The Beast” VST-42e shred trucks • Used shred trucks

Destruction Equipment - Plant Based • Shredders • Shredding lines: conveying systems, dust collection • Turn-key document destruction plants with integrated controls

Conveyors, Sorters & Handling Equipment • Mechanical & pneumatic conveyors • Box dumpers • Truck unloading containment systems • Baler Feed

(336) 285-0021 • www.vecoplanllc.com vecoplanllc.com

Parts, Service, Training • Full line of OEM parts in stock and ready to ship • 24-7 telephone support • On-site service • Mechanical training • Sales training

All The Elements For Your Success!

Security Shredding News Winter 2016-2017 11

Destruction Equipment

In the News Door to Door Secure Hard Drive Shredding Arrives in Toronto

T

he Electronic Recycling Association (ERA) recently announced that they are now offering mobile hard drive destruction in the Toronto area. ERA already offers the service across Canada, including British Columbia, Alberta, Saskatchewan, Manitoba and Quebec.

ERA, a not for profit organization, has been reducing unnecessary e-waste and its adverse environmental contribution through the recovery, refurbishment and donation of electronic and IT equipment since 2004.

“We are excited to now offer door-to-door, mobile hard drive shredding in Toronto.” Says Bojan Paduh, president of ERA. “We listened to what our partners were saying, and have removed their biggest concern: data security.

There is huge demand for this service in Canada, and we are looking forward to making safe and responsible e-waste disposal a streamlined process for everyone.

Our hope is that by removing risk, people will be more comfortable and likely to dispose of unwanted equipment in an environmentally responsible manner.”

Upon request, the hard drive shredders are delivered to businesses and set‑up, including a brief training session on their operation. Alternatively, businesses can have their hard drives picked up and destroyed at one of ERA’s warehouses, with a video recording of the destruction and serial number certificate provided following the service.

European Paper Recycling Hits New High

B

elgium – The 2015 European paper recycling rate of 71.5 percent is 1.5 percent higher than the target set by the ERPC in the 3rd European Declaration on Paper Recycling for the period 2010-2015.

“The efforts of the ERPC perfectly complement EU policy on Circular Economy. The paper fiber loop can serve as the perfect model for circularity”, says ERPC Chairman Henri Vermeulen. “All 13 ERPC associations are proud to be part of a value chain ‘Made in Europe,’ prolonging value creation and job opportunities”, he added.

In addition to the quantitative progress, a lot of qualitative work was done, particularly with initiatives to facilitate the recycling process and increase recycling activity. These notably include collection and applying ecodesign to paper products.

For the commitment period of 2011 to 2015, an EY (formerly known as Ernst and Young) report has independently verified the recycling rate calculations.

The commitment for 2016-2020 is being prepared.

Trump’s Impact on HIPAA Enforcement and the OCR Predicted to be Small

I

nfo security consultants and C-level executives interviewed prior to the November general election agreed that a Donald Trump administration would change little about protected health data regulation – in the beginning – but is likely to have a long-term impact on Health and Human Services Office of Civil Rights.

For the article, HealthcareInfoSecurity Executive Editor, Marianne Kolbasuk McGee, spoke with consultants and CIOs from organizations that specialize in, or oversee, HIPAA compliance, including: CynergisTek, Clearwater Compliance, University of Pittsburgh Medical Center, Beth Israel Deaconess HealthCare and the law firm, Davis Wright Tremaine.

Support for health information protection has been bipartisan, based on previous presidential cabinets, according to McGee, who noted that those whom she interviewed do not expect much to change at the Office of Civil Rights (OCR). This would include OCR’s Phase II compliance audits and the agency’s allocated budget.

Moreover, the $27 million the agency has collected from fines and penalties will be used to help resolve HIPAA violations, an attorney with Davis Wright believes. The CEO of Clearwater Compliance, a HIPAA consultancy, predicted that OCR was unlikely to be targeted for cuts since the agency division’s budget is small compared to other federal organizations.

Other observers McGee spoke with noted that Trump’s embrace of competitive advantage is likely to lend even more support to fighting cyber threats, which are considered part of business risk management, not merely HHS regulatory compliance issues.

Interestingly, Trump’s personal physician’s use of the outdated Microsoft Windows XP software came under scrutiny by the online IT news site, Gizmodo. As results of the president-elect’s physical were released last August, Gizmodo posted a headline slamming Trump’s doctor, Harold Bornstein, MD, for continuing to use the operating system, which has not been supported

by Microsoft with security patches and other updates since 2014. Although continued use of XP is not a HIPAA violation, and the law does not spell out operating system requirements for covered entities, Gizmodo noted that XP does not meet HIPAA requirements for information systems that contain electronic protected health information.

Along the same lines, other likely candidates for focused attention include security issues Congress already has been dealing with such as coordination and interoperability between the numerous healthcare records systems, payment program and health information exchange security. These complex issues will take time to work out, industry observers told McGee. Patient authorizations, and in particular, the manner in which disclosures are communicated to patients must be tackled by lawmakers, too, according to one attorney interviewed. A bill known as 21st Century Cures has been passed

by Congress and is being reviewed by the Senate. The bill would allow healthcare providers and health plans to share a patient’s protected health information with pharmaceutical and medical device makers, as a permitted disclosure under healthcare operations, but without the patient’s authorization.

12 Security Shredding News Winter 2016-2017

In the News Document Destruction Experts Open First Location in St. Louis; Launch Mobile Shredding Vehicle

P

ROSHRED® St. Louis recently announced that it is open for business, serving the greater St. Louis metropolitan market. PROSHRED St. Louis is a franchisee of PROSHRED Franchising Corp. (“PFC”). PFC currently has 27 locations in operation serving 30 markets in the United States and with the addition of the St. Louis, PROSHRED continues to develop its footprint across the United States and marks its seventh location in the Mid-West.

“The need to secure sensitive information and documents is more critical than ever. From legal findings, to social security numbers, to documents with credit card information or health information the lawyers, doctors, and other businesses we work with deal with sensitive information on a daily basis,” says Nguyen Violette, owner and president of PROSHRED St. Louis. “Our partners have a huge responsibility to their clients to protect that sensitive information.

As a native of St. Louis, I’m proud to be able to service the area as a locally owned and operated company.”

Coming First Quarter 2017 ...

Special Editorial Focus On Plant-Based Shredders!

All plant-based shredder manufacturers who advertise in this issue will receive an editorial profile focusing on their equipment.

For more information, contact Rick Downing at 440-257-6453 or email rickdowning@oh.rr.com.

www.chachkagroup.com chachka@chachkagroup.com

www.shred-tech.com

Security Shredding News Winter 2016-2017 13

In the News ABI Document Support Services Opens New North American Headquarters in Loma Linda, California

A

BI Document Support Services recently announced the opening of a new 25,096-square foot North American headquarters in the Corporate Business Center located at 10459 Mountain View Avenue, Suite E, Loma Linda, CA 92354.

“The move comes as ABI is experiencing significant sales growth,” said Steve Pylman, ABI’s Director of Human Resources. “The new headquarters will offer more space to better accommodate our growing staff.”

According to Pylman, ABI Document Support Services provides medical records retrieval for insurance companies and law firms nationwide. The company, which retrieves over 50,000 records monthly for its nationwide customer base, has offices located in Loma Linda, CA; Los Angeles, CA; San Diego, CA; Sacramento, CA; Las Vegas, NV; Phoenix, AZ; Springfield, MO; Garden City, NY; Tomball, TX; Sioux Falls, SD; Fullerton, CA; and Lake Mary, FL.

OCR Is Serious About Health Data Security: More C-Level Engagement Needed

W

ashington, D. C. – The head of the federal Health and Human Services (HHS) says that many HIPAA-covered entities and business associates are falling short when it comes to managing protected health information (PHI), HealthSecurity.com reports.

Tallies of HIPPA fines levied by HHS’ Office for Civil Rights (OCR) have reached $13.5 million to date.

Noting this, Secretary Jocelyn Samuels has stated that she wants to see HIPAA-covered healthcare organizations and their business associates do more to secure patients’ data. Specifically, she wants to see improvements in risk assessment, implementation of stronger safeguards and prompt action to address any compliance deficiencies.

Under the OCR’s watch, the evolving healthcare industry continually offers new services and tools for both patients and practitioners, making it ever more challenging to protect health data, however. Security breaches, such as those involving laptop computers, servers, data storage, document destruction have affected millions of individuals in the U.S. Below is a summary of significant breaches.

Organization

Settlement

OCR Response

$5.55m

August – November 2013.

Three reported breaches and multiple alleged HIPAA violations and noncompliance issues, including laptop thefts, unauthorized network access. Total of more than 4 million individuals affected.

OCR found a failure to conduct comprehensive risk analysis and risk management, and inadequate measures to reduce risks to ePHI in all physical locations and on all portable devices.

OCR directed Advocate to modify its existing risk analysis, develop and implement a risk management plan, implement a process for evaluating environmental and operational changes, and develop an encryption report.

University of Mississippi Medical Center (UMMC)

$2.75m

March 2013. Health data breach reportedly affected 10,000 individuals. Total of 67,000 ePHI files stored on a UMMC network drive were vulnerable to unauthorized access via UMMC’s wireless network using a generic username and password. Also a password-protected laptop was reported stolen by a hospital visitor.

OCR directed UMMC to identify risks and vulnerabilities to their ePHI, implement reasonable and appropriate safeguards to address them within an appropriate time frame.

Oregon Health and Science University

$2.7m

2013. OHSU submitted multiple breach reports including loss of unencrypted laptops and a stolen unencrypted thumb drive which posed potential exposure of thousands of individuals.

OCR found widespread violations including use of cloudbased Google Mail and Google Drive to transmit and store ePHI of over 3,000 individuals without password protection. OCR found significant risk of harm to 1,361 of these individuals. OHSU was cited for having no agreement in place to cover Google, which was functioning as a business associate.

OCR directed OHSU to develop a comprehensive threeyear corrective action plan to include risk assessment and management, as well as solutions for encryption, Mobile Device Management and security awareness and training.

2011-2012. Files containing ePHI of more than 31,000 individuals were publicly accessible on the Internet via Google and possibly other internet search engines for 12 months. BAA in place had not been updated.

OCR found a failure to conduct evaluations of environmental and operational changes thereby compromising the security of ePHI. SJH did not conduct an enterprisewide risk analysis and allowed contractor assess to ePHI without adequate protections in place.

OCR directed SJH to develop a corrective action plan with risk assessment, risk management, and training components.

2012. CNE-covered entity, Woman & Infants Hospital of Rhode Island (WIH) reported a loss of unencrypted backup tapes containing personal data of approximately14,000 individuals.

OCR found inadequate security measures to protect the tapes. The BAA between CNE AND WIH in place since 2005 had not been updated to incorporate revisions required under the HIPAA Omnibus Final Rule. Also, WIH also failed to provide timely notification to the affected individuals.

WIH entered into a consent judgment with the Massachusetts Attorney General’s Office (AGO), and reached a settlement of $150,000. OCR found the consent judgment to sufficiently cover most of the conduct in the breach

Richards & Richards Names New President and CEO

N

ashville, TN (Dec. 13, 2016) – Richards & Richards has named chief operating officer Jerre Richards Jr. as the company’s new president and CEO. Richards is the nephew of current CEO and founder Steve Richards, who will assume the role of chairman of the company.

“I’ve enjoyed being a part of this company since our earliest days,” said Jerre Richards. “It’s an honor to be named the new head of Richards & Richards, and I look forward to working with our team to build on the legacy of excellence that Steve created.”

Jerre Richards served as a vice president at Armstrong Transfer & Storage Co. before joining Richards & Richards in 1987. He assumed the role of COO in 1988 and was responsible for overseeing the company’s operations. Richards & Richards is a former winner of the Nashville Business Journal’s Small Business of the Year Award, is an Inc. 500 Company, was twice selected as a Future 50 company, is a Torch Award winner from the BBB and was recently named by The Tennessean as a Top Place to Work.

As chairman, Steve Richards will continue to focus on the growth of the company.

“Jerre has been by my side since the beginning,” said Steve Richards. “I have no doubt his leadership will produce great results for our customers and our company.”

Breach

Advocate Health Care

St. Joseph Health (SJH)

Care New England Health System

$2,140,500m

$400,000

HHS Secretary Samuels stated that, despite the record number of settlement agreements, most complaints OCR receives do not involve an alleged HIPAA violation, but rather, give notice of questionable situations that could lead to breaches. As OCR embarks on Phase II audits, the agency’s emphasis will shift toward making sure covered entities have preventative measures in place.

14 Security Shredding News Winter 2016-2017

www.certifymerecycling.org info@certifymerecycling.org

Security Shredding News Winter 2016-2017 15

®

Specialist in Mobile Shred Truck Financing • LOW INITIAL INVESTMENT • LEASE OR LOAN FINANCING • FINANCING NEW OR PRE-OWNED EQUIPMENT

• SIMPLE APPLICATION PROCESS • SERVING THE U.S. & CANADA • COMPETITIVE RATE STRUCTURE

We Provide a Convenient and Cost-Effective Solution!

Financing The World Of Transportation For a Quote or More Information Contact: Eastern States Western States Terry Lee Cassie Bergo Direct: 303-301-7651 | Cell: 937-620-9400 Direct: 303-301-7685 | Cell: 303-324-8340 tlee@transleaseinc.com cbergo@transleaseinc.com

www.transleaseinc.com WWW.TRANSLEASEINC.COM