(Published December 8, 2008)
In this day and age where identity theft is a major concern, new employee privacy laws are springing up all over the place. My state just implemented a new one, to be effective next month. Other states have them to varying degrees, from variations on HIPAA to restrictions on the use of Social Security numbers. But what are the employees doing to protect their information?
It varies with the employee, of course. I remember talking to one fellow a few years ago who was so paranoid about giving out his Social Security number that he didn't want to give it to the Payroll department! But others don't really think about some of the information they're freely making available.
As I've mentioned in other columns, open enrollment is going on right now for a whole lot of businesses nationwide. Many of us have online enrollment, which is fine if you have the appropriate protections built in. But in instances when enrollment forms need to be completed, some employees are maybe a bit too trusting. A colleague of mine mentioned recently a frequent situation in the law firm where she works: Attorneys have their secretaries sending in enrollment or beneficiary forms with Social Security numbers, addresses, and dates of birth of not only the attorney but also those of their dependents or beneficiaries; these come in, she says, in unsealed interoffice envelopes. Using e-mail is not necessarily better. She mentioned one instance where a PDF attachment was e-mailed to one of her staff…but with every member of HR cc'd on it. Not just the Benefits department, but all of HR! That's 40 people who now have private information that they don't need.
Perhaps we should start trying to make our employees aware of some of these issues. Perhaps when we ask them to send us information that might be of interest to identity thieves, we should be instructing them to send it in sealed envelopes or to e-mail it only to the person concerned. We can't eliminate the need for that information to be disseminated, and we can't force them to be more careful, but if an employee's information is stolen, we're going to want to be certain that we not only complied with all applicable laws, but also took all reasonable precautions.
Nor should we be concerned with only our own liability. Identity theft can be a serious problem. For our employees' own sakes, we should be urging them to be careful. It can take hours of time and thousands of dollars to recover from identity theft. We don't want to wish that on anyone.
Catherine Bannon is an HR consultant in Marshfield, MA (catherine.bannon@gmail.com). Bannon worked for 10 years in HR management before starting her consulting practice.
Home
