In Part 1 of this article, we provided an overview of considerations for secure data storage for call centres. These recommendations were based on specific compliance requirements from some of the main regulations and guidelines that companies need to adhere to, which include:
- The Health Insurance Portability and Accountability Act (HIPAA)
- Payment Card Industry Data Security Standard (PCI DSS)
- The EU’s General Data Protection Regulation (GDPR)
- The California Consumer Privacy Act (CCPA)
But the fact is, depending on what kind of data you’re capturing, organisations may need to deal with juggling more than one set of requirements for compliance from multiple regulatory bodies. This adds an extra layer of management and complexity when considering your approach to storing call centre data securely. If you’re HIPAA compliant with a customer service call, for instance, you may not be out of the woods in terms of regulatory due diligence. Such a call might additionally need to adhere to rules for the other three sets of guidelines above and/or Personally Identifiable Information (PII).
A number of increasingly common security-related interactions and transactions have started to muddy the waters regarding responsibility for data protection from a compliance perspective. On-call services generally now require consumers to disclose personal information as part of the call centre’s authentication measures to help verify that the person calling is indeed the policyholder. Key identifiers that consumers or patients might be asked to provide include sensitive data such as their social security number, little-known personal details such as parent or other family members’ names, and the consumer’s home address. Occasionally, in medical call centres, the caller may even need to provide a credit card number for a co-payment to be able to continue the call. Organisations should seek legal counsel as to how these forms of personal data should be safely stored, retained, and disposed of—and what internal policies need to be put in place to ensure adherence.
Another challenge to data protection is posed by malware and ransomware since. If these sinister programs penetrate your network, customer data can be exposed—and as we saw in Part 1 of this series, companies that become the victims of such data breaches can be liable from a compliance perspective. The end result can be a trickle-down effect of negative outcomes for companies that are on the receiving end of a ransomware attack, starting with aggravations from downtime and lost data, escalating into lost business revenue and consumer trust, as well as potential fees from failure to comply with data protection regulations.
Strategies for Secure Storage
In light of the challenges above, the best way that an enterprise can safeguard customer data from a compliance perspective is to approach the task systematically, rather than in a piecemeal fashion. Investing in a compliant storage system ensures that all your bases are covered without needing to worry about managing the details. Companies should take the time to compare storage products head to head, as not every system is designed to comply with all required regulations.