Private data must be protected, will not be included in Campus email
The Department of Labor and Industry (DLI) has received a great deal of feedback from stakeholders asking that more details be included in the email messages created and sent via Work Comp Campus. At this time, DLI will maintain its current business practice and refrain from including any injured-worker-specific identifying details in Campus-generated email messages. I want to take a moment to share our rationale for moving forward with our current protocols.
DLI has consistently maintained that under Minnesota Statutes, chapter 176, workers' compensation data, including even the existence of a claim, is not public data. Therefore, Campus-generated email has avoided including potentially identifying details, such as the date of injury (DOI) or worker identification (WID) number, in either the subject line or body of the message. The feedback DLI has received has indicated the use of encrypted email, which would allow additional information about an injured worker to be included in the body of an email message to authorized parties, is not a preferred solution for most Campus users.
In assessing the potential risk to DLI, given the large volume of messages generated and sent by Campus each day, it is not viable to deviate from our current procedure. The high standards outlined in the Minnesota Government Data Practices Act (MGDPA) dictate DLI must protect not public workers' compensation data, including following data security standards when information is sent from Campus. The group administrator service model unique to DLI and Campus, along with the wide range of messages generated by various interactions with the system, further reinforce that the best approach for DLI to abide by the terms of MGDPA is to continue to exercise caution with information DLI sends to stakeholders via unencrypted email.
In addition to data practices concerns, DLI is aware of several law firms and insurance companies that have recently experienced security hacks, phishing attempts and other efforts to compromise online systems. These cybersecurity attacks of stakeholders may affect the security of information within Campus.
DLI thoroughly examined several proposals and options offered by Campus users with its Office of General Counsel and leaders in the Workers' Compensation Division before deciding to reaffirm its position about this matter. We welcome your continued feedback and pledge to monitor the needs of Campus users to determine if other improvements can be made to the Campus email process, particularly as more users develop increased comfort with the use of encryption for general email transmission with other stakeholders as a best practice.
DLI truly values stakeholder feedback, but data security is our top priority. With your continued support, we will move forward together to help make the Minnesota workers' compensation system and Campus operate as efficiently and effectively as possible.
Sincerely,
Department of Labor and Industry Commissioner
|
