Competencies

DAT 250 Project Two: Organizational Scenarios Scenario A: AmityTech Solutions (CCPA and GDPR) AmityTech Solutions is a well-established technical management company based in North America, providing comprehensive data management services to businesses across various industries. AmityTech specializes in offering secure data solutions, robust server infrastructure management, and proactive cybersecurity measures for its clientele, which spans both the United States and Ireland. In addition to its core services, AmityTech aggregates anonymized data to create consumer profiles for targeted advertising. These profiles are strictly segregated from the company's regular data storage operations to maintain client confidentiality and ensure compliance with privacy regulations. Currently, AmityTech manages a database of approximately 300,000 individual consumer profiles.

Despite differentiating between its service offerings, AmityTech encountered a significant breach of client data due to lapses in compliance procedures. An internal audit revealed that scheduled compliance audits had not been completed for three consecutive nine-month cycles. A compliance auditor was also found to have falsified documents and violated security protocols by introducing personal storage devices (phones and external hard drives) into secured areas. This led to concerns about a data breach that could have impacted thousands of client accounts. The company must consider GDPR and CCPA, given where they operate their businesses. There are no required industry standards regarding how AmityTech should respond from a legal, ethical, or technical standpoint.

Upon discovering the errors and risk of a breach, the issue escalated to senior management, culminating in a direct meeting with the organization's owner. The owner and AmityTech’s senior leadership team ordered the development of a new security protocol to address the current incident and prevent future occurrences. The leadership also wants recommendations on whether public notice should be given about the breach and asked for advice in this area. Scenario B: MediGuard (HIPAA) MediGuard is a specialized healthcare data management company that partners with hospitals and healthcare facilities across the United States to provide secure data storage, electronic health record (EHR) management, and technical support services. With a strong emphasis on patient privacy security, MediGuard is responsible for compliance with the Health Insurance Portability and Accountability Act (HIPAA). One of MediGuard's primary responsibilities is to host and manage EHR systems for its hospitals, ensuring the availability, integrity, and confidentiality of patient records while adhering to HIPAA regulations. Additionally, MediGuard collects and stores a wide range of patient data, including medical histories, treatment plans, diagnostic test results, and billing information.

Despite stringent security protocols, a breach occurred due to lapses in compliance procedures within the hospital setting, raising concerns about potential HIPAA violations. An internal audit revealed that scheduled security assessments and data audits had not been conducted as per protocol, leaving vulnerabilities undiscovered for at least four months. The supervisor who realized this promptly escalated the issue to senior management at both MediGuard and the hospital administration. Recognizing the seriousness of the situation and the implications for HIPAA compliance, the CEO of MediGuard convened a meeting with hospital leadership to address the breach and mitigate its impact while ensuring current and future adherence to HIPAA regulations.

In response to the breach, MediGuard has been ordered to propose and administer a response for their hospital partner. They will need to highlight a new security protocol to maintain client trust and patient safety moving forward. The hospital leadership also wants recommendations on a communication strategy and whether public notice should be given to patients about the breach. They asked for advice in this area.

Scenario C: EduTech Innovation (FERPA) EduTech Innovation provides data management and technical support services to higher education institutions across the country. Partnering with the data management teams of universities and colleges, EduTech offers solutions tailored to the unique needs of academic environments, ensuring the security and integrity of student and faculty data while complying with the Family Educational Rights and Privacy Act (FERPA). One of EduTech's primary responsibilities is to develop and maintain the student information systems (SIS) for its partner institutions, which house student records, course enrollment data, academic transcripts, and financial aid information. EduTech also assists universities in managing personnel records, research data, and institutional analytics to support decision making and improve academic outcomes. Strict measures are in place to protect the privacy and confidentiality of student education records in accordance with FERPA guidelines.

Unfortunately, a breach occurred due to lapses in compliance procedures within a partner university, raising concerns about a breach and potential FERPA violations that could impact thousands of students. An internal audit revealed that scheduled security assessments and data audits had not been conducted, leaving vulnerabilities undiscovered for an extended period. Furthermore, an auditor was found to have falsified documents and violated security protocols by accessing sensitive student records and sharing them across the university without proper authorization.

Upon discovering this, the supervisor promptly escalated the issue to senior management at EduTech and the university's administration. Recognizing the seriousness of the situation and the implications for FERPA compliance, the CEO of EduTech convened a meeting with university leadership to address the breach and mitigate its impact while ensuring adherence to FERPA regulations. Since this has never happened to a client before, EduTech must propose steps to respond to the current concern with a specific focus on FERPA compliance. They must also make recommendations about how to prevent this from happening in the future. This will include determining whether a public disclosure is necessary and a communication plan that aligns with all the correct regulations.

10/17/24, 6:27 AMAssignment Information

Page 1 of 3https://learn.snhu.edu/content/enforced/1698884-DAT-250-14280.2…Two%20Guidelines%20and%20Rubric.html?ou=1698884&d2l_body_type=3

DAT 250 Project Two Guidelines and Rubric

Competencies

In this project, you will demonstrate your mastery of the following competencies:

Make ethically informed decisions based on awareness of legal and organiza!onal parameters

Describe best prac!ces for data management

Scenario

While you can select from any of the Project Two scenarios, you have been tasked to consider organiza!ons that focus on ethical decision making and frameworks using FERPA, GDPR,

HIPAA, and CCPA throughout the term. It is recommended that you select the scenario whose frameworks you feel most comfortable with and have addressed in the past so that you can

build off your own work and get feedback from your instructor. The scenarios are available in the Suppor!ng Materials sec!on.

You are a data management professional working for one of the following organiza!ons:

AmityTech Solu!ons

MediGuard

EduTech Innova!on

Each organiza!on has experienced a data breach that risks its clients' confiden!al data. You will examine the scenario's details, iden!fy the kinds of informa!on compromised, and determine

the incident's poten!al ramifica!ons. Your priority now is to help your organiza!on properly respond to the scenario, make recommenda!ons for upda!ng company policies, and consider

how to prevent this kind of incident in the future. You have a significant opportunity to help shi# your organiza!on's work in the right direc!on using best prac!ces and ethical frameworks.

Directions

Review the scenario you selected from the Organiza!onal Scenarios in the Suppor!ng Materials sec!on. Create a wri$en business recommenda!ons report for your organiza!on's senior

leadership team.

Your recommenda!ons report must address the following cri!cal elements:

Compare global policies and regula!ons regarding data privacy.

Consider data privacy regula!ons in the United States versus other countries.

Consider whether your company would need to change its data-gathering prac!ces if the company were to expand interna!onally (such as within the European Union).

Explain factors that impact an organiza!on’s policies on data privacy.

Explain the effect that data privacy policies can have on the company you selected, including how the issues exposed in an audit may impact the company's reputa!on.

Discuss the ethical considera!ons that affect privacy policies for your company's industry.

Describe the purpose of a compliance audit and its influence on policy decisions in the future.

Explain the ethical and professional purpose of compliance audits in organiza!ons.

Discuss how, if followed correctly, compliance with audit requirements could have prevented the issues experienced by your organiza!on.

Iden!fy poten!al consequences for con!nued non-compliance with audit requirements.

Discuss how data privacy laws and ethics affect how organiza!ons operate.

Indicate how data privacy laws and ethical frameworks influence decision making in regard to data policy.

Give an example of how the passing of a more restric!ve data privacy law and ethical frameworks would affect how your company operates.

Describe the roles and responsibili!es of data management professionals who contribute to data security and policy.

Give examples of roles within your organiza!on that might influence, or be influenced by, data security policies.

Describe how customer-facing and technical data roles differ in their approaches to data security policies.

Discuss how data management professionals apply ethical decision making in their roles.

Give an example of where a data policy might have an ethical gap.

Explain where you might go for guidance if an industry does not have wri$en ethical guidelines, or their new products have had unforeseen ethical consequences.



10/17/24, 6:27 AMAssignment Information

Page 2 of 3https://learn.snhu.edu/content/enforced/1698884-DAT-250-14280.2…Two%20Guidelines%20and%20Rubric.html?ou=1698884&d2l_body_type=3

Describe how you would handle a lack of ethical guidelines and how this might relate to the Riddle Security breach.

Discuss how technology in data management, security, and privacy has changed over !me.

Give examples of how changes in technology in the last ten years have impacted data regula!ons.

Discuss how changing technologies could have affected Riddle Security’s breach either in a posi!ve or nega!ve way.

What to Submit

This assignment must be submi$ed as an 8- to 10-page Word document, using one-inch margins, double spacing, and Times New Roman font. You should support your responses by

referencing appropriate resources from credible sources in the field. All references must be cited in APA format. Consult the Shapiro Library APA Style Guide for more informa!on on

references.

Supporting Materials

The following resources support your work on the project:

Document: Organiza!onal Scenarios

Review the case study for informa!on that will assist you in your project.

Webpage: Shapiro Library APA Style Guide

For help with your project submission, review the Wri!ng & Presenta!on Help and the APA Cita!on Style guides.

Project Two Rubric

Criteria Exemplary (100%) Proficient (85%) Needs Improvement (55%) Not Evident (0%) Value

Global Data Privacy

Conversa!ons

Exceeds proficiency in an

excep!onally clear, insigh%ul,

sophis!cated, or crea!ve

manner

Compares global policies and

regula!ons regarding data

privacy

Shows progress toward

proficiency, but with errors or

omissions; areas for

improvement may include

inaccuracies or cursory

explana!ons

Does not a$empt criterion 15

Data Privacy Policies Exceeds proficiency in an

excep!onally clear, insigh%ul,

sophis!cated, or crea!ve

manner

Explains factors that impact an

organiza!on’s policies on data

privacy

Shows progress toward

proficiency, but with errors or

omissions; areas for

improvement may include

missing key elements or

inaccurate informa!on

Does not a$empt criterion 15

Compliance Audits Exceeds proficiency in an

excep!onally clear, insigh%ul,

sophis!cated, or crea!ve

manner

Describes the purpose of a

compliance audit and its

influence on policy decisions in

the future

Shows progress toward

proficiency, but with errors or

omissions; areas for

improvement may include

cursory explana!ons of the

rela!on of elements

Does not a$empt criterion 10

Data Privacy Laws Exceeds proficiency in an

excep!onally clear, insigh%ul,

sophis!cated, or crea!ve

manner

Discusses how data privacy

laws and ethics affect how

organiza!ons operate

Shows progress toward

proficiency, but with errors or

omissions; areas for

improvement may include

missing key elements or

incomplete explana!ons

Does not a$empt criterion 10

Data Security and Policies Exceeds proficiency in an

excep!onally clear, insigh%ul,

sophis!cated, or crea!ve

manner

Describes the roles and

responsibili!es of data

management professionals who

contribute to data security and

policy

Shows progress toward

proficiency, but with errors or

omissions; areas for

improvement may include

missing examples or unrelated

roles

Does not a$empt criterion 15

Ethical Decision Making Exceeds proficiency in an

excep!onally clear, insigh%ul,

sophis!cated, or crea!ve

Discusses how data

management professionals

apply ethical decision making in

Shows progress toward

proficiency, but with errors or

omissions; areas for

Does not a$empt criterion 15

10/17/24, 6:27 AMAssignment Information

Page 3 of 3https://learn.snhu.edu/content/enforced/1698884-DAT-250-14280.2…Two%20Guidelines%20and%20Rubric.html?ou=1698884&d2l_body_type=3

manner their roles improvement may include

illogical or inconsistent

explana!ons

Changing Technology Exceeds proficiency in an

excep!onally clear, insigh%ul,

sophis!cated, or crea!ve

manner

Discusses how technology in

data management, security,

and privacy has changed over

!me

Shows progress toward

proficiency, but with errors or

omissions; areas for

improvement may include

cursory explana!ons

Does not a$empt criterion 10

Ar!cula!on of Response Exceeds proficiency in an

excep!onally clear, insigh%ul,

sophis!cated, or crea!ve

manner

Clearly conveys meaning with

correct grammar, sentence

structure, and spelling,

demonstra!ng an

understanding of audience and

purpose

Shows progress toward

proficiency, but with errors in

grammar, sentence structure,

and spelling, nega!vely

impac!ng readability

Submission has cri!cal errors in

grammar, sentence structure,

and spelling, preven!ng

understanding of ideas

5

Cita!ons and A#ribu!ons Uses cita!ons for ideas

requiring a$ribu!on, with few

or no minor errors

Uses cita!ons for ideas

requiring a$ribu!on, with

consistent minor errors

Uses cita!ons for ideas

requiring a$ribu!on, with

major errors

Does not use cita!ons for ideas

requiring a$ribu!on

5

Total: 100%