Hey folks, I am providing web hosting services (shared and dedicated) and have had one of my shared hosting clients mention needing an SSL cert for their site where they are collecting insurance quotes in a form, including names and social security numbers. My privacy sense is tingling, and I'm pretty sure it's not legal (in the US) to do this on a shared system, but can't find anything to support my thoughts outside of PCI-DSS, but the customer isn't processing payments through the site so I'm not sure if that applies. I'm reading lots of policy documents where people advise to minimize and manage the PII footprint internally, but as the host I don't want to put all of my customer's clients at possible risk. I'm not looking here for legal advice necessarily, but perhaps someone in a similar position to mine can provide some rule of thumb or point me in the right direction.
Add a comment
|
2 Answers
I wouldn't even consider doing this on a shared or VPS system.
The risks are too great for information loss/leakage. As a hosting provider, I'd be seriously scared about it too, and probably offer them a cheap dedicated box instead.
answered Dec 28, 2010 at 23:37
-
-
I totally agree, but I am in the position to offer a dedicated solution (which will probably blow his socks off cost wise) and he will ask why. I would prefer to have hard and fast laws to provide rather than just my suggestion for best practices. Honestly, I'm worried that they'll balk at the price and then leave and implement it on shared hosting elsewhere. As a consumer myself, I would be quite upset if people collected info irresponsibly like this, so I want laws and regulations to guide their decision, not just my .02 Big thanks for participating though I was worried i may be overreacting– S. CobbsDec 29, 2010 at 18:00
-
If they left it on shared hosting, and I was in your position, I'd tell them where they could stick it. I wouldn't want my company/reputation compromised by some cheapskates. Dec 30, 2010 at 15:53
I'm assuming you are in the US since you mention PCI-DSS. You might want to take a look at HiPAA rules available here
-
1PCI-DSS isn't just a US thing. It applies world-wide, anywhere that payment card data is being processed/handled/gathered/stored. Dec 28, 2010 at 23:37
-
Thanks for the wakeup, Tom. I hadn't particularly given the proper number of brain cells but you would clearly be right since PCI is a vendor organization, not a government's regulations. The same isn't true of HiPAA; it's the US government's regulations, which from my understanding the US is viewed as quite inferior to EU regulations on privacy, so there may be some help for S. Cobbs there. I set the company lawyers off on privacy regulations regarding EU a couple of months ago but they haven't gotten back to me on what I can and can't do with my services in the EU. Dec 29, 2010 at 0:08
-
There's other regulations too, ISO27001 compliance could play a key part in the security assurance of the host (but maybe not.. ) Dec 29, 2010 at 7:57
-
these are great, thanks! Im not sure if HIPPA applies, as its not healthcare, BUT I think the biggest ace in my deck is that we're located in Masachusetts and we have some good data privacy laws in place (mass.gov/Eoca/docs/idtheft/201CMR1700reg.pdf). I think will approach them with this as it seems the best fit.– S. CobbsDec 29, 2010 at 18:05
-
1HiPAA is so much more stringent than just SSN. It's any piece of information that can be used to identify a person, such as a phone number or address. I think there are 17 or 18 defined items. S. Cobbs, you are probably on a good path with the MA laws. I remember them being mentioned as being quite stringent in a HiPAA class I took recently. Another 'gotcha' with them and other states is that if your client serves customers in that state, I believe they have to adhere to that state's privacy laws. Again, these are all suggestions. Talk to your nearest attorney. Dec 29, 2010 at 23:35