SOX: Sarbanes-Oxley Act

The Sarbanes-Oxley Act of 2002 applies to public companies and is administered by the Securities and Exchange Commission (SEC).  It was enacted to protect shareholders and the general public from accounting errors and fraud.  The record management regulations affect the financial side of companies as well as their IT departments.  SOX also provides for criminal penalties including fines and prison time for any violation of the act.

Some of the most demanding and controversial aspects of the SOX Act were amended in late 2006. However, SOX compliance remains and important concern for many U.S. businesses.

GLBA: Gramm-Leach-Bliley Act

The Financial Modernization Act of 1999, also known as the "Gramm-Leach-Bliley Act" or GLBA, includes provisions to protect consumers’ personal financial information held by financial institutions. GLBA gives authority to eight federal agencies and the states to administer and enforce the regulations.

The GLBA regulations apply to "financial institutions," which include not only banks, securities firms, and insurance companies, but also other companies regulated by the FTC, providing many other types of financial products and services to consumers. 

If found to be non-compliant with GLBA, you could be vulnerable to severe fines and imprisonment and even subject to class-action lawsuits.

HIPAA: Health Information Portability
and Accountability Act

HIPAA regulates who has access to protected health information.  It affects electronic health care transactions and providers, health insurance plans, and employers.  The act also addresses the security and privacy of health data. 

Covered entities must maintain sufficient secure backups of their data and have disaster recovery procedures in place.  Failure to protect all medical records and other individually identifiable health information can result in penalties including severe fines and prison time.