OVERVIEW
HISE Financial Corporation is a California-licensed corporation that provides consulting services in forensic accounting, real estate, mortgage, regulatory compliance, litigation support, and other related financial matters. Our firm routinely handles sensitive information, including financial data, confidential business information, and Personally Identifiable Information (“PII”). Due to the sensitive nature of the information we manage daily, all information is handled on a strictly need-to-know basis, and we are committed to maintaining the highest standards of security and integrity.
HISE is committed to ensuring its customers’ privacy and protecting all information entrusted to us. As a general rule, HISE officers, employees, and subcontractors will not copy, share, or disclose any information provided to us without the express written consent of the party providing that information. This policy applies to all HISE officers, employees, and subcontractors.
DEFINITIONS
Personally Identifiable Information (PII)
Personally Identifiable Information, referred to as “PII,” is information that can be used to distinguish or trace an individual’s identity, either alone or when combined with other personal or identifying information that is linked or linkable to a specific individual. The definition of PII is not anchored to any single category of information or technology.
Most often, PII can be identified when an individual’s name is associated with a unique numeric identifier— such as a Social Security Number, Date of Birth, or driver’s license number.
DEFINITIONS
Business Sensitive Information
Business-sensitive information is defined as any document or record that is not available to the general public and is considered a critical document of a client, which, if released or disclosed, would have an adverse impact on the client’s business or reputation.
DATA COLLECTION
Methods by Which We Obtain Information
Almost all information received from clients is provided electronically through various methods. It is the policy of HISE not to accept any PII in an unsecured electronic format. Should a client or customer provide HISE with unsecured PII electronically, we will immediately notify the sending party of this potential security concern to ensure that no additional communications are transmitted in an unsecured manner.
Electronic Data Transfer
It is common for HISE clients to provide electronic information while we are physically present at the client’s office or place of business. Transferring electronic data to HISE devices is standard practice in these situations. When such transfers are accepted, HISE will not remove electronic transfer devices from the client’s property or premises.
In cases where electronic information is transmitted via email or other internet-accessible devices or systems, HISE will ensure that all transmissions are properly password-protected or encrypted in order to preserve the privacy and security of that information.
Paper and Hard Copy Documents
In the rare instances where HISE receives Business Sensitive information or PII in paper format, documents will, where practical, be converted into electronic format for secure storage on HISE electronic devices. The original paper documents will then either be returned to the client or destroyed securely.
DATA USE
How We Use Personal Information
We may use Personal Information to conduct the work for which we have been engaged by our clients. This may include, but is not limited to:
- Conducting specific testing procedures as required by our engagement and applicable laws and regulations
- Conducting testing through third-party software programs to complete our work
- Responding to client inquiries and fulfilling their requests
- Preparing work papers and reports for the client and/or regulators
- Responding to regulatory, law enforcement, or court-ordered requests for information
DATA SHARING
How PII and Business Sensitive Information Is Shared
HISE may, in a safe and secure manner, share PII and Business Sensitive information with its officers, employees, or subcontractors on an as-needed basis to accomplish the objectives for which we were engaged. No information will be shared with any officer, employee, or subcontractor unless there is a specific and demonstrated need to do so.
OTHER DATA
Other Information Collected and Used
Other Information refers to any information beyond PII or Business Sensitive information that does not reveal a person’s specific identity and does not constitute Business Sensitive information as defined above. HISE may collect and use such Other Information in various ways to perform the tasks for which we were engaged, including conducting analysis, testing, and providing consulting services.
PROTECTION
Security
To protect PII and business-sensitive information from unauthorized access and use, HISE employs security measures and strong passwords on all electronic devices. Subcontractors are strictly prohibited from storing, sharing, or removing PII or Business Sensitive information to any unauthorized device, including any personal device or backup service. Employees and subcontractors will not permit any other individual or unauthorized user to access their electronic devices.
Should access to an employee’s or subcontractor’s device become necessary to resolve a technical support issue, the employee or subcontractor must first remove any PII or Business Sensitive information from the device, or must remain present at all times during the rendering of technical support.
Any data transferred by email that contains PII will be encrypted with a strong password. Any electronic data stored or backed up by HISE is encrypted with 128-bit Blowfish encryption prior to transfer and then transmitted through an encrypted 128-bit SSL tunnel.
INCIDENT RESPONSE
Lost or Stolen Electronic Devices
If an employee or subcontractor discovers that an electronic device has been lost or stolen, they must immediately notify the Managing Director of HISE. Under no circumstances shall this notification occur more than 24 hours after the time of the discovery of the loss or theft.
