When evaluating providers for transactional communications, you’ll need to ask various questions. Part of your assessment should focus on their print and mail compliance standards. You must feel confident in their capabilities regarding these matters before you make a decision.
The landscape of compliance is complicated, but there are specific queries that deliver key information to consider. If you’re building an RFP (request for proposal) or researching vendors, use these questions to shape your decision.
1. What Certifications Do They Hold Regarding Compliance?
The basis of investigating compliance involves the certifications they hold. Depending on your industry, there may be ones specific to your business. The most common regulations include HIPAA, HITRUST, FISMA, PCI DSS, and state data breach notification laws.
Most will have these, but you’ll want to ask for proof that they meet the guidelines. Another layer of compliance is SOC (System and Organization Controls), which has two parts. SOC I focuses on controls relevant to financial reporting. SOC II refers to controls for security, availability, confidentiality, processing integrity, and privacy of data and systems.
Organizations with SOC I & II compliance follow rigid standards to uphold compliance across the entire lifecycle of print and mail operations.
2. Who Is Responsible for Print and Mail Compliance?
The next topic to inquire about is who owns the compliance oversight within the company. Ideally, dedicated staff fill this role. Organizations that have a Compliance Officer demonstrate their commitment to it. They have a specialized expert on board. They may also have a team responsible for specific areas of compliance.
With these resources, you can also have peace of mind that they can pivot if new regulations arise or existing ones change.
3. What Checks and Balances Exist in Systems to Ensure Compliance?
The workflow from data to delivery of the letter has many tasks and steps. Compliance should be a consideration with all of them. These standards and protocols become the checks and balances needed for adherence. Examples include:
- Secure file processing through SFTP (Secure File Transmission Protocol) that uses encryption
- Workflow auditing that creates a quality assurance model, identifying issues and addressing them
- Accuracy controls using intelligent insertion, which scans barcodes on documents so the equipment knows which pages fold into each envelope
4. What Type of Encryption Do They Use and When?
Encryption of confidential data, including PII (personally identifiable information) and PHI (protected health information), keeps you compliant. However, not all encryption is the same, and vendors don’t always embed it in specific processes.
Encryption works by transforming readable data into ciphertext, which is then unreadable, unless the key is present to decrypt.
First, they should be using encryption while data is at rest and in transit. Information goes through multiple workflows from start to finish. This protects it throughout.
Second, the type of encryption matters. The most secure is AES (Advanced Encryption Standard), which is approved by NIST (National Institute of Standards and Technology). AES uses the same secret key for encrypting and decrypting, operating on fixed 128-bit blocks of data.
5. How Do They Dispose of Physical Documents with PII or PHI?
It’s not just digital data that needs protection in print and mail operations. There could be printed documents that have confidential information. A compliant vendor will have a protocol for removing it, including proper shredding and disposal.
6. Do They Have Audit Trails for Compliance?
There may come a time when your business needs to audit its print and mail compliance. Your partner should be able to generate these reports at any time. They are tracking all the controls and processes in place that ensure compliance adherence.
7. What Data Security Protocols Do They Use?
In addition to encryption, other data security controls should be in place to ensure compliance. The company should have layers of this across its operations, such as:
- User-level security to ensure users only have access to what they need
- Multi-factor authentication to verify those signing into systems
- Proactive cybersecurity initiatives, including penetration testing and vulnerability scanning
- Network segmentation, which restricts communications between areas of the network to limit a breach or disruption
- Firewalls and IPS (Intrusion Prevention System) to keep perimeters safe and monitor network traffic for anything suspicious.
How Can PCI Help with Print and Mail Compliance?
These questions and their answers allow you to compare transactional print and mail companies. You’ll find that PCI Group meets and exceeds expectations on compliance. It’s part of everything we do because it’s the correct and smart way to operate.
If you’re ready to learn more, contact us today for a no-cost consultation.
