April 19, 2021

Volume XI, Number 109

Advertisement

April 16, 2021

Subscribe to Latest Legal News and Analysis

Do You Have a Backup Payroll Plan?

What do you do if your HR benefits and payroll vendor suffers a cyber-attack and payroll can’t be run? Do you have a backup plan for running payroll? How will you communicate with your employees? And if your benefits and payroll vendor has a cyber-incident and your employees’ highly sensitive data is exfiltrated, what will be your response and your liability?

Here is a perfect tabletop exercise that is real.

This week, it is being reported that PrismHR (which provides online payroll, benefits and human resources services to professional employer organizations offering those services to small businesses) suffered a cyber-attack over the weekend that caused outages to its systems. Although there is speculation that PrismHR was the victim of a ransomware attack, it has not confirmed that is the case, only that it suffered a cyber incident.

PrismHR stated that it is looking into the incident and that payroll will not be affected this week, and that it is waiving administrative fees for the current payroll period. Obviously, depending on the results of the investigation and whether any employee data were accessed or exfiltrated, PrismHR might have reporting obligations, including to its customers and their employees.

Whatever the outcome, the scenario is a perfect tabletop exercise to plan for and determine the risk and consequences for your organization. HR, payroll, and benefits vendors collect, maintain, use, and disclose highly sensitive data of employees, so managing the risk through security due diligence and strong contractual provisions is crucial for your risk management plan.

Advertisement
Copyright © 2021 Robinson & Cole LLP. All rights reserved.National Law Review, Volume XI, Number 63
Advertisement
Advertisement

TRENDING LEGAL ANALYSIS

Advertisement
Advertisement

About this Author

Linn F. Freedman, Robinson Cole Law Firm, Cybersecurity and Litigation Law Attorney, Providence
Partner

Linn Freedman practices in data privacy and security law, cybersecurity, and complex litigation. She provides guidance on data privacy and cybersecurity compliance to a full range of public and private clients across all industries, such as construction, education, health care, insurance, manufacturing, real estate, utilities and critical infrastructure, marine, and charitable organizations. Linn is a member of the firm's Business Litigation Group and chairs its Data Privacy + Cybersecurity Team. She is also a member of the Financial Services Cyber-Compliance Team (CyFi ...

401-709-3353
Advertisement
Advertisement