"Fiduciaries ... must: [1] Act prudently in responding to a breach of their plan participants' [protected health information (PHI)] and [personally identifiable information (PII)]. [2] Consider developing prudent policies and procedures for handling, collection, transmission, security and storage of all PII, data, and PHI. [3] Consider developing third-party procedures and notification and remediation measures for breaches of their plan participants PHI and PII.... This Note provides guidance for plan fiduciaries of retirement plans to develop prudent policies and procedures to secure information and data."  MORE >>