Help Me With Hipaa

Everyone is ready for the great deals retailers offer on Black Friday and Cyber Monday. We have a list of low-cost and no-cost deals on HIPAA Security & Privacy tools for you!  Episode 29: HIPAA Black Friday Sale More details at helpmewithhipaa.com/29

The Internet of Things (IoT) is already here, it isn't something that is coming. It is here and it is the future, it will just become more prominent in our daily lives.

If you expect your IT company to do certain things as a HIPAA compliant vendor you are more likely to have the level of support you need.  If you don't ask then they may not be fully aware of what you need or what it requires to be HIPAA compliant themselves.

We review the latest OCR settlement CAP details.

This week we get in the Halloween spirit and share some scary stories that make you have those compliance nightmares.

Description Business Associates and required BAAs are discussed often but not resolved quickly. Let's talk about some ideas and issues that go with BAAs. Links FindHealthcareIT HIPAAforMSPS.com Kardon Compliance Notes Who is a BA? A business partner who provides a service to a CE or BA that requires them to CReMaT PHI. Anyone with persistent access to ePHI whether they do anything with it or not is irrelevant - the fact that they CAN do things is what matters. Complexity is increasing Dietitians at hospital needs info on the scripts for the diet but the employer never stores, accesses, or has persistent access to it but the workforce needs to see it. CE should train them on Privacy rules.BA means it is not your data but you have it or have access to it from the owner of CE. Medical director could be a BA or could be workforce member depending on the contract they have with the employer. ACO formed by hospital as a completely separate legal entity But the ACO is staffed by hospital employees Plus the h

Description We explained the concepts of encryption in Episode 2: Let’s Talk Encryption but people continue to ask more about what they really need to do with encryption. Links FindHealthcareIT HIPAAforMSPS.com Kardon Compliance Episode 2: Let’s Talk Encryption The government and privacy advocates can’t agree on what ‘strong’ encryption even means Notes First, what can encryption do for you and what it can't do for you. VPN, HTTPS, SSL, SFTP, etc. Protect communications from prying eyes. Everything else is about encrypting data on the devices themselves. If you encrypt data on a device but you are hacked when you are logged into the device, encryption isn't too helpful. Encryption is helpful when someone tries to access the data on the device without your key (or password). Strong Encryption is also subjective - there is no solid authority on what is really strong encryption because law enforcement wants a back door. What does HIPAA say about encryption? Encryption (Addressable). Implement a mechanism to en

Cybersecurity coverage being challenged in court has some important points that all businesses should consider. Links FindHealthcareIT HIPAAforMSPS.com Kardon Compliance Help Me With HIPAA  Notes COLUMBIA CASUALTY COMPANY v. COTTAGE HEALTH SYSTEM Data breach occurred Breach announcement said: Between October 8, 2013 and December 2, 2013, PHI of approximately 32,500 patients on the CEs servers weredisclosed to the public via the internet. Hospital got voicemail message from a third party, who informed it that he was able to read the PHI online. Patients seen Sept. 29, 2009, to Dec. 2, 2013 included names, addresses, DOB, MR#, Acct#, diag, lab results and procedures performed. No financial information or Social Security numbers were involved Insync, their IT vendor at the time, left anonymous access for FTP traffic active on an internet servers on or about Oct. 8, 2012. The change allowed ePHI to become available to the public via Google's internet search engine. The server was taken offline immediately on Dec

Show Notes If they were shocked that no one was actually watching for security holes at Ashley Madison you can bet they will be shocked that you haven't been looking because Healthcare is supposed to be private. Ashley Madison: Nobody was watching Top 10 Tech Companies with Ashley Madison Accounts What kinds of things do you need to do to actually be considered looking for them, though? HIPAA Compliant IT Router / Firewall test showed 600% Increase in Unique Vulnerabilities Discovered Last Year (OCR / NIST conference) Within hours or days of a release of software (firmware) vulnerabilities will be identified. Keep firmware up-to-date UTM - what is a UTM not just a router off the shelf at best buy IPS Antivirus Support Subscription! Reporting each month - look at what is going on - if you have IT they can do it but you should be asking them for reports. Printers / Copiers easy for hackers to get to first Smart TVs Patching helps when Hackers Start with "low hanging fruit"  Beginning hackers look for

Show Notes When it comes to securing anything the weakest link in the chain is always people.  People are the ones who make mistakes, over-share, and are also the criminals.  This episode talks about what people can manage to do so you have to think of all kinds of things outside the norm. University of Pittsburgh MC BA breach after being hacked the year beforeEmployee of the billing service call center copied personal information from the billing system. 2,259 patients were then passed on to a third-party. Notification that it happened came from FBI. Last year UPMC was hacked and employee information taken for all 62,000 employees. Over 800 employees reported ID theft. Oakwood Healthcare worker fired for HIPAA-violating Facebook commentsTerminated after posting disparaging comments about a patient on her Facebook page. Worked at a hospital that had to treat a suspect in a police shooting. Her posts were pointing out her disgust in having to treat him. It is still a violation. Roanoke, Va. Carilion Clinic - 1

Mobile devices are vulnerable just like your network, servers, laptops, and desktops. Your risk analysis should include checking on any types of messages, pictures, or access to your data that can be done on your smartphones. Even if you don't put PHI on them they may be able to be used against you in some way to crack your network and your PHI. Patches Android updates and know your version of Android Wipe leaves some stuff on old Android versions iOS updates and know your version Windows is so small market share but mention it Encryption Android Option to encrypt this device Lock screen setting to wipe device after X failed logins iOS data protection turns on with password set set to wipe if after X number failed logins MDM - Mobile Device Management What is it What can you do with it BYOD - Bring Your Own Device Set rules to follow Do checks for software updates Don't let kids play with phone MDM? Backup If you lose the phone or it dies will you lose important things?  Figure out a ba

Let's review email systems and how they can be secured for ePHI and other sensitive data. Find Healthcare IT HIPAA For MSPs Kardon Compliance Alston Article on Email Security   Notes Leigh from Florida sent us an email asking for us to explain some more specifics about email. She had been listening to Episode 8: HIPAA Myths Part 2 which mentioned it but she had specific questions how can email be secured. This couldn't be covered in a quick 5 minute HIPAA answer episode so we are doing a whole episode.  How does email work - for "real people" to understand Compare to the post office since that is the way it was originally modeled to match Why that isn't secure at all, really http://www.healthcareitnews.com/news/hipaa-breach-letters-go-out-after-email-hack (article on email hacked and it had patient info in it) open transmissions and many different servers Misconceptions I use a password so it is secure I use https so it is secure I use TLS so it is secure I use updated Outlook with Hosted Exchange so

Links ComplyAssistant FindHealthcareIT HIPAAforMSPS.com Kardon Compliance Notes Who is Gerry Blass Been in healthcare for the long ride Consultant for years Now consultant and software company ComplyAssistant - when did you start development and what was your vision for it? What kinds and size of clients do you have - hospital, practices, BAs and CEs of all types ComplyAssistant features  Due Diligence for BAs Contract management Incident Management Project Management Documentation, Documentation, Documentation Management Importance of having a documentation and management system of some sort in place Why ComplyAssistant instead of using a spreadsheet / folder approach?

Culture of compliance is the phrase OCR uses when defining what they are looking for in an audit or investigation. They also use the phrase robust compliance program in the same manner. Using these steps is a great way to make sure your organization is following their lead. Links ComplyAssistant Compliance Management Solution  Spher EHR Access Monitoring Solution FindHealthcareIT HIPAAforMSPS.com Kardon Compliance Notes 7 steps to improving your Privacy & Security policies and procedures and nurturing a Culture of Compliance: Designate a Compliance (Privacy & Security) OfficerFirst, the law requires you do this. But, if no one is in charge then nothing will happen, we all know that to be the case. Or, in a vacuum of leadership someone else will take charge and handle things the way they think they should be done without the support of management.  Train and educate your staff and BA partnersConstantly restating the same information over and over in a variety of ways may be annoying to some but tha

In 2014 NIST introduced the National Cybersecurity Framework (CSF). It is designed for all businesses, large and small, to know things they should be doing to protect their businesses, data, customers, and more. Just how does it compare to HIPAA? Notes NIST Cybersecurity Framework DHS Getting Started for Small and Midsize Businesses (SMB) US Chamber of Commerce: Internet Security Essentials for Business 2.0 C3 Voluntary Program: Begin the Conversation: Understand the Threat Environment FindHealthcareIT HIPAAforMSPS.com Kardon Compliance Notes It's not just HIPAA. All the different guides spell out the same basic concepts.For example: NIST - Cybersecurity Framework US Chamber of Commerce: Internet Security Essentials for Business 2.0 STRONG SECURITY IS SMART FOR BUSINESS AND THE NATION COMMON THREATS TO BUSINESS INFORMATION Hacking and Malware Lost or Stolen Physical Storage Media Insider Threat and Human Error Accidents and Natural Disasters CYBERCRIME ON THE RISEINTERNET SAFETY AND SECURITY FUNDAMENTALS Se

An interview with Ray Ribble discussing the AMS Spher product.  We learn how Spher can automatically "learn" what access patterns are normal and ask you when something isn't right. Your HIPAA compliance requirement to audit access logs may be solved with this tool.  Your very own HIPAA Breach Detection Service! Links The AMS SPHER™ Solution FindHealthcareIT HIPAAforMSPS.com Kardon Compliance Notes Who is AMS and Ray Ribble? Tell us about The AMS SPHER™ Solution. Behaviorial Analytics SPHER leverages pattern recognition algorithms to determine if there was suspicious behavior on the EHR. It does this by comparing past behaviors to behaviors in the audit log file SPHER is currently reviewing. For example, SPHER may have learned over the past months that an EHR user named John is typically active between 8 AM and 4 PM. In the current audit log file, SPHER notices that John was active on the EHR from 4 PM to 12 midnight which causes SPHER to send you an unusual time of access alert. It Learns! You know that John

Description What a HIPAA Risk Analysis includes and why you need it for your cybersecurity risk management. Glossary CReMaT'ed - Create, Receive, Maintain, Transmit CIA - Confidentiality, Integrity, Availability Links JPP Medical Record OCR Guidance on Risk Analysis Training Documentation for this episode FindHealthcareIT HIPAAforMSPS.com Kardon Compliance Notes Not a simple checklist it requires a lot of thought, data collection, and analysis. The analysis part Define where e-PHI is CReMaT'ed in your organization. Not just the server that holds the EMR.   Cloud apps used, messaging tools, mobile devices, USB storage devices, home computers Practice Management system and data analysis tools Don't forget to include downloads folders and temp folders on all PCs. Do you need to worry about vendors or consultants - your BAs that may move data around your network, systems, etc. If they handle it for you do you even know where it is going? What are the threats to the CIA of the PHI that you have located an

We have a listener who called in with an example situation to find out what we thought.  Is the company a Business Associate?  Listen to Donna's answer in Episode A2. These short "answer episodes" are released weekly on Tuesday mornings when we have them come in. Send us your questions and we will publish them with our thoughts and the best answers we can muster!   Use the Website form or Speakpipe voicemail  You can also find all our social media contact information at HelpMeWithHIPAA.com.    

Description A Breach Response plan is a required element of your compliance program since HITECH became effective. Everyone must have a written plan and know what needs to be done. Glossary NIST National Institute of Standards and Technology Links NIST SP 800-61 Revision 2 - Computer Security Incident Handling Guide APDerm Resolution Agreement See item 2(2) FindHealthcareIT HIPAAforMSPS.com Kardon Compliance Notes Establishing an incident response capability should include the following actions: Creating an incident response policy and plan Written required - already had an OCR resolution that mentioned not having one (APDerm - $150,000) Developing procedures for performing incident handling and reporting Who is your "go to" team for forensics Setting guidelines for communicating with outside parties regarding incidents PR will be critical for reputation managment Selecting a team structure and staffing model Someone has to be in charge of the whole thing and then others in charge of the parts. E

How do I get rid of my printers properly?  Find out in HIPAA Answers Episode A1. Thanks for our listener questions that are coming in!  It took us a bit to work out the best way to get back to you, so sorry for the delay.   Today we introduce, HIPAA Answers episodes.  These short "answer episodes" will be released weekly on Tuesday mornings. Send us your questions and we will get them answered.  Lots of ways to contact us below! Website form or Speakpipe voicemail Twitter LinkedIn Facebook Google+ Send us an email