Mobile devices are vulnerable just like your network, servers, laptops, and desktops. Your risk analysis should include checking on any types of messages, pictures, or access to your data that can be done on your smartphones. Even if you don't put PHI on them they may be able to be used against you in some way to crack your network and your PHI.

• Android updates and know your version of Android
  • Wipe leaves some stuff on old Android versions
• iOS updates and know your version
  • Windows is so small market share but mention it

• Android
  • Option to encrypt this device
  • Lock screen setting to wipe device after X failed logins
• iOS
  • data protection turns on with password set
    • set to wipe if after X number failed logins

• What is it
• What can you do with it

• Set rules to follow
• Do checks for software updates
• Don't let kids play with phone
• MDM?

If you lose the phone or it dies will you lose important things?  Figure out a backup plan but make sure it is properly secured too.

• Try not to use it unless necessary
• Bluetooth can be used to connect to your phone within 30 feet
• Personal WAN can be used to jump on your connection and use your data plans

Understand this is the new frontier for hackers. Ransomware and malware for smartphones are growing quickly

Let's review email systems and how they can be secured for ePHI and other sensitive data.

Find Healthcare IT

HIPAA For MSPs

Kardon Compliance

Alston Article on Email Security

Leigh from Florida sent us an email asking for us to explain some more specifics about email. She had been listening to Episode 8: HIPAA Myths Part 2 which mentioned it but she had specific questions how can email be secured. This couldn't be covered in a quick 5 minute HIPAA answer episode so we are doing a whole episode. 

Secure messaging systems for internal discussions that don't use email

Texting also matters but that is a different episode we can touch on it here

A word about spear phishing - excellent example this week from a client

ComplyAssistant

FindHealthcareIT

HIPAAforMSPS.com

Kardon Compliance

Culture of compliance is the phrase OCR uses when defining what they are looking for in an audit or investigation. They also use the phrase robust compliance program in the same manner. Using these steps is a great way to make sure your organization is following their lead.

ComplyAssistant Compliance Management Solution 

Spher EHR Access Monitoring Solution

FindHealthcareIT

HIPAAforMSPS.com

Kardon Compliance

7 steps to improving your Privacy & Security policies and procedures and nurturing a Culture of Compliance:

Designate a Compliance (Privacy & Security) OfficerFirst, the law requires you do this. But, if no one is in charge then nothing will happen, we all know that to be the case. Or, in a vacuum of leadership someone else will take charge and handle things the way they think they should be done without the support of management. 

Train and educate your staff and BA partnersConstantly restating the same information over and over in a variety of ways may be annoying to some but that means they have heard it! Also, don't forget to work with your BA partners to confirm they actually understand what HIPAA compliance requires in their organizations.

Implement an ongoing Compliance maintenance solutionThis is what we talk about using tools such as ComplyAssistant, Spher, and professional MSP monitoring and management applications. Either use the tools or develop manual internal controls and processes to accomplish those same documentation and audit tasks on a regular basis. 

Conduct regular and complete audits and monitoring of all ePHI systems If you are ignoring it then so will everyone else in your organization.

Monitor and respond to Incidents in a timely manner (State & Federal regulations)We all freak out together as soon as we know something could havehappened to our PHI.

Adhere to a strict breach remediation protocolDefine your breach plan and use it every time. After any case that it was used, then review it to make sure you don't need to change or add things in the plan.

Create a open line of communication for management and staffThe law requires you to never retaliate towards any person who files a complaint or reports a problem including a breach. If you don't make it clear that you fully support that rule and all workforce members are free to ask any question, file any complaint, and report any concern then you will likely be missing things just because someone was afraid to tell.

In 2014 NIST introduced the National Cybersecurity Framework (CSF). It is designed for all businesses, large and small, to know things they should be doing to protect their businesses, data, customers, and more. Just how does it compare to HIPAA?

NIST Cybersecurity Framework

DHS Getting Started for Small and Midsize Businesses (SMB)

US Chamber of Commerce: Internet Security Essentials for Business 2.0

C3 Voluntary Program: Begin the Conversation: Understand the Threat Environment

FindHealthcareIT

HIPAAforMSPS.com

Kardon Compliance

It's not just HIPAA. All the different guides spell out the same basic concepts.For example:

Cyber Essentials to Protect Your Business: Managing Cyber Risks in a Time of State and Non-State Threats to Business Security and Resilience - Hosted by US Chamber of Commerce

An interview with Ray Ribble discussing the AMS Spher product.  We learn how Spher can automatically "learn" what access patterns are normal and ask you when something isn't right. Your HIPAA compliance requirement to audit access logs may be solved with this tool.  Your very own HIPAA Breach Detection Service!

The AMS SPHER™ Solution

FindHealthcareIT

HIPAAforMSPS.com

Kardon Compliance

SPHER leverages pattern recognition algorithms to determine if there was suspicious behavior on the EHR. It does this by comparing past behaviors to behaviors in the audit log file SPHER is currently reviewing. For example, SPHER may have learned over the past months that an EHR user named John is typically active between 8 AM and 4 PM. In the current audit log file, SPHER notices that John was active on the EHR from 4 PM to 12 midnight which causes SPHER to send you an unusual time of access alert.

You know that John’s shift recently changed from 8 PM to 4 AM. Going through the SPHER incident resolution process, you indicate that this behavior is Normal and Permitted. Based on this feedback, SPHER has now learned that this is normal EHR behavior for John and will not send an alert the next time it sees EHR activity for John during this new time span. As normal behavior on your EHR changes, SPHER learns and does not send false alerts for behaviors you’ve already indicated are normal.

What a HIPAA Risk Analysis includes and why you need it for your cybersecurity risk management.

CIA - Confidentiality, Integrity, Availability

JPP Medical Record

OCR Guidance on Risk Analysis

Training Documentation for this episode

FindHealthcareIT

HIPAAforMSPS.com

Kardon Compliance

Not a simple checklist it requires a lot of thought, data collection, and analysis.

The analysis part

The assessment part

This is your full analysis and assessment report that you will use to inform your decision making process for your security policies and procedures.

It is also the report you will review and update on a regular basis. Sometimes minor updates are needed but other times you will need to do most of the whole thing over if there is a major change in your business.

We have a listener who called in with an example situation to find out what we thought.  Is the company a Business Associate?  Listen to Donna's answer in Episode A2.

These short "answer episodes" are released weekly on Tuesday mornings when we have them come in.

Send us your questions and we will publish them with our thoughts and the best answers we can muster!  

Use the Website form or Speakpipe voicemail  You can also find all our social media contact information at HelpMeWithHIPAA.com.  

A Breach Response plan is a required element of your compliance program since HITECH became effective. Everyone must have a written plan and know what needs to be done.

NIST National Institute of Standards and Technology

NIST SP 800-61 Revision 2 - Computer Security Incident Handling Guide

APDerm Resolution Agreement See item 2(2)

FindHealthcareIT

HIPAAforMSPS.com

Kardon Compliance

Establishing an incident response capability should include the following actions:

How do I get rid of my printers properly?  Find out in HIPAA Answers Episode A1.

Thanks for our listener questions that are coming in!  It took us a bit to work out the best way to get back to you, so sorry for the delay.  

Today we introduce, HIPAA Answers episodes.  These short "answer episodes" will be released weekly on Tuesday mornings.

Send us your questions and we will get them answered.  Lots of ways to contact us below!

Website form or Speakpipe voicemail

Twitter

LinkedIn

Facebook

Google+

Send us an email