Help Me With HIPAA

This week is basically part 2 from last week. We left off just before reviewing the OCR audits and enforcement updates announced at the NIST / OCR Security Conference 2016.

Get more details at HelpMeWithHIPAA.com/79

Donna shares information from the 2016 NIST/OCR Annual Conference on Safeguarding Healthcare Information.

Learn what she thought was interesting to share with you.

More information at https://HelpMeWithHIPAA.com/78

We tour the HIPAA haunted house in this year's Halloween episode!

Cybersecurity has become a big concern over the last 18 months. Breaches in 2015 have given way to ransomware along with more daring breaches in 2016. What is really happening on your computers, networks, and the Internet every second is terrifying in several ways. There are plenty of amazing and good things happening at the speed of light but so are the bad ones.....

For more details go to HelpMeWithHIPAA.com/77

Ransomware and HIPAA have been a topic on the podcast multiple times. They are some of our most popular episodes, in fact. Recently, we realized we haven't discussed the OCR guidance on ransomware and HIPAA. On July 11, 2016, HHS.gov featured a new post from Jocelyn Samuels the Director of the Office for Civil Rights (OCR). The title is catchy: Your Money or Your PHI: New Guidance on Ransomware.

This episode is a review of that post and the fact sheet with OCR guidance on ransomware and HIPAA that the post announced.

.

For more information http://HelpMeWithHIPAA.com/76

Everything going on today with hurricanes and such makes it is a great time to talk about this. We mention it all the time but this episode is going to be just about what DR/BC means and what you can do to be prepared in advance. So, this episode covers disaster recovery planning under HIPAA but any business can learn from our topics!

• What is DR/BC Planning?
• Who should do it?
• Is this another big expense?
• What is involved in building and maintaining DR/BC plans?
• General elements of a plan

Get more details at http://HelpMeWithHIPAA.com/75

Last year Sen. Lamar Alexander and Sen. Patty Murray asked for answers to some questions concerning cybersecurity in healthcare. They were interested in understanding what CMS and HHS were doing to protect patients from fraud. It seems as though they were wondering if HIPAA security updates where needed.

We discussed the Senators request in episode 31 : https://helpmewithhipaa.com/episode-31-enforcement-efforts-ocr-increase-2016/

Their letter asked:

• What CMS and HHS is doing to monitor medical identity fraud
• What is CMS and/or OCR actually doing, if anything, to track cases of ID theft and fraud
• OCR uses the data collected from covered-entities to monitor potential breach victims and find out if their data have in fact been used by criminals
• They also want to know whether any education materials or help are offered to breach victims by the CMS and OCR

The report was presented to the committee on August 6, 2016 and made public on Sept 26.

BAs are in the HIPAA spotlight now more than ever.

• TheDarkOverlord was clearly using some BA applications to infiltrate networks and exfiltrate PHI.
• OIG reviewed Alaska VA system after breaches and the report specifically points to the need to monitor BAs
• OCR audits of BAs are about to start. Previously said end of September but now saying October

In this episode we discuss what all this means.

More at HelpMeWithHIPAA.com/73

Did you hear that maximum penalties for HIPAA violations are being adjusted for inflation? It has quietly happened. Here is how.

Check out the Federal Register entry from September 6, 2016. If you aren't in to reading yourself, don't worry, you know Donna did it. Well, at least the HIPAA parts.

Learn more at: HelpMeWithHIPAA.com/72

OCR recently released another memo concerning compliance enforcement efforts. They say effective August 2016, they have started an initiative to more widely investigate breaches involving under 500 patients. That means that OCR small breach investigations will begin happening immediately. In the past, the policy had been to investigate all breaches over 500 patients but not under.

More information at HelpMeWithHIPAA.com/71

OCR published a memo on Aug 1, 2016. The title is "Do you know who your employees are?". It is a great reminder about insider threats that we should all worry about regularly.

Quoted directly from the memo. ============================ Although all insider threats are not malicious or intentional, the effect of these threats can be damaging to a Covered Entity and Business Associate and have a negative impact on the confidentiality, integrity, and availability of its ePHI.

According to a survey recently conducted by Accenture and HfS Research, 69% of organization representatives surveyed had experienced an insider attempt or success at data theft or corruption. Further, it was reported by a Covered Entity that one of their employees had unauthorized access to 5,400 patient's ePHI for almost 4 years.

For more visit: HelpMeWithHIPAA.com/70