Help Me With HIPAA

When it comes to securing anything the weakest link in the chain is always people. People are the ones who make mistakes, over-share, and are also the criminals. This episode talks about what people can manage to do so you have to think of all kinds of things outside the norm.

University of Pittsburgh MC BA breach after being hacked the year beforeEmployee of the billing service call center copied personal information from the billing system. 2,259 patients were then passed on to a third-party. Notification that it happened came from FBI. Last year UPMC was hacked and employee information taken for all 62,000 employees. Over 800 employees reported ID theft.

Oakwood Healthcare worker fired for HIPAA-violating Facebook commentsTerminated after posting disparaging comments about a patient on her Facebook page. Worked at a hospital that had to treat a suspect in a police shooting. Her posts were pointing out her disgust in having to treat him. It is still a violation.

Roanoke, Va. Carilion Clinic - 14 employees admitted snooping Found it by random log reviews. Previously, only checked on patients where a big new story was happening.

Physician Suffers Second 2015 Data Breach Break-in in Jan requires breach notification to 350 patients. Break-in again in March they got computers and patient charts. The computers were not encrypted and they had patient info OTHER THAN THE LETTERS to the 350 patients. This time the total patients involved are 1,342. At this point they hire a security guard who stops a third break-in. The doctor is moving their office to a new town. Encryption could have saved a lot here, increased security after the first break-in would be the most obvious requirement. That is a simple decision that was just not made. Now over 4 times the number of patients are involved.

Doctor convicted of illegally accessing medical records Doctor having an affair and looked at the mistress' medical records. Looking to see if she had STDs. Plead guilty in federal court and kept his license but must be monitored.

Medical is years and years behind other industries on security requirements and criminals are figuring that out. Plus, those that are way ahead are getting breaches like Home Depot, Target, and more. In all those cases there was a person somewhere involved in the process, in some cases several people made mistakes are took the wrong action.

Mobile devices are vulnerable just like your network, servers, laptops, and desktops. Your risk analysis should include checking on any types of messages, pictures, or access to your data that can be done on your smartphones. Even if you don't put PHI on them they may be able to be used against you in some way to crack your network and your PHI.

• Android updates and know your version of Android
  • Wipe leaves some stuff on old Android versions
• iOS updates and know your version
  • Windows is so small market share but mention it

• Android
  • Option to encrypt this device
  • Lock screen setting to wipe device after X failed logins
• iOS
  • data protection turns on with password set
    • set to wipe if after X number failed logins

• What is it
• What can you do with it

• Set rules to follow
• Do checks for software updates
• Don't let kids play with phone
• MDM?

If you lose the phone or it dies will you lose important things? Figure out a backup plan but make sure it is properly secured too.

• Try not to use it unless necessary
• Bluetooth can be used to connect to your phone within 30 feet
• Personal WAN can be used to jump on your connection and use your data plans

Understand this is the new frontier for hackers. Ransomware and malware for smartphones are growing quickly

Let's review email systems and how they can be secured for ePHI and other sensitive data.

Find Healthcare IT

HIPAA For MSPs

Kardon Compliance

Alston Article on Email Security

Leigh from Florida sent us an email asking for us to explain some more specifics about email. She had been listening to Episode 8: HIPAA Myths Part 2 which mentioned it but she had specific questions how can email be secured. This couldn't be covered in a quick 5 minute HIPAA answer episode so we are doing a whole episode.

• How does email work - for "real people" to understand
  • Compare to the post office since that is the way it was originally modeled to match
• Why that isn't secure at all, really
  • http://www.healthcareitnews.com/news/hipaa-breach-letters-go-out-after-email-hack (article on email hacked and it had patient info in it)
  • open transmissions and many different servers
• Misconceptions
  • I use a password so it is secure
  • I use https so it is secure
  • I use TLS so it is secure
  • I use updated Outlook with Hosted Exchange so that should be secure
• Secure email via
  • End to end encryption tools - each party knows the key
  • Messaging system - you get an email telling you to log in to get the secure email
  • Hosted services that allow for specific types of messaging
    • Hosted exchange
    • Plug-in apps
  • Secured internal only messaging systems
    • Very specific set up to secure the mail database on your internal server
    • Controls you have in place to prevent email to other domains outside the secure system (usually software required)
    • Some systems are automatic encryption / others require you to hit a button on the mail to send it secured.

• Secure messaging systems for internal discussions that don't use email

  • whole new way of communications in forums / chats instead of email

• Texting also matters but that is a different episode we can touch on it here

• A word about spear phishing - excellent example this week from a client

ComplyAssistant

FindHealthcareIT

HIPAAforMSPS.com

Kardon Compliance

• Who is Gerry Blass
  • Been in healthcare for the long ride
  • Consultant for years
  • Now consultant and software company
• ComplyAssistant - when did you start development and what was your vision for it? What kinds and size of clients do you have - hospital, practices, BAs and CEs of all types
• ComplyAssistant features
  • Due Diligence for BAs
  • Contract management
  • Incident Management
  • Project Management
  • Documentation, Documentation, Documentation Management
• Importance of having a documentation and management system of some sort in place
  • Why ComplyAssistant instead of using a spreadsheet / folder approach?

Culture of compliance is the phrase OCR uses when defining what they are looking for in an audit or investigation. They also use the phrase robust compliance program in the same manner. Using these steps is a great way to make sure your organization is following their lead.

ComplyAssistant Compliance Management Solution

Spher EHR Access Monitoring Solution

FindHealthcareIT

HIPAAforMSPS.com

Kardon Compliance

7 steps to improving your Privacy & Security policies and procedures and nurturing a Culture of Compliance:

1. Designate a Compliance (Privacy & Security) OfficerFirst, the law requires you do this. But, if no one is in charge then nothing will happen, we all know that to be the case. Or, in a vacuum of leadership someone else will take charge and handle things the way they think they should be done without the support of management.

2. Train and educate your staff and BA partnersConstantly restating the same information over and over in a variety of ways may be annoying to some but that means they have heard it! Also, don't forget to work with your BA partners to confirm they actually understand what HIPAA compliance requires in their organizations.

3. Implement an ongoing Compliance maintenance solutionThis is what we talk about using tools such as ComplyAssistant, Spher, and professional MSP monitoring and management applications. Either use the tools or develop manual internal controls and processes to accomplish those same documentation and audit tasks on a regular basis.

4. Conduct regular and complete audits and monitoring of all ePHI systems If you are ignoring it then so will everyone else in your organization.

5. Monitor and respond to Incidents in a timely manner (State & Federal regulations)We all freak out together as soon as we know something could havehappened to our PHI.

6. Adhere to a strict breach remediation protocolDefine your breach plan and use it every time. After any case that it was used, then review it to make sure you don't need to change or add things in the plan.

7. Create a open line of communication for management and staffThe law requires you to never retaliate towards any person who files a complaint or reports a problem including a breach. If you don't make it clear that you fully support that rule and all workforce members are free to ask any question, file any complaint, and report any concern then you will likely be missing things just because someone was afraid to tell.

In 2014 NIST introduced the National Cybersecurity Framework (CSF). It is designed for all businesses, large and small, to know things they should be doing to protect their businesses, data, customers, and more. Just how does it compare to HIPAA?

NIST Cybersecurity Framework

DHS Getting Started for Small and Midsize Businesses (SMB)

US Chamber of Commerce: Internet Security Essentials for Business 2.0

C3 Voluntary Program: Begin the Conversation: Understand the Threat Environment

FindHealthcareIT

HIPAAforMSPS.com

Kardon Compliance

It's not just HIPAA. All the different guides spell out the same basic concepts.For example:

• NIST - Cybersecurity Framework
• US Chamber of Commerce: Internet Security Essentials for Business 2.0
  • STRONG SECURITY IS SMART FOR BUSINESS AND THE NATION COMMON THREATS TO BUSINESS INFORMATION
  • Hacking and Malware
  • Lost or Stolen Physical Storage Media
  • Insider Threat and Human Error
  • Accidents and Natural Disasters
  • CYBERCRIME ON THE RISEINTERNET SAFETY AND SECURITY FUNDAMENTALS
  • Set Up a Secure System
  • Protect Business Data
  • Train Your Workforce
  • Be Prepared
  • ADD BUSINESS VALUE THROUGH INFORMATION SECURITY
  • NATIONAL AND PRIVATE SECTOR PERSPECTIVES

Cyber Essentials to Protect Your Business: Managing Cyber Risks in a Time of State and Non-State Threats to Business Security and Resilience - Hosted by US Chamber of Commerce

• FBI - Deputy Director
• DHS - Undersecretary for Cybersecurity
• Secret Service - Atlanta Office Cybersecurity Team
• Army Lt Col - Cybersecurity Command

An interview with Ray Ribble discussing the AMS Spher product. We learn how Spher can automatically "learn" what access patterns are normal and ask you when something isn't right. Your HIPAA compliance requirement to audit access logs may be solved with this tool. Your very own HIPAA Breach Detection Service!

The AMS SPHER™ Solution

FindHealthcareIT

HIPAAforMSPS.com

Kardon Compliance

SPHER leverages pattern recognition algorithms to determine if there was suspicious behavior on the EHR. It does this by comparing past behaviors to behaviors in the audit log file SPHER is currently reviewing. For example, SPHER may have learned over the past months that an EHR user named John is typically active between 8 AM and 4 PM. In the current audit log file, SPHER notices that John was active on the EHR from 4 PM to 12 midnight which causes SPHER to send you an unusual time of access alert.

You know that John’s shift recently changed from 8 PM to 4 AM. Going through the SPHER incident resolution process, you indicate that this behavior is Normal and Permitted. Based on this feedback, SPHER has now learned that this is normal EHR behavior for John and will not send an alert the next time it sees EHR activity for John during this new time span. As normal behavior on your EHR changes, SPHER learns and does not send false alerts for behaviors you’ve already indicated are normal.

What a HIPAA Risk Analysis includes and why you need it for your cybersecurity risk management.

CIA - Confidentiality, Integrity, Availability

JPP Medical Record

OCR Guidance on Risk Analysis

Training Documentation for this episode

FindHealthcareIT

HIPAAforMSPS.com

Kardon Compliance

Not a simple checklist it requires a lot of thought, data collection, and analysis.

The analysis part

• Define where e-PHI is CReMaT'ed in your organization.
  • Not just the server that holds the EMR.
  • Cloud apps used, messaging tools, mobile devices, USB storage devices, home computers
  • Practice Management system and data analysis tools
  • Don't forget to include downloads folders and temp folders on all PCs.
• Do you need to worry about vendors or consultants - your BAs that may move data around your network, systems, etc.
  • If they handle it for you do you even know where it is going?
• What are the threats to the CIA of the PHI that you have located and identified above?
  • Human
  • Natural
  • Environmental
• What would be the impact to your business if the threat did act against your PHI?
  • Would it be a bump in the road or a sinkhole?
• What is the likelihood this threat will actually act against your PHI?
  • Very likely down to not likely at all
• With all this considered what level risk do you think this threat creates to your PHI?
  • High, Medium, or Low
• Based on everything you know then you decide what you are going to do about the threat and the risk it presents?
  • Accept the risk is just part of doing business
  • Address the risk with some type of safeguards in your organization
  • Outsource the risk by hiring another company to handle managing it for you

The assessment part

• At this point, you review that plan you have just made to address risks against what you are actually doing
  • Are doing everything you can to protect the PHI and meet your obligations under HIPAA laws from all those threats?
  • If you are outsourcing threat management, have you made sure your BAAs are in order?
  • If you are handling it internally do you have all the written policies and procedures
  • Is your staff trained to respond accordingly?
• Once you complete that process you draw up your final report on what was determined during your analysis and assessment.
  • What actions need to take place to address those threats and what priority should be applied to them?

This is your full analysis and assessment report that you will use to inform your decision making process for your security policies and procedures.

It is also the report you will review and update on a regular basis. Sometimes minor updates are needed but other times you will need to do most of the whole thing over if there is a major change in your business.

We have a listener who called in with an example situation to find out what we thought. Is the company a Business Associate? Listen to Donna's answer in Episode A2.

These short "answer episodes" are released weekly on Tuesday mornings when we have them come in.

Send us your questions and we will publish them with our thoughts and the best answers we can muster!

Use the Website form or Speakpipe voicemail You can also find all our social media contact information at HelpMeWithHIPAA.com.

A Breach Response plan is a required element of your compliance program since HITECH became effective. Everyone must have a written plan and know what needs to be done.

NIST National Institute of Standards and Technology

NIST SP 800-61 Revision 2 - Computer Security Incident Handling Guide

APDerm Resolution Agreement See item 2(2)

FindHealthcareIT

HIPAAforMSPS.com

Kardon Compliance

Establishing an incident response capability should include the following actions:

• Creating an incident response policy and plan
  • Written required - already had an OCR resolution that mentioned not having one (APDerm - $150,000)
• Developing procedures for performing incident handling and reporting
  • Who is your "go to" team for forensics
• Setting guidelines for communicating with outside parties regarding incidents
  • PR will be critical for reputation managment
• Selecting a team structure and staffing model
  • Someone has to be in charge of the whole thing and then others in charge of the parts.
• Establishing relationships and lines of communication between the incident response team and other groups, both internal (e.g., legal department) and external (e.g., law enforcement agencies)
  • Bigger organizations need to know who is responsible for talking with each department.
• Determining what services the incident response team should provide
  • How far is the team going through the process? Will they pass off follow up or will they do all the activity required from beginning to end. Again, large organizations need to worry about this.
• Staffing and training the incident response team
  • Make a written list and have the team meet regularly to review how to respond to any incident that may come up in the organization.