It is important for all businesses to review what they have in their employee handbook. If you do not have one, it is imperative that you create one immediately. Employees have rights under certain laws. You could have misinformation that would not hold up in court or land you in a lawsuit. This is not our specialty, but we work with a consulting firm and an attorney that understands this very important area. If you have not addressed them in your handbook we will be glad to put you in touch with one of our resource partners.
In the meantime here are some areas that you should review.
Maternity leave
Free speech rights (NLRB)
Social media
Cell phone use
Off-duty conduct
Paid leave policy
Overtime
FMLA leave and those who are not eligible
Maternity leave
Firearm policy
Whistleblowers
E-cigarettes, tobacco, and marijuana use
Be sure to keep you HIPAA policies and procedures up to date as well!
To find out more about how our automated HIPAA compliance platform can help your organization click here:
In the news nearly daily there is talk about a data breach, a hacking incident, or a cyber crime. Most practices do not think about this until it happens to them, unfortunately it could be devastating. Most experts now state that it is not IF this happens to you, but WHEN. The costs associated with a breach are widespread, see below for some examples.
notification costs (postage, call center, toll free numbers, etc.),
depending on the cause of the breach, you may encounter fines and penalties.
According to the Ponemon Institute, medical breaches are more costly ($408 ) than other small businesses ($148) per record. For example, if you have 5,000 patient records and you can’t determine which of the records were accessed or compromised you must notify all of the patients. That equates to $2,040,000.00. The main cause of data breaches were 48% due to malicious code or criminal attack, 27% due to negligent employees or contractors (business associates), and 25% due to system glitches and business process failures. When it comes to reputation management, this is critical after a breach. Especially in health care since it has the highest rate of churn because patients have more choices.
We are taught to be proactive with our health. We exercise, eat right, and make sure we get enough sleep. We see our physician to make sure our blood work has the correct levels and we have tests performed to catch any early detection of disease.
We should do the same for our business. Just think what would happen to the business side of a medical practice if their data was compromised, stolen, or encrypted. Most small businesses do not survive after a data breach. Here are some helpful hints to protect your practice and your business:
Conduct a network security audit to ensure your network is as secure as possible.
If you do not have an enterprise firewall, add one to your network. Be sure to have custom security policies implemented on your device.
Review all of your computers and be sure to use business operating systems, antivirus/malware, and software.
Work on your Risk Management Plan, understand your vulnerabilities and mitigate them to the best of your ability.
Education. Keeping all staff including the physicians educated on safe computer practices and only permitting work related surfing on company computers. Knowledge about the dangers and consequences of their actions can greatly reduce the chance of a breach.
Make sure the business associates that you use are HIPAA compliant. When you use other companies to assist you, it is the responsibility of the practice to ensure they know how to protect your data.
Invest in cyber liability insurance. Cyber liability insurance covers the cost of notifying patients, data restoration, extortion, and reputation management. It is best to obtain a policy from a knowledgeable agent that specializes in this area since there are many variables in this type of coverage. Also, may sure you read the exclusions. You may not have the coverage you think you do. Many medical malpractice or general liability policies have small token amounts included, this is NOT enough. Review the number of medical records, paper and electronic and insure them accordingly.
To find out more about how our automated HIPAA compliance platform can help your organization click here:
When we conduct HIPAA training most employees are discouraged when we tell them not to surf the web on work computers. There is a very good reason for this… malicious code can be found on websites that have not been updated and maintained properly. Websites, just like any other technology device you use, must be updated and maintained to avoid being hijacked. Website developers sell templates, this makes it very easy to create a website. When vulnerabilities are discovered in the design of the site or one of the plug-ins, updates are pushed out. It is so important that you have a webmaster that stays on top of this! How would you feel if your website was used to infect your web traffic? Image how embarrassing it would be if your patients got a virus or malware from your website?
That brings us to another very important issue when it comes to healthcare; remote users. Home computers are more likely to be infected, in fact 68% of infections were on consumer computers. Are your employees using their own computers at home to access patient data? Was the RDP set up properly? Are the devices properly maintained by an IT professional? Do employees bring their devices from home into your office? Do your employees use their smartphones to connect to your WiFi? These are all areas that need to be reviewed and addressed to ensure your data is not at risk. This is not about restricting employees computer usage because the employer is being unreasonable. This all about protecting your organization from cyber attacks and protecting patient data.
Well educated employees are your best asset and together with proper security you can protect your organization from a data breach. The average data breach cost is $3.8 million and healthcare being one of highest at $380 per patient record. Keep in mind, if you can’t determine which patient records were breached, they are all considered to be breached and are included in the process. Between the cost of the breach and loss of confidence most organizations do not survive past 1 year after a breach.
Our business partner is nationally known and has mitigated some of the largest data breaches. They work with your IT professional to secure your network BEFORE you suffer a data breach. Let us know if you would like a quote on a network security audit.
To find out more about how our automated HIPAA compliance platform can help your organization click here:
As we start this new year we must reflect what we have learned from 2018 in order to make 2019 a success.
The Office for Civil Rights (OCR) has gained momentum in enforcing HIPAA violations. With that said HIPAA is an ongoing process and once is not enough. It is not considered done unless it is documented. At the annual conference this past year, the OCR admitted they are adamant on ensuring your patient’s information is protected. Therefore, you must document your compliance. If you say you did something, they will ask for your documentation. If you do not have documentation, you will be fined.
Companies located in United States are now required to adhere to the General Data Protection Regulation (GDPR) if they market goods and services to citizens of the European Union (EU). You must ensure the security of the data as well as inform visitors to your website how you intend to use their data. This must be clearly written in your privacy notice on website. This is not to be confused with your Notice of Privacy Practices that you give to your patients. If you plan on marketing to visitors from your website, you must offer them a free opt-out option. We could go on in more detail on this subject, but since many medical clinics do not market to international patients, you may contact us for more information.
Here are a few things to review and update as necessary:
Risk analysis and risk management plan, this is your documentation to demonstrate what risks you have (had) and how you have mitigated them or plan to mitigate them.
Replacing or updating any outdated technology, hardware and software require updates from time to time. You can be fined for utilizing outdated hardware/software that is no longer supported by the manufacturer.
Adding a second authentication process for access to ePHI as well as for online personal accounts.
HIPAA training, ensuring your employees understand how to protect your data is also part of this training.
Making sure you have all of the necessary privacy and security policies, procedures, and forms in place. This means reading and dating them to demonstrate they were actually implemented.
Retaining your documentation for the required time limit, including correspondence with patients that are considered to be part of their medical record.
Reviewing your website, determining if your site collects any data and how it is transmitted and stored.
If you see something in your workplace that looks suspicious, tell your HIPAA Compliance Officer, you could be the one to prevent a data breach or stop a data breach from becoming a major breach (over 500 patient records). Keeping data secure is everyone’s business. Being mindful of our surroundings and educating others helps all of us in this crazy world we live in now!
To find out more about how our automated HIPAA compliance platform can help your organization click here:
What do you know about HIPAA enforcement? Just imagine you were investigated by CMS or the OCR, what would they find? How confident are you in your medical and/or HIPAA documentation? Do you have the appropriate documentation to protect your organization?
The Office for Civil Rights (OCR) is very serious about ensuring your organization is educating employees on patient rights and securing PHI. During a recent investigation in Florida an organization was fined $100K for each year they could not produce documented HIPAA training. The first year they only had 3 employees! They were fined for five years, $500K. Once you are under investigation, they review ALL of your documentation, not just what they originally requested. You do not want to end up being in the willful and wanton neglect category. This is where the big fines are calculated.
If you have a patient complaint or suffer a data breach, the best advice is to document, document, AND document! OH, did I mention… DOCUMENT? Next, cooperation. If they ask for something, give it to them. Nothing more, nothing less, but give them what they ask for. Show the OCR you are trying to do the right thing. After all, how would you like it if the information that was compromised was yours? Wouldn’t you want the organization to do what they could to stop the breach or prevent another one from happening?
Remember the MD Anderson in Texas fines? They had multiple devices lost containing unencrypted ePHI. They claimed that they were not obligated to encrypt its devices, and stated that the ePHI that was involved was for “research,” and thus was not subject to the HIPAA non-disclosure requirements. They challenged the OCR and the Judge ruled in favor of the OCR and MD anderson was ordered to pay $4,348,000 in civil money penalties. The quote from OCR Director Roger Severino: “OCR is serious about protecting health information privacy and will pursue litigation, if necessary, to hold entities responsible for HIPAA violations”.
At the NIST/OCR conference in Washington DC, the director along with other members of the OCR staff reminded organizations about enforcement. This is NOT going away. Patient information is extremely valuable to criminals. The days of just a slap on the wrist because you didn’t conduct risk assessment, conduct HIPAA training, or you can’t prove your HIPAA compliance is over. Every organization that has anything to do with patient information must get on board and understand HIPAA. There is NO certificate to prove you are HIPAA compliant, the proof is in your documentation. So I ask one more time… How well do you trust your HIPAA documentation?
To find out more about how our automated HIPAA compliance platform can help your organization click here:
We hear on the news about data breaches almost daily. Some are credit card theft, our personal information being sold, and then are medical data breaches. These are extremely worrisome as this is where identity theft can start. The medical community is a major target for that very reason, medical records are the main source of complete information to steal personal information.
Do you know how many individual patient records have been compromised in 2018?
11,785,675 patient records were reported as breaches to the Office of Civil Right (OCR) in 2018 that were over 500 records per incident. Keep in mind this does NOT include breaches under 500 records.
Plus 944,595 patient records that had been exposed that have already been archived according to the OCR portal.
At the NIST/OCR October conference, they talked about how medical offices use the excuse… “I didn’t know”. They also said that was not an acceptable answer any longer. They can and will fine organizations that are not HIPAA compliant. You are 4 times more likely to get hacked than to have your equipment stolen and this does not even include the breaches caused by unauthorized access. Needless to say data breaches are on the rise no matter what angle you are looking at.
So as we close out 2018 and venture into 2019… You MUST be diligent and keep up to date on the latest technology for data security. You MUST make sure your employees are WELL educated on data security. You MUST document your compliance efforts.
In the words from the Office for Civil Rights, “If it’s not documented, it doesn’t exist”!
Be safe out there in the World Wide Web… it’s a wonderful but dangerous place!
To find out more about how our automated HIPAA compliance platform can help your organization click here:
After attending the Office for Civil Rights (OCR) annual webcast, many things were confirmed that we thought may have been rumors. First of all, medical offices are targets of hacking because you hold everything needed for identity theft.
What is identity theft? Most people think of it as their credit card being stolen, or even their tax returns. True, that is identity theft but there is also another component that is not often talked about. That is, assuming someone else’s identity for health care purposes. Imagine someone assumes your identity and has a surgery and “corrects” your medical record and changes your blood type. Then, you are involved in a car accident and receive a blood transfusion but it’s the WRONG blood. Yes, this can happen. We are not sure how often, but with the rise of medical records being stolen we could see this happen more often. Knowing where your data is located and how it is stored is a starting point in protecting this valuable information. Conducting a risk analysis and having an ongoing risk management is mandatory under HIPAA. During this process you will uncover potential vulnerabilities. Once you mitigate these risks, you may be able to avoid a data breach.
Protecting yourself and your organization is one in the same. Practice these safety tips at work and at home:
Make sure your operating system updates are current as well as your anti-virus and anti-malware.
Scan for viruses and malware after every update.
If you use personal devices to access ePHI or work files, be sure to use enterprise versions of anti-virus and anti-malware. Free versions typically are not robust enough.
NEVER use free Wi-Fi even if you are not accessing any patient information. You could pick up malware from someone that has spoofed the Wi-Fi network that you thought you were logging into.
NEVER click on links within emails that claim to be urgent or a free offer of some type. Typical phishing expeditions start in this manner. After you click, they ask for certain information they are lacking about you or they may ask for everything! Sometimes, this is merely a tactic to get you to go to a certain website and place malware on your computer and you never even know it.
NEVER click on a link within an email asking you to verify your identity. You wouldn’t show a stranger on the street your driver’s license just because they asked to see it, then why would you “verify” your identity with someone invisible in your email? Again, this is how spear phishing starts.
NEVER click on an attachment within an email unless you are expecting it, even if you know the person that sent it. Their email could have been hacked and you are being spoofed into thinking it is from them. This includes messages from FedEx, UPS, and the IRS. Best practices is to open your web browser and go to their website and sign in.
NEVER click on links in text messages unless you are expecting one, such as you just signed up for text messages from a service provider. Bank customers are being spoofed into clicking on links in text messages and taking you to what looks like your bank. Guess what… it’s NOT your bank but looks like it!
I have said this before… the World Wide Web (WWW) is the new Wild Wild West. The only difference is, in the old wild wild west you could see danger coming on the horizon and prepare. The World Wide Web, the dangers are there, but they are invisible.
Be safe out there!
To find out more about how our automated HIPAA compliance platform can help your organization click here:
Just as the eyes are the window to our soul, passwords are the gateway to our inner most kept secrets.
Passwords are used to gain access to YOUR information, but what happens when your passwords are responsible for other people’s information? Did you know that by having your email hacked, you could potential expose not only your personal information but that of others?
Recently, I receive a text from a friend of mine saying “LOL, your email was hacked, just got a fake email from you!” Since she knows that I work in medical offices and with HIPAA compliance, she thought this was funny. However, the problem was, it was HER email that was hacked and they spoofed my address in hopes that she would fall for it. This is just one of the many ways that hackers “get in”. Some hacks start with this type of phishing email that someone falls for, depending on the hackers intentions… the sky’s the limit!
Did you know that a hacker that could get into your email would have the ability to change your access codes to many different resources and you not even know it? Many sites verify your identity through your email address. For instance, if you use the same password across different platforms, once they gain access to your email, they can try that password on other sites. Then they can change YOUR credentials and even change banking information.
So.. what can you do to protect your information and that information that you are responsible for…
Here are some suggestions that you may use. Maybe not all of them, but incorporate as many as you can.
Use STRONG passwords, preferably pass phrases.
Change them at least them at least every 90 days.
Do not share your passwords.
Do not use the same password/phrase phrase across multiple platforms.
Do not reuse the same passwords.
Enable two step authentication wherever offered.
Utilize an encrypted file and copy/paste passwords instead of typing them each time.
Make sure the network that you are accessing information from is secure.
Although nothing in this day is 100% safe, by simply adding a few precautionary measures you can protect yourself and the patient information that you are responsible for as much as possible!
If you would like to schedule a HIPAA training course customized to your facility, or if you need to update any of your HIPAA security needs call 877.659.2467 or complete the contact us form.
“Simplifying HIPAA through Partnership, Education, and Support”
Why are so many medical offices being attacked? Simple, this is a one stop shop for everything needed for identity theft and many medical practices do not have appropriate safeguards in place. Business associates have even been the target or the entry point. HIPAA requires certain security safeguards to be in place to ensure the safety and security of Protected Health Information (PHI).
There have been 188 data breaches of 500 or more patient records in the first 6 months of this year, and in April alone there were 42. Thirteen of the 188 have already been resolved. https://ocrportal.hhs.gov/ocr/breach/breach_report.jsf
These breaches include small medical practices, business associates, and hospitals. Small and large. Paper and electronic. No one is immune. Many organizations think they are too small to get hit, but the fact is the most common problem is untrained staff that unknowingly cause this to happen. Education is the key to avoiding this catastrophe from destroying your reputation. Of course you still need to certain technical safeguards in place, but even then it only takes one click of a mouse to bring your network down.
Here are some areas to consider:
How would you process a data breach?
How would you handle the reputation management of the breach?
How would you pay for the cost of breach and the investigations?
Having a breach notification plan in place before a breach occurs is critical to reducing the damage. You must have processing in place to shut the system down, continue manually, and report to the appropriate authorities.
Consider the lack of trust from your patients since their information was compromised from your office. No matter if it was your fault or that of a business associate this could have a negative impact on your patient database.
Breaches are costly on many fronts, the first being the cost of the notification of the patients, investigations, downtime, and the mitigation of the source of the breach. In 2013 the Ponemon Institute reported that a data breach cost $233 per medical record, now in the 2018 the report states a healthcare breach can cost on average $408 per medical record. https://www.ibm.com/security/data-breach
Keep in mind if you do not know which records were breached then everyone must be included in the notification process. What could turn out to be the most costly is the fines and penalties associated with the breach. Depending on how and when you processed the breach is one determining factor. Also once the investigation is complete, if it is discovered this was an ongoing problem and was not mitigated, then you could be found in willful and wanton neglect. This is NOT a place you want to find yourself! The Office for Civil Rights (OCR) can also fine you for not conducting a thorough enough risk analysis thus leaving vulnerabilities untouched. How well do you trust your efforts in securing your data? Have you conducted a risk assessment to determine if what you have in place is sufficient?
How can Aris help?
First of all we conduct a thorough risk analysis that uncovers vulnerabilities and create a risk management plan so that you can mitigate those risks.
Since written documentation is also part of HIPAA compliance, we provide the necessary privacy and security policies, procedures, and documentation needed for state and federal regulatory requirements.
We also offer HIPAA training that includes privacy and security and any custom requests.
If you are one of the many organizations that simply do not have the time to implement your HIPAA program, we can do that for you as well. Month to month, no long term contracts!
If you would like a free HIPAA checkup call 877.659.2467 or complete the contact us form.
“Simplifying HIPAA through Partnership, Education, and Support”
Whether you work in a medical office or are a business associate, they all rely heavily on the software they use for patient care. The reason software developers send out periodic updates is because more than likely a vulnerability has been discovered and the “patch” or “update” will mitigate the issue. Vulnerabilities come in a variety of types including electronic health records (EHRs), operating systems, custom software, databases, email, and even Java and Adobe Flash. Each program will have its own type of vulnerabilities. Unpatched software poses to a threat to ePHI and updating is required under HIPAA. Routers, phones, servers, and even some refrigerators have firmware that must be updated as well.
When discussing routers, it is important to mention that all routers come with default settings, including a username and password. These must be changed, otherwise they can be hacked. Routers also need to be rebooted or reset sometimes, depending on the type of vulnerability that has surfaced. Malware can infect not only your phone and computers, but also your router. It is imperative that you have an experienced IT professional that is current on these issues. Long gone are the days of plug and play. Although it is not difficult to set up a computer or a network, securing it is a whole new game.
Even if you utilize a cloud based system, the devices you use to access your system can be compromised. If you haven’t done so already, you should invest in a qualified IT vendor that will secure and monitor your computers and network. The data that your patients have entrusted you with is sought after in many areas. It is required under HIPAA to have reasonable and appropriate safeguards in place, but besides that… it’s the right thing to do!
For more information on how Aris Medical Solutions can help your organization with HIPAA Compliance and Protecting your Data call 877.659.2467.
“Simplifying HIPAA through Partnership, Education, and Support”
