Upload File

hipaa and cybersecurity best practices · security risk analysis (sra) – healthit services §...

  • Home
  • Documents
  • HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk
32
HIPAA and Cybersecurity Best Practices and Lessons Learned

Upload: others

Post on 13-Jul-2020

4 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

HIPAAandCybersecurityBestPracticesandLessonsLearned

Page 2: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 2

Speakers

MollieMcCammon,RHIA,CHPOutreachSpecialist,AFMCHealthIT

WinnieAlobuia,RHIAHIPAASRASpecialist,AFMCHealthIT

TobyEdwards,CCFE,MSCybersecuritySecurityRiskAssessor,AFMCIT

Page 3: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 3

TopicsofDiscussion

§ CommonHIPAArisksandvulnerabilitiesandhowtoavoidthem

§ Cybersecurity

§ 2016onsiteriskassessmentresultsandlessonslearned

§ SecurityRiskAnalysis(SRA)– HealthIT services

Page 4: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 4

ExposedRecordsandDataBreachintheU.S.from2005to2016

Imageviastatista.com https://www.statista.com/statistics/273550/data-breaches-recorded-in-the-united-states-by-number-of-breaches-and-records-exposed/

Page 5: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 5

2017“WallofShame”ListContinuestoGrow– AHIMA

§ BreachesreportedtoHHSOCRfromthebeginningoftheyeartoMarch22include:• 66newreportsaffecting500ormoreindividuals• About440,000individualshavebeenaffectedby2017breachesalone• Over170millionindividualshavebeenaffectedsincebreachreportingbeganin2009

§ Typesofbreaches:• Unauthorizedaccess/disclosure:41%• Hacking/ITincident:27%• Theft:23%• Loss:6%• Improperdisposal:3%

‘WallofShame’ListContinuestoGrow.JournalofAHIMAMay,2017

Page 6: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 6

CommonHIPAARisksandVulnerabilitiesandHowtoAvoidThem

§ Noticeofprivacypracticesdistribution

§ Lackofriskanalysis

§ Inappropriateuseanddisclosure

§ HIPAAtraininganddocumentation

§ Cybersecurity

Page 7: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 7

NoticeofPrivacyPracticesDistribution

§ Updateyournoticeofprivacypractices

§ Contentofthenoticeofprivacypractices

§ Followrequirementsfordistributionandposting:• Providetonewpatientsandobtaingoodfaithacknowledgementofreceipt• Makecopiesavailabletopatientsinthewaitingroom• Havecopiesavailableuponrequest• Postinaclearandprominentlocationlikeawaitingroomorcommonarea• Postonwebsiteandelectronicallyavailable

Page 8: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 8

LackofRiskAnalysis

§ PerformriskanalysisonceayearforMU/ACI,and

§ Ongoingthroughouttheyear,anytimeyouhavechangestoyourbuilding,staffing,hardware,softwareetc.thatcouldeffectthesecurityofyourPHI

§ Documentthefindingsandworktocorrectthedeficiencies

§ Implementandupdatepoliciesandproceduresbasedonthosefindings

Page 9: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 9

ImpermissibleUsesandDisclosures

§ Employeesaccessingpatientfileswithoutaneedtoknow

§ Thentakingthenextstepandsharingtheinformationwiththewrongpeople

§ Givingrecordstothewrongpatient

§ Socialmedia

§ ReleaseofInformation

Page 10: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 10

LackofHIPAATraining

§ HIPAA-requiredtraining• newemployeeswhentheystartatyourorganizationshouldbetrainedongeneralHIPAAandHIPAArelevanttothejobdutiestheywillbeperforming

• AnytimeHIPAAisupdatedoryourpoliciesandproceduresareupdated• WhenemployeeschangejobdutiestheyshouldreceiveHIPAAtrainingspecifictotheirnewjob

• Periodictrainingtoexistingstaff• Updatestostaffwhenprivacyandsecurityissuesarise

Page 11: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 11

HIPAATrainingDocumentation

§ Trainingcanbedoneindifferentformats§ Besureanddocumentthetraining:when,where,who,what§ Keepthisdocumentationforsixyears

Page 12: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 12

Cybersecurity

§ Databasebreaches

§ Lostorstolendevices

§ Hacking

§ Trainstafftowatchforattacks

HHSOCRinActionforFebruary2017– ReportingandMonitoringCyberThreats

Page 13: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 13

2016OnsiteRiskAssessmentResultsandLessonsLearned

FacilityAssessments

Performedin2016360

Page 14: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 14

CommonHIPAADeficiencies,RisksandVulnerabilities

§ Lackofencryption§ Sharinglogincredentials,unattendedcomputersnotlocked,unsecuredwrittenpasswords

§ UnsecuredITequipment§ Outdatedoperatingsystems§ UnsecuredpaperPHI,medicalrecords,X-rays§ PaperPHIandX-raystobedestroyed

Page 15: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 15

2016OnsiteRiskAssessmentResultsandLessonsLearned

82

224

34

166

160

124

204

PHIDISPOSAL

PHISTORAGE

OUTDATEDOPERATINGSYSTEMS

NETWORKEQUIPMENTSTORAGE

WORKSTATIONACCESSCONTROL

ENCRYPTION

NOTICEOFPRIVACYPRACTICES

0 50 100 150 200 250 300 350

2016OnsiteAssessmentResults

Page 16: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 16

CommonHIPAADeficiencies,RisksandVulnerabilities

§ Lackofencryption

Page 17: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 17

CommonHIPAADeficiencies,RisksandVulnerabilities

§ Sharinglogincredentials,unattendedcomputersnotlocked,unsecuredwrittenpasswords

Page 18: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 18

CommonHIPAADeficiencies,RisksandVulnerabilities

§ UnsecuredITequipment

Page 19: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 19

CommonHIPAADeficiencies,RisksandVulnerabilities

§ Outdatedoperatingsystems

Page 20: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 20

CommonHIPAADeficiencies,RisksandVulnerabilities

§ UnsecuredpaperPHI,medicalrecords,X-rays

Page 21: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 21

CommonHIPAADeficiencies,RisksandVulnerabilities

§ PaperPHIandX-raysto-be-destroyed

Page 22: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 22

UncommonHIPAADeficiencies,RisksandVulnerabilities

§ VOIPservers§ Homeeditionoperatingsystems§ TransportingPHIinemployeevehicles§ UsingMicrosoftWord

Page 23: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 23

UncommonHIPAADeficiencies,RisksandVulnerabilities

§ VOIPservers

Page 24: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 24

UncommonHIPAADeficiencies,RisksandVulnerabilities

§ Homeeditionoperatingsystems

Page 25: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 25

UncommonHIPAADeficiencies,RisksandVulnerabilities

§ TransportingPHI inemployeevehicles

Page 26: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 26

UncommonHIPAADeficiencies,RisksandVulnerabilities

§ UsingMicrosoftWord

Page 27: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 27

TriggersforFollow-upAssessmentsin2017

§ PHI§ Lackofencryption§ UnsecuredITequipment§ Outdatedoperatingsystems

Page 28: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 28

RoleoftheAssessor

§ Thinklikeathief

Page 29: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 29

RoleoftheAssessor

§ Wearenot HIPAAauditors!§ HIPAAisnotoptional§ Don’tsugarcoatthings

Page 30: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 30

SecurityRiskAnalysis(SRA)– HealthITServices

§ MeaningfulUse:ProtectPatientHealthInformation:Conductorreviewasecurityriskanalysisper45CFR164.308(a)(1),includingaddressingthesecurity(toincludeencryption)ofelectronicpersonalhealthinformation(ePHI)createdormaintainedinCEHRTinaccordancewith45CFR164.312(a)(2)(iv)and45CFR164.306(d)(3)

§ HealthITworkswithclinicsandhospitalsacrossthestateonannualSRAstomeetthemeaningfulusemeasure

§ WeprovidetemplateHIPAAsecuritypoliciesthatcanbecustomizedforyourpractice,guidancethroughtheSRAprocessandadditionaltoolstohelpwithHIPAA

Page 31: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 31

ContactInformation

Ifyouareinterestedintheseservicesorhavequestions,pleasecontactHealthIT HIPAASRAspecialistWinnieAlobuia at:§ (501)212-8785§ [email protected]

Page 32: HIPAA and Cybersecurity Best Practices · Security Risk Analysis (SRA) – HealthIT Services § Meaningful Use: Protect Patient Health Information: Conduct or review a security risk

5/23/17 Copyright©2017AFMC,Inc.AllRightsReserved. 32

References

§ Primeau,Debra."HowSmallOrganizationsHandleHIPAACompliance" JournalofAHIMA88,no.4(April2017):18-21.

§ [email protected]§ AFMCHealthITsecurityriskassessors§ JournalofAHIMA,May2017– ‘WallofShame’ListContinuestoGrow.


Security Risk Analysis & Requirements Engineering 1 Security Risk Analysis & Management

Gartner Security & Risk Management Summit 2015 · #gartnersecurity Gartner Security & Risk Management Summit 2015 Reevaluate your security and risk strategies and investments for

Security Audits and Security Risk Assessments

Apple HealthKit Impact on HealthIT: Rough Draft

Information Security Risk

Risk Management and Assessment for the Conventional Power ...€¦ · Security risk awareness · Security vulnerability assessment · Cyber security assessment · Security management

Information Systems Security Information Security & Risk Management

Based on healthit

Security Risk Assessment for Business Aviation€¦ · Security Risk Assessment for Business Aviation 1 Security Risk Assessment Process The assessment process is intended to provide

Gartner Security & Risk Management Summit 2015€¦ · 2 Gartner Security & Risk Management Summit 2015 ... The annual Gartner Security & Risk Management Summit equips security and

Information Security Risk Management - OVIC · This is often referred to as security risk, information security risk or information risk and is a category of risk to be considered

Security Risk Report - IT Assessment, Security, and

Cloud-Client Security – The Smart Protection Network...Security Latency Impacts Risk Content Security Risk/Cost 2003 Risk Profile Risk Profile 2008 If you think your business is

[email protected] · Strategic Security Consuling Humint Intelligence Risk Assessment Risk Percepion Risk Management Risk Governance Country Risk Report Travel Security Mariime Security

Transportation Security Administration "Risk-Based Security Overview"

A New Approach to Healthcare Security...Healthcare organizations working to meet more stringent government and industry requirements cannot predict 3. HealthIT Security. “Why Healthcare

Security Risk Analysis

Cyber Security Risk Management and ... - Nevermore Security

Book - Climate Change as a Security Risk Climate Change as a Security Risk

Chapter 1: Day 1 – Security and Risk Management - Security ...€¦ · Chapter 2: Day 2 – Security and Risk Management - Risk Management, Business Continuity, and Security Education

TENDER NO: UNES/USAID/HEALTHIT/001/2021-2022 SUPPLY …

Network Security Risk

Transportation Security Administration Enterprise Risk ... · Transportation Security Administration Enterprise Risk Management ... HSE Health, Safety, ... Risk management is central

HealthIT @VUMC Organization Chart Teresa Gillespie … · Teresa Gillespie Exec Secretary 104785 HealthIT @VUMC Organization Chart as of 2/21/2017 Business Operations Donna Forsythe

MIT IT Risk Security Specialist Job Description v5 IT Risk... · Individuals within the IT Risk & Security Specialist role plan, ... IT Risk & Security Specialist Job Description

Security Risk Analysis and Management: An Overvie · Our Security Risk Analysis ToolKit ... This document describes our Security Risk Analysis and Management ... threats or hazards

Cyber Security Risk

Risk Security

Security Risk Assessment I - Universitetet i oslo · What is Security Risk Assessment? Security risk assessment is a specialized form of risk assessment focusing on ... Process of

Conceptual Framework on Information Security Risk ... · Conceptual Framework on Information Security Risk Management Risk Management Risk and risk management have been studied in

Security risk

Infographic the Body as a Source of Big Data HealthIT Infographic

Security Risk Analysis

Security risk presentation

Optimal risk Overview of risk & security services