Help Me With HIPAA

This story has been going around since September 2019. Images exposed on the internet from PACS systems around the world available to anyone that wanted to see them. Images exposed included x-rays, MRI scans and more. It still hasn't been locked down after all these months. That means it's time to talk about it instead of keeping it quiet. More info at HelpMeWithHIPAA.com/243

Another report comes out that says insiders are a huge problem. You have to worry about the people, people. We have been saying this for years. The lastest news on that front is in the 2020 Cost Of Insider Threats Global Report released by the Ponemon Institute and sponsored by ObserveIT and IBM. It does tell us a lot of things we already knew but the details including those about how it is growing are important to note. More info at HelpMeWithHIPAA.com/242

Wearables, medical devices and HIPAA are just some of the questions we have gotten recently. Today's episode is privacy and security news plus listener questions. More at HelpMeWithHIPAA.com/241

Is HIPAA ambiguous? That is the way many people refer to anything that has to do with HIPAA regulations. It comes from doctors, nurses, lawyers, managers, supervisors, even compliance officers. But, is it really the way we should refer to the law? Should we say it is flexible or reasonable instead? More at HelpMeWithHIPAA.com/240

There have been a lot of headlines lately about Windows 7 end of life and Windows 10 security patches. Let's discuss why supported software and security patching matters in general. Then, we can talk about why it matters under HIPAA. More at HelpMeWithHIPAA.com/239

We have mentioned ransomware warnings over and over on HMWH. To the point ransomware shows up in a search on 56 different episodes before this one. That means we've talked about ransomware warnings in 24% of our episodes. Guess what - clearly we need to talk about it again! More info at HelpMeWithHIPAA.com/238

As we anticipated there was one more OCR settlement announcement before the end of 2019. This one popped in at the end of December and was yet another one in our backyard. The ambulance company settlement seemed simple at first but once we read the details there is a lot to unpack in the CAP. Let's get to it then! More info at HelpMeWithHIPAA.com/237

We need to get on the record with our 2020 predictions even if we both agree we have no freaking idea what is going to happen in 2020. If anyone out there says they honestly believe they have a true beat on it, check them out. We do have a few 2020 predictions that we feel sure enough about to say it outloud to you guys. More info at HelpMeWithHIPAA.com/236

Here we go with two more OCR enforcement settlements. As we expected, the end of the year included a flurry of enforcement announcements from OCR. Just as this was about to be recorded they announced the second patient access settlement. So we can we get both done in one episode! Both of these cases are related to some costly PHI mistakes so let's get down to business. More info at HelpMeWithHIPAA.com/235

We have made it most of the way through 2019. Now is the time to see how we did when we released our HIPAA privacy and security predictions for 2019 in episode 186 way back on Jan 11. There were so many things that transpired this year just when thinking about the threat landscape much less all of our HIPAA discussions it feels long ago in a galaxy far, far away. For more info HelpMeWithHIPAA.com/234

Enjoy Bojan's 2019 version of our annual blooper show. Yes, some things really are as crazy behind the scenes as it seems. Thanks for all your support in 2019. Enjoy whatever holiday you celebrate this time of year to the fullest!

A Business Associate Agreement isn't just another simple bit of paperwork. The liability commitments in your BAA and the business relationship it defines are very serious and very important in defining clearly the responsibilities of both parties. Lately, we have had to ask a lot of questions like what is in your BAA and today we discuss what we have been seeing out there in the wild, so to speak. More info at HelpMeWithHIPAA.com/233

OCR has been busy closing out investigations lately. They announced 2 more enforcement actions in early November. One was a settlement in NY, but the other was a civil money penalty with Texas HHSC. Let's review these 2 new OCR enforcement actions to see what we need to learn from the details released. More info at HelpMeWithHIPAA.com/232

Happy Thanksgiving from the HMWH team. Since we just talked with Erik Decker the last two weeks about HICP it seemed fitting that our Thanksgiving replay this year is the discussion we had about our initial review of HICP earlier in 2019. That was episode 189. Thanks for listening and enjoy the Holiday season!

Today we share part 2 of our Erik Decker HICP discussion. Learn about more tools for small and medium organizations. The 405(d) Task Group has more work to do so learn ways you can help spread the word about using these tools to improve healthcare cybersecurity. We even ask how we can all help promote cybersecurity awareness and HICP to improve the healthcare cybersecurity. HelpMeWithHIPAA.com/231

We covered the release of HICP or Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients back in Feb in the episode we called 5 Threats and 10 Protection Practices – Ep 189. HICP has now been out for a bit and the next phases of the project are in process. Today we discuss all things HICP with Erik Decker who is the Health Sector Coordinating Council Co-Lead of the 405(d) Task Group that developed this tool to help our sector follow solid cybersecurity practices. More info at HelpMeWithHIPAA.com/230

HIPAA penalties are always discussed in training and presentations about HIPAA. Those discussions are usually more about an overview of what is in the law than actual information on how the law is applied. HIPAA penalties are really not seen often. Civil money penalties are not part of the settlements we usually see but OCR announced a big one in October. How do they really apply those huge numbers everyone talks about but we never see? More info at HelpMeWithHIPAA.com/229

The annual conference hosted by NIST and OCR Safeguarding Health Information: Building Assurance through HIPAA Security and the repeated message on day one of the conference was "HIPAA is the floor" which started with OCR Dir Severino's keynote. We always get information at some point that makes these conferences worth the time. What did we get from this one? More info at HelpMeWithHIPAA.com/228

As is our custom, each year we have a halloween-themed episode. This year we are thrilled to bring you several very real Tales From The Dark Side Of HIPAA. Thanks to our friend, Jack Rhysider from DarkNet Diaries for recording our haunting lead-in! More info at HelpMeWithHIPAA.com/227

Social media and PHI get the OCR spotlight in the latest settlement announced. Reading these settlement agreements provide the best guidance from OCR which is why we always take the time to get those details for you. How much have you considered about your social media policies and how your staff understands their responsibilities? More info at HelpMeWithHIPAA.com/226

Is there such a thing as bad luck breaches? Most of us don't expect luck to rule our world although I will always take good luck if I can get it. But when bad things happen sometimes we say it is due to a string of bad luck. Can data breaches be due to one of those strings of bad luck? For more info go to HelpMeWithHIPAA.com/225

The first patient access settlement has been announced by OCR. Director Severino mentioned they would be putting an emphasis on this issue and we now have the first enforcement come through. What should you learn from this settlement? It included some interesting corrective action requirements. More HelpMeWithHIPAA.com/224

January 14, 2020 marks the end of life for Windows 7 and Windows 2008 operating systems. Have you done your SRA to make sure you have things covered? What about home computers, should you be worried about those? In this episode we review what this end of life for Windows OS means and what you should be doing in the 4th quarter of 2019 to prepare for it. More at HelpMeWithHIPAA.com/223

We always talk about the need for a culture of compliance or culture of privacy and security. Today we talk about 6 things you notice when you have built a culture of compliance. The 6 comes from 3 x 2 which means there is clearly no rhyme or reason for the selection today. More at HelpMeWithHIPAA.com/222

When working on a plan for this episode I had two different sources drop some insider breach issues in my lap. When I added those to the news stories we are already following involving insider issues, it was clear the topic was meant to be. Multiple cases and reports are out — the topic I must cover is because I am reading about insider breaches everywhere around me. More at HelpMeWithHIPAA.com/221

October is National Cybersecurity Awareness Month (NCSAM) and it is a perfect tool to feature security awareness with your workforce and clients. You can not beat an opportunity to run a month long awareness program that provides EVERYTHING you need for free. Today we discuss what the program includes and how to use it in your office. More at HelpMeWithHIPAA.com/220

We discussed the patient rights to access medical records a few episodes ago. Since then, a new study came out that says a majority of providers are not complying with patient medical records requests. I have also gotten more questions about law firms demanding to pay only $6.50 for medical records requests. We are discussing these issues with specifics about fees for patient requests in this episode. More at HelpMeWithHIPAA.com/219

When you work with outsourced IT or Managed Service Providers (MSPs) you need to vet them closely to make sure they truly do understand what HIPAA requires from your organization. Here are seven questions to ask your IT team about HIPAA. For more info go to HelpMeWithHIPAA.com/218

The Ponemon Institute has produced an annual study of data breach costs. This is the 14th year. We have used it as a guide for a lot of information over the years. The data has consistently been helpful for us to understand what are the key drivers in data breach costs, remediation, and response. If you can find what the major factors include, it is a great way to determine your priorities in investing resources with the biggest impact. Let's see what we learned from the 2019 version sponsored by IBM. More info at HelpMeWithHIPAA.com/217

Who is a business associate? A listener asked for an episode on it. Turns out we haven't done one since episode 2. Wow! So, maybe there is more we have to add to that topic in 2019 after 214 other episodes. Today, let's talk about how to determine who is your Business Associates or BA. More info at HelpMeWithHIPAA.com/216

We have gotten a flurry of listener questions and comments lately. Since it is so much easier to do an episode based you listener questions that writing up a whole plan we are definitely doing those today. We really do read and respond to as many as we can. So here we go. More info at HelpMeWithHIPAA.com/215

If you haven't heard of it before there is a thing called the California Consumer Privacy Act (CCPA). It is considered the first version of a GDPR-type legislation on this side of the pond. It becomes effective Jan 1, 2020. There are many folks that think the CCPA isn't something for them to worry about. Well... Maybe you should take a second to reconsider that position. More at HelpMeWithHIPAA.com/214

Today we discuss 5 medical record uses and disclosures rules that I have been covering recently in training. Medical records are always around for those of us in healthcare. It is so easy to forget that the rules apply to more than just data breaches and social media. There are some very basic concepts that people who have been dealing with medical records for years are surprised to learn. Here are five of them we use the most. More at HelpMeWithHIPAA.com/213

We need to keep up with our education just like everyone else to keep up with cybersecurity tips and trends. Donna hit some training at SecureWorld and sat in on a 6-hr online seminar offered by Dark Reading. All of that thinking and learning means we have cybersecurity tips and trends to share in this episode. This is not just for those who worry about HIPAA. More info at HelpMeWithHIPAA.com/212

The debate continues in ransomware attacks, do you make the ransom payment or not? Lately, we have seen many payments being announced. This should be in your incident response plan ransomware playbook. These decisions should be discussed now, not when an attack happens. What are the pros and cons to paying and what should be in your ransomware response plans? More info on Help Me With HIPAA blog post.

False claims settlements over meaningful use money have popped into the news again. The provider was sued by whistleblowers and the DOJ for not doing a security risk analysis but attesting to one to get the meaningful use payments anyway. There is whistleblower's angle in this case which makes it even more interesting. If you know anyone that has received any meaningful use money they should check out this episode! More info at HelpMeWithHIPAA.com/210

This new BA guidance from OCR is important because it defines clearly all the things we hear misstated over and over. Several of our Top 10 Wrong HIPAA Statements episode are addressed in the simple ten item list. Today we will discuss the announcement and what does that mean to BAs and their privacy and security programs. More info at HelpMeWithHIPAA.com/209

The multi-state settlement with Medical Informatics Engineering makes the OCR settlement seem like a cake walk. The vendor agrees to pay OCR $100,000 with a standard 2-year corrective action plan. The states get $900,000 plus 5 years of very specific corrective action requirements. Vendors need to pay attention to this case and take appropriate action now. More info at HelpMeWithHIPAA.com/208

Sanction policies are often vague or even overlooked in many privacy and security programs. The whole point of a sanction policy is to list out the consequences for failure to follow our policies and procedures. With a vague or non-existent policy consequences aren't clear which leads to a lack of concern for failure to follow the policy in the first place. You will never build a culture that worries about protecting information without it being clear that is a requirement for inclusion in our culture. How do you sanction? More at HelpMeWithHIPAA.com/207

Maturity is something we expect from respected folks or grown folks but what about your privacy and security program, do you check it's maturity? You have all of these plans, policies, procedures, and training but is it actually meeting your needs? Time to talk maturity assessments. More at HelpMeWithHIPAA.com/206

The latest HIPAA violation settlement with OCR was announced recently. Ironically, the settlement with Touchstone Medical Imaging was for $3,000,000 and announced just after the reduction of maximum penalties was announced by HHS. Just how bad was this violation to get hit with this level of penalties plus the 2-year corrective action plan? More at HelpMeWithHIPAA.com/205

Headlines everywhere are telling us all that the HIPAA penalties are being "slashed" or "capped" or "reduced". What is the real story and what does it mean to the rest of us? Great time to talk about what you should consider if you think you will be facing any HIPAA penalties. More info at HelpMeWithHIPAA.com/204

We have talked many times about vetting business associates. When people talk about supply chain security it isn't just the business associate you contract with you have to worry about. It is all the vendors that they use. Today we are going to review 3 supply chain stories that explain how complex your supply chain unbeknownst to you. More at HelpMeWithHIPAA.com/203

We are all being watched. Cameras are everywhere today. With the advent of dashcams, home security camera systems, CCTV in cities and businesses we are caught on camera somewhere every day. What does that mean when you have privacy concerns to address like, I don't know, HIPAA? More info HelpMeWithHIPAA.com/202

We discussed this whole Alexa and HIPAA thing before. This week came the big announcement from Amazon that had headlines telling us that Alexa is HIPAA compliant with some slick new medical skills. Time to talk about her again. Let's see what the announcement really said. While we are at it we will also look into the story that Amazon also has thousands of people sitting around listening to Alexa requests all day long. More info at HelpMeWithHIPAA.com/201

It is hard to believe we are recording our 200th episode. Some might even say it is close to a miracle that David and Donna could stay focused on one thing for this long. Probably very true. Our passion for what we do here is more than most people would think. We truly do believe that tagline we use in every episode "HIPAA is not about compliance; it's about patient care.". More at HelpMeWithHIPAA.com/200

Medical record release is becoming a heated topic. There are several parties involved in the discussion. Of course, the patient and their rights to the medical record comes first. Then, you have the providers trying to meet their obligations to supply the records. But, there are also lawyers and medical record release of information companies and, of course, OCR involved. Today we will try to make some sense out of the mess. More at HelpMeWithHIPAA.com/199

We come bearing news from the 2019 HIPAA Summit, today. Officially, it was The 28th Annual National HIPAA Summit. The event happened in March from Washington, DC. Thankfully, they have offered a webcast option along with onsite attendance for years. I sat in on the HIPAA Summit sessions again via webcast and there is much to share. For more info go to HelpMeWithHIPAA.com/198

We are fans of the podcast DarkNet Diaries, "True stories from the dark side of the Internet". As fans, it explains why we are excited to have Jack Rhysider, the host of DarkNet Diaries, on the podcast with us today. Prepare to be surprised by some of these real hacker stories. More info at HelpMeWithHIPAA.com/197

It is important to think about what could happen if one of your vendors is the reason you become another business listed in data breach statistics. Third-party data breaches can impact your business even when it doesn't involve your data. These stories show how many different angles you should use when reviewing their impact on your business. More info at HelpMeWithHIPAA.com/196