Help Me With HIPAA

John Miller, CEO of Sterling Seacrest Partners, was with us back at the beginning of our podcast experiment. Over 100 episodes ago, in February 2017 on episode 89, we first talked with him about cyber insurance policies. Today we've brought John back to discuss how cyber insurance coverage has changed over the last two years. More info at HelpMeWithHIPAA.com/195

Ransomware is getting scarier even if you don't know it yet. It appears that the lull we enjoyed through the last bit of 2018 may be over. Not only are the incidents increasing but the mechanisms and ransom demands are changing. Yes, no matter how we looked at it we had to say ransomware is getting scarier than it has been since the beginning of 2018. More info at HelpMeWithHIPAA.com/194

There are several recent studies and articles that discuss the world from the viewpoint of the people who have the cybersecurity roles in your IT staff. Their days are packed just trying to keep everything working and secure. As much as we have been after IT folks lately it is important to note that many times they take care of problems that you never even see. Today we are taking the time to remember that cybersecurity roles are tough. Really all IT roles involved in protecting our valuable information resources are tough jobs. It takes everyone to defend our data so your cybersecurity team needs your support! More details at HelpMeWithHIPAA.com/193

If you spend time every day worrying about the risks in using email, you might be a security professional. Email is very risky even if you don't realize it. Imagine that you are just walking along a bridge safely. What you don't realize is the pit that is just a few inches below the bridge is filled with snakes, gators, and poison spikes. One small mistake could mean - dum, dah, dum, dum, duuummmm. Email is dangerous, seriously it is. More info at HelpMeWithHIPAA.com/192

OCR got to toot its own horn in a big press release on Feb 7. Not only did they announce another settlement that happened in December that we had not heard about but they also recapped the record-setting year they had with enforcement cases in 2018. Time to learn from other's mistakes. More info at HelpMeWithHIPAA.com/191

As with many things, HIPAA "experts" are everywhere. There is also a lot of misinformation, confusion, and downright bad advice being handed out by people who think they understand HIPAA more than they actually do. Wrong HIPAA statements can be found on a lot of discussion boards and just out in the world talking to people. We deal with those issues on a regular basis. Sometimes we can laugh about it. Other times we just have to take very deep breaths before we find ourselves responding inappropriately. Our intent here is to educate, always educate even when you are dealing with someone that may not know they need educating. More at HelpMeWithHIPAA.com/190

The Cybersecurity Act of 2015 (CSA) called for adapting our critical infrastructure to better handle cybersecurity issues using private and public partnerships. Section 405(d) of CSA calls for "Aligning Health Care Industry Security Approaches." A task force has been working on doing that since May 2017. On December 28, 2018, they published the information we have been excited to see in their document Health Industry Cybersecurity Practices: Managing Threats and Protecting Patients (HICP). Let's review this important information, shall we? More info at HelpMeWithHIPAA.com/189.

Let's be #PrivacyAware in today's episode. Privacy Day has been around for a while. It is "international effort to empower individuals and business to respect privacy, safeguard data and enable trust". At HMWH, we are all about trust here and certainly aim to empower those who are willing to respect privacy. For more info HelpMeWithHIPAA.com/188

Passwords are a necessary evil in our online and digital world. There are lots of tools out there that help us deal with them but you have to use them every day in some way unless you are completed unsecured or off the grid. LastPass recently released an interesting report about the use of passwords. Let's see what new trouble we can find in these details about our daily password battle and discuss some options we have found for dealing with them. More at HelpMeWithHIPAA.com/187

Today we cover the things we are keeping an eye on for 2019. Yes, it is 2019, I can not believe how quickly we have gone through almost 2 decades of the 21st century. Our top 7 predictions for 2019 may not surprise you. But, that shouldn't stop us from throwing them out there. More at HelpMeWithHIPAA.com/186

In case you have missed it there have been several headlines about HIPAA changes in the last month. What is that all about and what should you worry about? Today we are discussing if HIPAA changes are will be coming this year. Even better we will tell you what we plan to do with the information. More at HelpMeWithHIPAA.com/185

OCR continued to hand out settlements to close out 2018. These last few announcements came out so quickly vs normal rates it is definitely raining settlements! While these last two do pale in comparison to the huge Anthem settlement, they certainly bring home more messages. What lessons are they trying to teach us with the Florida and Colorado settlements announced in December? More info at HelpMeWithHIPAA.com/184

Each year our Croatian sound editor, Bojan, compiles his favorite package of our issues to share his pain with our listeners. Listen in to hear how much he has to work to make us sound so much better than we should. Thanks, Bojan for all the hard work! For all our listeners, Happy Holidays and thanks for your support this year and in the future!

The allergy practice settlement that was recently announced will be known as the "no comment" settlement in my mind. As always, there are lessons to be learned from this announcement and the way OCR handled it. This settlement brings up a lot of discussions about handling patient public comments. More at HelpMeWithHIPAA.com/183

There have been several announcements about cybersecurity agencies and offices lately. Some announcements are from the Department of Homeland Security (DHS) and some are from Health and Human Services (HHS). What are they talking about and what does it mean to you? More at HelpMeWithHIPAA.com/182

It is hard to believe we are coming to the end of another year. Seems like just yesterday we recorded 7 Educated Guesses About 2018. Today we review our 2018 predictions, ummmm, educated guesses for 2018 and see how we did. More info at HelpMeWithHIPAA.com/181

This holiday we are both taking time off to celebrate with our friends and families. In our absence, please enjoy a replay of our previous Gift Giving Guide for compliance officers.

Listener message potpourri means we will be hitting several different topics in this episode. We get emails and messages from listeners a lot these days. While we do our best to respond we can't say we are consistent. That is why we do these episodes periodically. If we've missed yours, don't hesitate to point it out to us in another message. More info at HelpMeWithHIPAA.com/180

In the recent NIST OCR security conference, a panel member said the terms "HIPAA compliant" and "HIPAA certified" made her cringe. We agree. The Anthem settlement has a lot of people asking about certifications for cybersecurity since Anthem was technically HITRUST Certified when the hacker first broke into their network. Let's talk certifications and what they really mean under HIPAA, shall we? More info at HelpMeWithHIPAA.com/179

The 2015 Anthem data breach could have been a watershed moment for HIPAA privacy and security in many ways. It remains to be seen if the settlement with OCR turns out to be another one. Either way, the historic breach and historic settlement have many lessons for us to learn. Let's discuss Anthem settlement lessons today. More info at HelpMeWithHIPAA.com/178

Time for the annual Halloween episode! 5 horror movie quotes are this year's theme. We have 5 horror movie quotes that are matched up to data breach stories. More info at HelpMeWithHIPAA.com/177

We are #CyberAware is the tag for the National Cybersecurity Awareness Month campaign. Each year this campaign is run by the National Cybersecurity Alliance. In 2018, Kardon, Security First IT, and HMWH are all signed up to be champions and publish information for the campaign. Today, we will review what these campaigns are about and how you can use these and more like them to augment your education program. More at HelpMeWithHIPAA.com/176

What should we learn from the recent OCR settlement? This time it was three settlements in one that related to a fourth. There is more here than the headline-grabbing dollar amounts. These settlements are the best specific guidance you can get from OCR. As always, we do the analysis for you! For more info go to HelpMeWithHIPAA.com/175

Often tech folks will say that they understand HIPAA. What that really means is that they understand the technical requirements of HIPAA. The overconfidence sometimes works against them. Today we cover 3 stories tech should hear. It is important that they learn there is more than just their tech knowledge.

CIS 20 or SANS 20 is the name to reference a list of security controls that are intended to be used in the absence of any framework like NIST or HIPAA requirements. If you are trying to get the most bang for your buck and you know you are way behind on your security program CIS 20 may be the thing for you. For more info go to HelpMeWithHIPAA.com/173

Have you seen the report about consumer online digital trust and what it means to all businesses? The report is The Global State of Online Digital Trust A Frost & Sullivan White Paper which was commissioned by ca technologies and published in July 2018. This survey study was done to compare perceptions about consumer trusts that executives and security professionals have vs the actual consumer trust findings when surveying consumers. Would you believe there is a disconnect across the three perceptions? For more go to HelpMeWithHIPAA.com/172

I can tell you from experience snooping is a serious problem that haunts all entities with health information to protect. Even if you don't know it is haunting you, it is. You will learn to fear it eventually. The extent of improper record access goes well beyond what most people imagine. The image of a healthcare professional keeping patient information confidential is something we all assume is happening. In the real world, most workers know someone who has improperly accessed records if they haven't done it themselves. More info at HelpMeWithHIPAA.com/171

Securing home networks matters more now than ever before. We are a very connected society. That creates great opportunities and new challenges every day. Especially, for those tasked with securing all that connectivity. One opportunity that gets a lot of people talking is teleworking, telecommuting, working remotely, or working from home (WFH) - all seem to mean the same thing to most people. Our whole company is built on the ability of our systems to be secured and also be able to connect and work from anywhere in the world. Many groups forget to worry about those home networks that are connecting to your office network and even using your office applications, and data on a regular basis. More at HelpMeWithHIPAA.com/170

We live in a world of instant communications. During a crisis, our normal standards of communications can be very limited. How many different issues have you addressed for communications in a crisis in your plans? We mention the business continuity and disaster recovery plans that everyone should have often in episodes. This is just one element of the plan that can make or break the business in a crisis. If you can't communicate effectively with each other the chance of you being able to keep things running drops significantly. For more go to HelpMeWithHIPAA.com/169

It may not occur to many of you that a hacktivist should be on your security risk analysis (SRA). They must be on there in this digital age. You never know what could trigger a hacktivist to focus on your business and put you under attack. Why you may ask - well we will discuss that now. For more text go to KardonHQ.com/168

The FBI released an alert on July 12 titled Business E-mail Compromise E-mail Account Compromise The 12 Billion Dollar Scam that should be on your radar. BEC-EAC stands for Business Email Compromise - Email Account Compromise. If you haven't learned about this particular threat it is important that you review it and assess the risk it brings to your company. That's why we review these increasing threats and what you need to do about them in this episode. For more go to HelpMeWithHIPAA.com/167

We often get questions from both the tech staff and security officers about what should be documented regularly and why it should be done. There are 3 reports you need to get from your tech team on a regular basis IMHO. Today, we will discuss those three reports, why you need them and what to do with them. More at HelpMeWithHIPAA.com/166

One of the discussions you must always be prepared to have is that size does not matter when it comes to privacy and security issues. Does size matter? Not as much as most people think and not in the ways that most people think either. More at https://HelpMeWithHIPAA.com/165

Want to know how to save money in a data breach? You have to have a plan before you have the data breach to keep you from making costly mistakes. Everyone knows a data breach can be expensive but there are studies that show us what makes them more expensive and what helps you save money. The annual Ponemon cost of a data breach study has been published. IBM sponsors the study each year and it is one of the best tools for us to prepare for the cost of a data breach. If you have any valuable data at all you should review the report to get an estimate of what the cost of a data breach would be for your organization. Let's dig into some numbers and add a bit of perspective, shall we? Go to HelpMeWithHIPAA.com/164 for more details.

Our most downloaded episode Is from way back in May of 2016. HIPAA Access Logs Audits was our 54th episode. It is hard to believe it was that long ago! Today we are doing a deeper dive into how many layers exist when it comes to access logs to see if you have thought of all of them. Which of the logs really matter and what do you do with them? For more go to HelpMeWithHIPAA.com/163

We all live in a world that revolves around communication tools today. Messaging failures are often the reason privacy breaches occur. In fact, we have 3 to share with you today. Messaging failures can occur in ways you never dreamed of until it happens to someone you know - not you, of course. Today's episode covers 4 different stories about messaging failures. For more go to HelpMeWithHIPAA.com/162

OCR continues setting examples with the recent announcement of the $4,348,000 civil money penalty (CMP) that they imposed on MD Anderson. A review of the details shows us once again that the enforcement of HIPAA obligations is not something they decide to do in a willy-nilly way. It is specific and designed to set examples of what is expected. Most headlines are about that $4.3 million in penalties but to us, that is not what is the most interesting and important thing to note in this case. More at HelpMeWithHIPAA.com/161

Medical device inventory is a challenge for most organizations. Just as with computers and mobile devices, though, you can't understand your risks and security requirements if you don't know what you have out there. A medical device treasure hunt is what it turns out to be when you make a dedicated effort to find them all in your organization. How do you find them all and how do you worry about protecting them all? More information at HelpMeWithHIPAA.com/160

It happens out of the blue. You get a letter that tells you that there has been a complaint filed and an investigation has been opened by OCR. That may not be the best day of your life. Just the thought of opening one of those letters can make some people feel queasy. If you have ever experienced that moment you don't have it high on your lists of things to do again. Let's review the kinds of things you may be asked to answer when under and investigation. For more go to HelpMeWithHIPAA.com/159

In the past few weeks, the nerd news has been full of network security alerts and discussions about issues potentially lurking on every network, especially smaller ones. These are not the things we normally worry about either. You usually think Windows, Office, Adobe, etc patches are the main alerts to worry about on your network. These are new alerts that could be in every network you use including home, public wifi, and work. Per usual, we are here to explain them as best we can - in English. Tech folks you should listen up to what we expect you to be doing for our listeners who rely on you, too. For more information go to HelpMeWithHIPAA.com/158

Secureworld Atlanta just finished up. Turns out cyber experts do agree about many of the same issues we discuss here. Two days of discussions amongst CISOs, ISOs, security techies, etc. about what to worry about and what to do for cyber protections. Yes, there was a lot of really nerdy discussions but the good news is the central themes do not require geek speak to share with you. Learn more at HelpMeWithHIPAA.com/157

Have you considered that there are other valuable information assets to protect than just PHI? Most healthcare privacy and security programs only focus on PHI and HIPAA requirements. If you are already doing the work why not include all of your valuable information assets. It is time to ask yourself what data should we protect? For more go to HelpMeWithHIPAA.com/156

This time of year many of us think about cleaning out closets and switching seasons. By clearing out your digital clutter you can double check the security of your devices and reduce your attack surface at the same time. Plus, it is way easier than cleaning out the old hall closet that may have monsters lurking in the back of it. Make the time to clean your digital clutter at least once or twice a year and you will feel better for it. Why not do digital spring cleaning, too? For more go to HelpMeWithHIPAA.com/155

There is a frequent issue with people understanding what a Security Risk Analysis includes. In fact, there is so much confusion we often see documents presented as a risk analysis that is actually a gap analysis. It happens so often that OCR is trying to address it in their April newsletter. We are going to take a stab at explaining what gap analysis reports look like vs what a security risk analysis report really includes when done properly. For more information: HelpMeWithHIPAA.com/154

Back in January, I read an article in Forbes titled: The Five Laws Of Cybersecurity. When reading it I realized that it was a great message to our listeners but it needed a HIPAA flavor added it to it. This episode we add our thoughts to his article and turn it into 5 Laws of HIPAA Cybersecurity. For more details HelpMeWithHIPAA.com/153

More news on the insider front makes it necessary to point out, again, how susceptible healthcare is to insider failures. HelpMeWithHIPAA.com/152

The American Medical Association (AMA) did a survey of physicians and their thoughts about privacy and security practices. It was interesting to hear their responses. Also, when a group of Security Officers gets together for a chat some people glaze over. For nerds like us, it is an exciting discussion. Today we are going to discuss the Security Officer panel topics and the AMA report presentation from the National HIPAA Summit. HelpMeWithHIPAA.com/151

Are you ready for extreme vendor vetting? Many vendors have been pushing back against any covered entity or business associate that asked them to answer questions about their privacy and security programs. They believe signing a business associate agreement (BAA) meets the legal requirements and that is all they must do. Well, the times they are a changing - again. There are many different factors making it necessary to ask these type questions and not just accept a BAA as reasonable assurances. What are those factors and how things are changing are the topics we discuss in this episode. For more go to HelpMeWithHIPAA.com/150

The National HIPAA Summit always features some interesting news from OCR concerning guidance, enforcement, and audits. This year was no different. In this episode, we discuss the highlights as we interpreted them anyway. More at HelpMeWithHIPAA.com/149

Cybersecurity trends sound scary when you hear us talk about some of this stuff. Cyberscary is actually what we decided to call it. The good news is we do talk about other things sometimes. There are two reports that came out in recent weeks have gotten my attention and just have to be discussed with you guys. More info at HelpMeWithHIPAA.com/148