HIMSS 2018 – Take Aways

I attended the national HIMSS 2018 conference in Las Vegas a few weeks ago.  43,000+ roaming loose in Vegas, primarily in a few hotels and the Sands Expo Center.  It was mayhem.  I attended the Cyber Security Symposium all day Monday.  Six sessions focused on cyber security and best practices.  I then attended the keynote speech by Eric Schmidt, the CEO of Alphabet, the parent company of Google. Tuesday was primarily more sessions and a few minutes out in the expo “acres” wandering around trying to get my bearings and locate a few people and vendors.  Wednesday and Thursday were spent seeking partners that we thought might offer beneficial products and services to our customers.  I’ll try to summarize each “section” of the event I experienced, hopefully offering some insight and benefit to you and your organization.

Cyber Security Symposium

First, all of the speakers and presentations were excellent.  HIMSS does a great job finding top notch speakers on relevant topics.

The cyber symposium confirmed our approach here at Third Rock is on track with NIST, GDPR, OCR, and large healthcare CIO/CISOs approach.

High Points / Lessons Learned made throughout the various presentations.

1. It’s about Cyber Risk – Managing it and Correcting Issues
2. Cybersecurity requires a Holistic Approach – People, Process, Technology (BINGO, I think I’ve heard someone/company preaching this.)
3. Perform a Third Party Assessment that includes a cyber security assessment
4. Backups that will restore and not be corrupted/infected/hijacked.
5. Data Inventory – Data Flow – DO IT, NOW!!!
6. Shadow data is a problem – keep on top of it.  (Data the IT dept doesn’t really know about.)
7. Equipment inventory – there are more computers on your network than you think – HONEST
8. Policies & Procedures are necessary and they need to be USED and operational, law firms don’t do this well.
9. Security Play Books – Scripted Scenarios for responding to issues – know what to do before it happens
   1. Like Disaster Recovery Runbooks, but for Breach Response.
10. The NIST CSF is the standard – USE it as the basis, reference.  HITRUST CSF complicates it, why bother.
    1. CSFs are high level guides, you need step-by-step policies and procedures that become standard operating procedures.
11. COMMUNICATE with Executives, Management, ALL departments.  Do NOT ASSUME they know.  They DON’T.
12. Provide daily status, simple color charts
13. Enable, don’t inhibit.
    1. Reduce friction.  Implement Policies and Procedures as beneficial Standard Operating Procedures.
14. Use compliance as a gap analysis (assessment) tool and score card.
15. AUDIT YOUR Business Associates – NOW.
16. Every organization needs a privacy and security leader.
17. If you declare an issue in your risk register (Issues) the OCR will not FINE you.
    1. Almost ALL OCR settlements cited Risk Assessment as a critical lapse of compliance!
    2. Trying to hide you’re mismanagement and lack of cyber security, which is non-compliance, will COST you in fines.
18. Risk Management is how to achieve improved cyber security.
    1. Use Compliance standard (HIPAA, GDPR, NIST 800-171) as the gap analysis and benchmark / scorecard.

Eric Schmidt included a few interesting points in his typical chairman of the board or CEO inspiring talk about what’s to come.

1. MOVE to the CLOUD now!  (Whether it’s google’s, AWS, or a vendor, do it.)  It will save you time, money and improve performance, security and compliance.
2. Embrace new technology, it will allow you to catch-up with the other industries and transform healthcare.  Stop using the fax machine, it’s DEAD.  Harness the power of IT for the benefit of the patient.
3. It was implied that based on history, innovation will come from outside the Healthcare technology giants. It will take consumer focused technology companies to bring real change to healthcare.

What the OCR had to say about HIPAA Compliance Issues and Continued Fines

1. Lack of Security Risk Analysis
2. Lack of Business Associates agreement and auditing of BAs.
3. Lack of Risk Management Plan to Manage Identified Risks, e.g. Encryption
   1. If you don’t have a risk register in prioritized order, your assessment isn’t worth much.
4. Lack of Transmission Security
5. Lack of Appropriate Auditing
6. Lack of Patching of Software
7. Insider Threats
8. Improper Disposal of equipment and media
9. Insufficient Data Backup (inability to restore)
10. Lack of Contingency Planning (and emergency response planning)
11. CMS will start auditing for Disaster Recovering and Emergency Response Plans in May 2018.
    1. Make sure you prioritize the systems based on CIA importance in your DR plan.

Hope some of this info was helpful.

Sign up for our newsletter to see all of the new services and Trusted Alliance Partners Third Rock will be announcing over the next few months.

Protect your Clients. Protect your Organization. Protect Yourself.™