One of the most common services in healthcare is the connection to the internet. With all the focus on security and cyber breaches, one of the most vulnerable pieces on your connection to the internet is what is called the router / gateway. The router / gateway connects your computers and devices to the public internet and in many cases provides the initial security or barrier through the use of a built-in firewall.

The problem is, that while this is the door, the gateway to the internet, it is a two way door. Much like the door on your office or building, if it is not properly secured anyone can walk in. What makes this such an issue is the Internet Service Providers (ISP) that generally setup the router / gateway for your organization. Larger organizations may or may not take care of this themselves, but small and medium organizations rely on the ISP to do the install and setup.

Here comes the major problem!!

The ISP will generally leave the default username and password for the router / gateway. This means that anyone that gets on your network can simply connect to the router and use the commonly known list of default usernames and passwords to quickly access your router and change the settings to allow them to access your network from anywhere and steal data.

How to fix this

You have two options to correct this.

1. Most ISP’s have instructions on how to access and change the router’s username and password. You can login and change it yourself.
2. If you are unsure, contact the ISP and they can walk you through the process.

This is a critical issue that is extremely prevalent in many organizations, not just healthcare.

Welcome to 2017.  If you haven’t heard, the Health and Human Services Office of Civil Rights (OCR) will perform several hundred on-site HIPAA audits this year. The possibility of being selected is highly unlikely, but if you are one of the “lucky” covered entities that is audited you had better be ready – with all your ducks in a row. Current HIPAA training is only one duck, you need at least four more.  So, prepare to go duck hunting and get them in order sooner rather than later.

There are two very important issues to understand about this new process and the protocol the OCR implemented in 2016. The OCR now requires documented proof that covered entities and business associates have …

1. Implemented HIPAA specific Policies and Procedures (P&P) in 2016 showing a plan for risk management.
2. Documentation, including the P&Ps and logs of HIPAA activity, in electronic format for uploading to their web site.

Don’t forget the OCR expected the following for a HIPAA desk audit starting in 2015 and 2016.

1. A current annual Security Risk Analysis (SRA) based on the OCR SRA questions and/or the NIST 800 standard.  In addition, a risk assessment that includes privacy is needed as well.
2. Current HIPAA training that includes privacy and cyber security training for all staff with access to PHI and ePHI.

The real takeaway?  The OCR expects to automate auditing and all covered entities and business associates will be audited by 2019.  The OCR expects covered entities and business associates to have HIPAA compliance documentation in electronic format starting in 2016.  Make sure your HIPAA report, corrective actions and logs are in electronic format and that you can show improvement in your HIPAA compliance.

Call-To-Action: If you haven’t started and done all of the necessary steps to be HIPAA compliant, it’s time to take action and have a Risk Assessment done immediately and make sure it’s delivered and available in electronic format, preferably online.

This is the second in a two part series concerning the value of compliance.  Our mission is, Worry-Free Compliance, to help you obtain a culture of compliance through normal business operations.  Our vision is to reduce the complexity, cost and burden of HIPAA compliance using a next-generation compliance management platform.

What does a next-generation management platform provide?  Here’s a list:

• • Complete
    • Manages the entire compliance process
    • Maintains custom policies and procedures
    • Provides and tracks training
    • Creates & maintains Body of Evidence for audits
• • Simple and Easy
    • Understandable format, HIPAA expertise not required
    • Logic driven questions reduces assessment time
    • Supporting documentation easily attached and managed
    • Generates electronic reports for audits
• • Significantly Reduces Time and Effort
    • Intuitive, step-by-step workflow
    • Provides remediation guidance and support
    • Automates building the body of evidence
    • Reduces man-hours by over 50%
    • Reduces overall cost of HIPAA compliance by 65%
• • Greatly reduces liabilities

Before you buy a HIPAA kit that will sit on your shelves and collect dust or hire a HIPAA auditor/consultant to perform a security risk analysis for you, then leaves you a checklist of issues to correct, you should consider using an online tool that makes you more compliant, in less time and helps you maintain your culture of compliance.

The first post in this two-part series was Value Proposition of HIPAA Compliance.

Take our free mini-Risk Assessment to see how compliant you are.

Protect your patients, protect your practice, protect yourself.

The healthcare industry is beginning to realize that HIPAA is here to stay and they are probably going to be audited sooner or later.  What physicians and all healthcare providers need to understand is that if you don’t protect your patients’ PHI/ePHI the following can happen to your patients as a result of their identity being stolen and used.

NOT Protecting Your Patients’ (PHI/ePHI):

1. You can cause them financial difficulties or even financial ruin.
2. You can cause them undue stress, even a stroke or heart attack.
3. You can cause them to be denied healthcare insurance.
4. You can cause them to be denied healthcare services.
5. You can cause them to be denied medicines, treatments, and therapies.
6. You can cause them to be misidentified during healthcare treatment, causing incorrect operations, procedures, medicines, or even death.
7. You can cause the death of your patient.
8. You will suffer the consequences listed under “NOT Protecting Your Practice”.

You might think, these can’t happen, but all of them have already happened, with the exception of causing a death, but there have been several close calls with death because of identity theft.

What HIPAA “forces” you to do, is what you should already be doing:  operating a safe, secure, efficient, productive, and profitable healthcare provider organization.  That’s right, if you were doing what needs to be done to protect your patients’ PHI/ePHI, you would be HIPAA compliant and you would be protecting your practice (business) and yourself.

NOT Protecting Your Practice:

1. You will likely be breached and lose access to or have your patient’s ePHI stolen.
2. You will receive the maximum fine from the HHS OCR audit, which may close your doors.
3. You will likely have a class action lawsuit by your patients against you.
4. You will have approximately 40% of your patients abandon you and your services.  (People don’t like having their identity stolen.)
5. You will have to pay for the remediation of your HIPAA non-compliance issues with government oversight.
6. You will have to pay for cyber theft protection insurance for all of your patients.
7. You will suffer from negative social media.
8. You will suffer major interruption to your cash flow.

And last but not least, you must realize you need to protect yourself.  The HIPAA law provides for the prosecution of individuals who neglect to protect their patients’ PHI/ePHI or those individuals who destroy, lose, or steal a patient’s PHI/ePHI. If you don’t want to wear an orange jump suit you might want to consider working on becoming HIPAA compliant.

NOT Protecting yourself:

1. You could find yourself sued by patients.
2. You could find yourself fined for failure to protect PHI.
3. You could find yourself found guilty of breaking the law.
4. You could find yourself in federal prison.

Protect your patients, protect your practice, protect yourself.

I would strongly suggest you use a Compliance Management Platform to build the required body of evidence, reduce the work load, increase compliance, simplify electronic reporting and save money while working to become HIPAA compliant.  Check out CompassDB™ at http://compassdb.com/.

If you want to know where you stand with your HIPAA compliance take the free HIPAA Quick-Check.

While meeting all the HIPAA requirements for your technology (computer, network, etc.) requires some planning, there are some quick fixes that can greatly reduce the odds of your organization being breached while at the same time starting you on your path to compliance.

Below are some common issues that we see at all sizes of organizations. How you go about correcting some of them is determined by the size and resources of your organization.

Quick Fix #1

Issue: The operating system (i.e. Windows) on your organization’s computers / laptops is out of date.

Details: Hackers are constantly finding new ways into your computers. If you do not keep your computer up to date, it leaves these vulnerabilities open for attack.

Fix: For smaller organizations you will need to manually check each of your computers to make sure automatic updates are turned on and updating. Alternatively there are centralized patch management systems that can help, if you are running on a Windows domain.

Quick Fix #2

Issue: Weak password! Simple passwords DO NOT WORK!

Details: Hackers can download a tool off of the internet to crack passwords fairly easily. The weaker the password the more likely the hacker will be able to breach your computer and network.

Fix: Require that all users have unique accounts and passwords that are a minimum of 12 characters with a mix of UPPERCASE, lowercase, numbers, and at least one special character (i.e. !@#$%^&*). You should also have your users change their password every 90 days max. If you have a Windows domain you can enforce this with a domain policy.

Quick Fix #3

Issue: Outdated Antivirus

Details: Similar to #1, if your antivirus is out of date, your computers and networks are vulnerable to the latest virus’, malware, and ransomware.

Fix: Check all of your computer’s antivirus software to ensure that it still has an active subscription, is running, and is being updated. Most major antivirus companies have business versions of their product that allow you to centrally manage the antivirus and reduce the likelihood of something happening.

Quick Fix #4

Issue: Lack of trained staff

Details: Staff that has not been trained to watch out for malware in emails or on the web is generally the most likely way for your organization to become a victim of malware or ransomware.

Fix: Ensure the staff is properly trained in HIPAA. There are plenty of online training courses that are neither expensive nor time consuming. While the return on investment may be hidden, it is huge.