The Right Cyber-Talk

I recently taught a cyber security class to a large medical practice.  The goals were to better protect the organization from cyber-attacks and to improve their HIPAA compliance.  This medical practice is a well-run and well-managed business that invests in its employees and is clearly one of the most security conscious practices I have worked with.  The hour-long course covered the cyber security basics including password management, safe Internet practices, phishing, malvertising, and incident resp ...

HIMSS 2018 – Take Aways

I attended the national HIMSS 2018 conference in Las Vegas a few weeks ago.  43,000+ roaming loose in Vegas, primarily in a few hotels and the Sands Expo Center.  It was mayhem.  I attended the Cyber Security Symposium all day Monday.  Six sessions focused on cyber security and best practices.  I then attended the keynote speech by Eric Schmidt, the CEO of Alphabet, the parent company of Google. Tuesday was primarily more sessions and a few minutes out in the expo "acres" wandering around trying to ...

MACRA 2017 deadlines are coming. Do you have a Security Risk Assessment scheduled before December 31st?

Right now the healthcare industry is in the final race to complete the requirements for MACRA, the new reimbursement scheme for Medicare. Thousands of dollars are at risk – failing to satisfy the MACRA requirements in 2017 will result in payment reductions for all of 2019! Submerged within the 2,398 pages of MACRA lies a key requirement for eligibility - completing a security risk assessment (SRA). The SRA is a “core requirement.”  Without an SRA, a healthcare practice can undo all their other eff ...

Check out our own Robert Felps, CEO Third Rock, speaking at two events in November

Robert is taking his  acclaimed “Cure for the HIPAA Headache” presentation on the road this month and presenting at the Developmental Services Network Annual Meeting  on November 6th in La Quinta, California. He then heads to Dallas on November 16th for the IQSC First Annual Healthcare Data Seminar. Contact us at info@thirdrock.com if you would like a copy of the presentation or would be interested in us presenting at one of your events.   Bio - Robert Felps, CEO/CISO - is a trusted advi ...

HIPAA Compliance is a Business Decision

A couple of weeks ago, I was talking with a technology vendor who is starting to move into the healthcare space. Their technology isn’t used in the creation or manipulation of patients’ protected health information (PHI), but they do store information on behalf of healthcare organizations that could potentially include PHI. They wanted to know, “Are we required to comply with HIPAA?” Technically – yes. On the other hand, there are hundreds of healthcare organizations and healthcare vendors who act ...

National Health IT Week – FREE Assessment

It's National Health IT Week and Third Rock is promoting the value of Health IT and its role in protecting your patients, your practice and yourself with a FREE assessment. Just click below to take your free risk assessment to better understand your practice's security risk from cyber threats. It only takes a few minutes! Let's Get Started Join the movement to improve Health IT to improve patients' health.  Checkout our HIPAA and Cybersecurity Resources page at https://thirdrock.com/resources/ ...

Could this breach have been prevented? – A new series

Could this breach have been prevented? – A new series One of the first lessons of process improvement is that preventing errors is much less expensive and time-consuming than remedying the damage after the fact. The same is true for an information breach. The time and cost for installing new software, training staff members, and reinforcing policies and procedures pales in comparison to cleaning up the damage of an information privacy or security breach. Recent headlines of multi-million-dollar ...

Thank Goodness! NIST says, “No more difficult passwords!”

Just when you thought all hope was lost of remembering your 16 character password with upper and lower case letters, numbers, and special characters; NIST comes to the rescue. That's right!  The National Institute of Standards and Technology wrote a brief addendum to SP 800-53 which simplifies Strength of Memorized Secrets.  You and I refer to those "secrets" as passwords.  It's a light read, only 50 or 60 pages.  I don't really know because I didn't want to print it and kill four trees.  Anyway, the ...

Think you can take your time when breached? Think Again!

In January of this year, the HHS Office of Civil Rights levied a $475,000 fine against Presence Health for taking too long to notify their patients - as well as the OCR - after discovering the breach of PHI (protected health information). The incident occurred in October 2013 when Presence Health, based in Illinois, discovered that hundreds of physical documents containing patient names, birth dates, medical record numbers, and surgery details for 836 patients were missing.  They did not report the breach ...

What happens when someone submits a HIPAA complaint?

You may not realize how easy it is for someone to submit a complaint about your organization. However, if you are not prepared, what happens after that submission is not something you will soon forget! This is why HIPAA compliance must be a culture and not just a piece of paper. While someone WILL submit a complaint against you at some point, if you have a culture of compliance in place, there should be little to no effect on your business. If you just run through a simplified checklist once a year, howeve ...

1 2 3 4 5 6 7