The Health Care Compliance Association Regional Conference will be held in Houston on Dec. 8, 2017.
Third Rock’s COO, Ed Jones, PMP, CHSP, will be participating on a panel discussing the importance of Patient Information Privacy along with representatives from THSA and Winstead, PC.

Members of our Third Rock Team will also be in Dallas on Dec.14 & 15 for the Cybersecurity Forum at the Dallas Health IT Summit. The Cybersecurity Forum brings together experts in healthcare IT security and privacy issues to discuss key trends in the IT security/privacy sphere, and the top challenges facing the leaders of patient care organizations in this critical area.

For more information on these events and others, please visit our events page.  We welcome you to attend!  Contact us at info@thirdrock.com if you would be interested in having a member of our team present at one of your events.

The EquiFax breach really has me angry.  Mostly because I have no control over any aspect of this mess.  EquiFax scoops up data on all of us without our consent.  They seem unaccountable and untouchable.   With a last name like mine, I’ve had many opportunities to dispute incorrect data on my credit reports, which is always time consuming and irritating.  They make it known how unimportant you are and assume you are “guilty” unless you prove otherwise.  They collect data on all the people in the U.S. old enough to make purchases using credit, and they don’t even bother to encrypt it!  Worse yet they didn’t even bother to patch their systems after they had several breaches earlier this year!  Talk about arrogant!

Is EquiFax just one bad apple?  Sadly, they are not.  Historically, industries with self-certification of compliance to data protection regulations have woefully low compliance.  Government surveys say the healthcare industry is about 15 percent compliant!  With respect to the credit card industry, they are better than the healthcare industry by a whopping 5 percent!  Eighty percent of businesses fall short.  The insurance and financial industries currently have NO regulations to protect your data!  The “good news” is regulations are being drafted and are being implemented starting with New York state.

I hope EquiFax is a tipping point for the consumers in our country!  It’s time we take control of our data and demand it is properly protected.  Nothing seems safe when each morning news declares there is another data breach and the North Koreans launched another missile! It is alarming and discouraging.  But I shouldn’t have to give away my hard-earned credit score to buy that shiny new toy for my man cave (I wish!) for a low price on the Internet. I shouldn’t have to worry that my most confidential data is in jeopardy because I had my annual physical! Should I buy that insurance policy to protect my family, or will the data I provide on the application fall into the hands of cybercriminals and cause significant damage to my family?

Going forward, I will do my homework when purchasing online by selecting reputable companies and not chasing the lowest price.  I will ask my doctor when was the last time his practice did a security risk assessment and all staff had cyber security training?  Does their medical system encrypt the data at all points (most don’t)?  I will look at my financial and insurance companies with a skeptical eye and make informed decisions.  I will also add my voice to the Equifax failure to better protect my children and their future.

I encourage you to take our confidential free mini-Risk Assessment to see how compliant your organization is. Should you discover you aren’t as compliant as you had hoped, contact us at compliance@thirdrock.com.  We’d be happy to help you improve your score and protect your patients, your practice, and yourself!

One of the first lessons of process improvement is that preventing errors is much less expensive and time-consuming than remedying the damage after the fact. The same is true for an information breach. The time and cost for installing new software, training staff members, and reinforcing policies and procedures pales in comparison to cleaning up the damage of an information privacy or security breach.

Recent headlines of multi-million-dollar OCR fines and the hundreds, thousands – even millions! – of lives affected suggest the scale of the damage to both businesses and individuals. The news reports rarely explain, however, exactly how the breach could have been averted. This is the first in a new series of articles using publicly reported breaches as teaching opportunities for breach prevention. These are not intended as an “I told you so” for the organizations breached – each incident could happen at almost any healthcare organization today. The goal is for all of us to continuously improve our understanding of the risks to patient information and the options available to us for protecting that information without creating an oppressive atmosphere for our patients, staff, and visitors.

Unauthorized photographs of a surgical patient

This first example was reported in the HIPAAJournal just last week. Basically, surgical staff members photographed a patient’s genital injury using their personal phones and shared the photos with friends. Details of the incident are available in the HIPAAJournal post. What we want to focus on here is whether and how management could have prevented this breach.

This incident is particularly egregious because the information disclosed was so sensitive and because so many health care professionals and staff members – the very people charged with keeping the patient and his information safe – were complicit in the violation. I understand that in the face of such irresponsible behavior, a manager might be tempted to feel helpless – “I can’t watch every person every minute. What can I possibly do to make sure none of my staff ever do something stupid?” Here are some suggestions.

Action 1: Policy disallowing use of personal phones in the OR (or any patient area) for any reason.

As a former frontline nurse, I understand the tendency to scoff at policy – “What good’s a policy? People will do whatever they want to anyway!” There’s some truth to that – practice never perfectly matches policy – but what a policy does do is establish clear guidelines for expected behavior.

If the hospital wants staff to have mobile communications, they need to supply them with Vocera badges or other devices and not rely on staff members’ personal telephones. Personal phones can be used at the desk and in the break room, but not in patient areas – period. Responsibility for enforcing the policy must be shared by charge nurses and circulating nurses, not just the department manager or director. A charge nurse found not to be enforcing the policy could be suspended just as if s/he had been using the phone him or herself.

Action 2:  Intensive staff training, retraining, and reinforcement.

The speed and shamelessness with which these staff members brandished their phones suggests gross ignorance of the HIPAA Privacy and Security Requirements and of the potential consequences for violating them – termination, civil charges and fines, and criminal charges that could include probation or jail time.  Staff should receive comprehensive HIPAA training during their orientation before being given access to patients or PHI. That training should then be reinforced with shorter refresher courses and/or routine discussions of patient privacy and information security in staff meetings, organizational Town Hall sessions, and online forums on the organization’s intranet.

Action 3:  Leadership in the moment.

In the OR, the anesthesiologist, the surgeon, and the circulating nurse all possess significant authority. Any one of these individuals could have called a halt, required everyone to power off their phones, sealed the room, and called hospital security to confiscate the phones until someone from IT could sit with each individual involved to clear the photos.

This action is still more Band-aid than prevention, but it is the actions of leaders in the heat of the moment that either reinforce or undermine policy and training. It did sound like the executives were taking the incident very seriously and had applied appropriate sanctions. It may also have been the case that the circulating nurse or surgeon brought the incident to the executives’ attention – that information wasn’t included in the article. The critical takeaway is that protecting patient privacy, confidentiality, and information security are now as important a leadership responsibility as patient safety and infection control.

The above actions, taken together, are the pillars of creating a Culture of Compliance. Whether the focus of the compliance is HIPAA, CLABSI protocols, or hand washing – all require clear expectations, appropriate training, and unrelenting leadership. Culture is powerful – the trick is to create a culture that makes it easy – automatic – to do the right thing.

Our very best wishes to the patient and everyone at UPMC Bedford Memorial trying to remedy the situation.

If you need assistance establishing a culture of compliance please contact us at compliance@thirdrock.com

Protect Your Patients.  Protect Your Practice.  Protect Yourself.™

HealthITSecurity August 16, 2017-Texas covered entities will now have assistance in working toward healthcare privacy and security compliance measures through a recent partnership between the Texas Health Services Authority (THSA) and Third Rock Incorporated.

THSA will utilize Third Rock’s cloud-based compliance management platform, which “streamlines and automates the privacy and security compliance process,” according to a THSA statement.

Sometimes we tend to focus strictly on the technical side of security and compliance and fail to notice the very important issues hiding in plain sight. While a hacker breaking into your network and stealing ePHI is the threat that is being talked about the most, it is sometimes the overlooked old-fashioned threats that present the greater risk.

Think about how many times a patient record has been sitting somewhere and how long does it actually take for someone to pick it up and walk off? What about allowing easy access to documents or equipment that contain sensitive data? Over the years we have seen clients forget some of the simple things that they could do to protect patient information.

Below is a simple walk-through checklist that you can use to recognize and fix security issues that may be hiding in plain sight…

1. Have any documents been left on the counter face up when not in use?
2. Have patient documents been left on a surface that is accessible to patients, visitors, vendors, etc.?
3. Have paper charts been left unattended where someone could grab them while walking down a hall?
4. Are all discarded documents containing PHI shredded or placed in a locked container to await shredding?
5. Have security cameras been installed to track unauthorized access to anywhere patient data could be found?
6. When calling a patient from the waiting room, do staff use only the patient’s name, and preferably only a first name?
7. Have staff logged out of all unattended computers, especially those in exam rooms and publicly-accessible hallways?
8. Do you and your staff lock unattended rooms that could provide access to the network or computer equipment?
9. Is the back door (or other secondary entrance) ever left open or unlocked for any reason?
10. Do you and your staff lock offices when unattended?

Sometimes, just by walking through on a weekly basis you can find simple issues that need to be addressed. We recommend doing this during business hours as you want to see what your visitors see. Not only will this help you be more vigilant in your security, but it will allow visitors to rest easier seeing that you are actively taking steps to protect them and their health information.

Protect Your Patients.  Protect Your Practice.  Protect Yourself.™

info@thirdrock.com | 512.310.0020

In their roles as both care giver and care coordinator, nurses generate, transmit, transcribe, and interact with enormous amounts of information using a dizzying array of devices. Not surprisingly, nurses play a critical role in keeping patients’ protected health information (PHI) safe.

Nurses, you are amazing!! 

In the course of a single hospital shift, a hospital nurse may interact with a single patient’s record 10-20 times – or more – depending on the intensity of the care and length of the shift, while caring for 2-10 patients! (A physician office nurse may interact with 20-50 patient records per day!)  In addition, nurses coordinate patient care activities across departments and facilities, including pharmacy, food service, PT, OT, radiology, lab, respiratory therapy, the OR, and more. Nurses also serve as the primary point of contact for an ever-shifting array of family members and friends. And to make it possible to fit all this activity into a single shift, health systems have equipped nurses with a variety of mobile technologies – workstations on wheels, laptop computers, iPads, mobile phones, and Vocera badges being the most common. And we haven’t even gotten into the details of actually caring for the patients!

 You are also vulnerable to information breaches.

Each time you interact with patient information – whether face-to-face, over the phone, or via one of the many gadgets that occupy your day – your actions either protect or expose patient information. With everything on your plates, it’s easy to understand how you might leave a workstation unlocked and unattended or might misplace a mobile device. Unfortunately, these actions can now have significant negative consequences – for you, your patients, and your organization. Your patient’s identity – and credit – can be impacted for years. Your organization may be heavily fined in addition to paying lawyers’ fees and the cost of notifying affected patients. And you may face civil – and possibly criminal – charges.

Protect your patients. Protect your organization. Protect yourself.

1. Keep your voice low when speaking with patients and colleagues.
2. Only share the minimum necessary information to accomplish the task at hand.
3. ALWAYS lock your work station before stepping away (“Windows” logo key + L).
4. Double-check for mobile devices before leaving a patient room.
5. Store mobile devices in locked drawers or a locked room when not in use.
6. DO use secure email and texting applications.
7. If you must use an unsecure channel, don’t include identifying information in the message.
8. Always validate the identity of an information recipient before disclosing PHI.
9. Don’t use work computers to do personal business or shopping.
10. If you see something, say something!

Thanks for all you do. Keep up the good work!

As a reward for all your hard work, check out these freebie offers from restaurants just for nurses, gathered onto a single page by Brittney Wilson, The Nerdy Nurse.

And if you think your organization could use an easier way to conduct HIPAA Risk Assessments, HIPAA Training, and manage HIPAA documentation, contact us:  info@ThirdRock.com.

“To err is human”… a pretty obvious statement. So if we all know we are going to make mistakes, why not add an extra level of security to mitigate the effects of the mistake?

I am sure we have all been in the predicament of sending John C. an email, but when we clicked on our contacts list we accidentally sent it to John B. I have conversations constantly with clients and friends about encrypting their email to protect themselves and often get the same set of questions…

• “Isn’t that expensive?”
• “How does someone unlock the email I sent?”
• “Won’t that take a lot longer for me to encrypt it?”
• “Why should I take the extra time? The person who gets it will just delete it.”

There seems to be a lack of understanding in the market place of how simple it is to take this one extra step to protect yourself and private information.

This has become an increasingly obvious issue in the healthcare space. The amount of ePHI sent daily between providers, insurers, patients, labs, etc. is vast and sooner or later mistakes will be made. When one patient receives another patient’s records this typically worries the individual who receives it and angers the patient whose information was released – accidentally or not. There are numerous low cost encrypted email services and even most of your standard email platforms come with settings for encryption. Encrypting your email ultimately protects you, your patients, and your practice.

I recently ran across an article that gives a very simple explanation of how encryption works and the advantages. When we do make mistakes and the wrong person can’t open the information, we have ultimately protected everyone with a single, simple step. Let’s do all of mankind a favor and take one small step…ENCRYPT.

I hope you enjoy the article.

https://www.ltnow.com/how-does-email-encryption-work/