All Data Fast News is © Data Fast Solutions, unless where otherwise indicated • All Rights Reserved
Keep up to date with Data Fast Solutions for your business.
Since the inception of HIPAA in 1996, health information managers have been tasked with keeping the security of patient data in check. However, as technology continually progresses, this becomes more challenging for all healthcare professionals and their associates. This is especially true for remote and wearable technology used outside of a doctor’s office where personal health information (PHI) is much more difficult to control. HIPAA does have guidelines in place stating that patient information collected by a doctor provided wearable device will be covered under HIPAA.
Wearable technology includes commercial consumer products such as fitness trackers as well as products manufactured for remote healthcare monitoring by physicians and other healthcare personnel. Fitness trackers, such as the highly popular Fitbit, are not controlled by HIPAA unless that data is shared with a doctor’s office. Once shared, it falls under the restrictions of HIPAA, so health care providers must ensure that the data is not compromised. Outside of commercial products, remote data downloads occur daily for patients who may be under a physician’s care for any number of health related issues from diabetes to cardiac care to sleep apnea.
It is also not only the data which is at risk. Any remote transfer of healthcare data which is vulnerable can put a patient in physical danger as well. In 2016, a medical device researcher with Johnson & Johnson discovered that remote controlled insulin pumps were susceptible to an outside attack. This was because the communications between the wireless device and the insulin pump were not encrypted. However, a more malicious attack could have occured, according to the Johnson & Johnson researcher, due to the fact that the pairing between the remote devices was weak. Due to that, an outside attacker could access the patient’s remote device and administer additional, deadly, doses of insulin.
Technological advances in healthcare such as remote, real time monitoring of patient data, have gone far beyond what some would have imagined when HIPAA was enacted in 1996. As new technology evolves, healthcare I.T. developers and manufacturers have learned to work in conjunction with revised HIPAA regulations to ensure compliance prior to delivery. Most wearable devices are now manufactured with strict HIPAA compliance to ensure data is secure. Remote data is now shared much more securely with increased encryption in place.
As this type of technology continues to progress, it is the healthcare organization, and their covered entities, who are held responsible for keeping PHI secure. That does not mean that healthcare providers have to tackle all aspects of HIPAA compliance alone. Technology professionals can provide technical processes that can help. From implementing separate networks for shared data, to encryption, to multi-factor authentication, technology experts can help ensure remote and wearable technology data is never compromised. In addition to the technology itself, assistance with ongoing technology training can add an extra layer of protection against HIPAA breaches. No matter what technology is utilized, partnering with an I.T. company who is highly trained in HIPAA compliance can help ease the burden of making sure PHI is consistently kept safe.
This article is ©2018 Data Fast Solutions • All Rights Reserved
Voice activated virtual assistants such as Apple’s Siri, Amazon’s Alexa and Google’s Assistant, are utilized more and more by people across the globe, but it’s important to know that virtual assistant technology used by healthcare professionals is not as simple as speaking into your smartphone. An article published last spring by Harvard Business Review states that “in a nationwide survey of pediatricians conducted by Boston Children’s Hospital (not yet published), 62% of respondents said they have used voice-assistant technology, and one-third own, and use, at least one smart speaker.” While voice dictation technology has been around for decades in the medical field, smart speakers and smartphones with virtual assistant software can obviously do much more. However, this technology has yet to become HIPAA compliant so attempting to use it in conjunction with sensitive patient information leaves oneself open for some serious violations.
As we have discussed in previous blogs, Ransomware hackers routinely target the medical field for private health information which can be lucrative for them. Increasingly, these hackers are focusing their attacks on smaller offices which do not always utilize the best I.T. services available to them. This makes vulnerable devices, such as those utilizing virtual assistant software more susceptible.
In addition to possible hacking, it’s common knowledge that voice activated software can be challenging when trying to utilize it for simple tasks such as a grocery lists. So, attempting to use the current technology to convey complicated medical terminology or relay the names of many pharmaceuticals just doesn’t make sense. Until there are safeguards in place which can guarantee healthcare related tasks are not vulnerable to mistakes, virtual assistant technology simply cannot be utilized effectively in a healthcare setting.
While virtual assistant software is not currently HIPAA compliant, there have been ways it has been able to offer general medical advice not bound by HIPAA. Amazon Alexa’s KidsMD, launched in 2016 in conjunction with Boston Children’s Hospital, and provides health advice to parents regarding their children’s fever and medication dosing. The app can be downloaded to any Alexa enabled device such as Amazon Echo, Echo Dot, Amazon Tap and Amazon Fire TV and gives parents the ability to ask about different symptoms that their child may be experiencing from fever and cough to shortness of breath or unusual fatigue. Parents or caregivers can also ask about weight and age guidelines as they relate to over-the-counter drug dosages.
Other ways VA’s are currently being utilized are through a patient’s own, personal device for medication reminders and finding out more about medical terms and definitions. So, the technology is useful for some patients.
According to the pediatricians surveyed by Harvard Business Review, only 16% stated that they would not try virtual assistant technology. However, many who would try it, said they were less likely to do so while treating their patients due to a patient’s possible reaction to what was recommended by the virtual assistant or the doctor overriding recommendations made by the technology. One way in which doctors thought voice assistants could be utilized in the future was in populating medical questionnaires prior to an office visit to help save time. In addition, 55% of doctors surveyed were not entirely confident about the reliability of answers provided by virtual assistant technology. 68% said that knowing the content came from a reliable source such as Boston Children’s Hospital would make them more confident in utilizing the information provided.
While physicians and other healthcare professionals may be tempted to use voice activated virtual assistants in some aspects of their jobs to save time, attempting to use them with HIPAA protected data can be detrimental. Until the technology is fully HIPAA compliant, it is recommended by HIPAA certified I.T. professionals, such as Data Fast Solutions, that virtual assistant technology be left for simpler tasks in a user’s day-to-day personal life.
According to HHS.gov, the use of encryption is not mandatory, it is “addressable” rather than “required”. However, a Health and Human Services administrative law judge (ALJ) recently ruled that the University of Texas M.D. Anderson Cancer Center must pay 4.3 million in fines for failure to safeguard patient information on unencrypted devices. According to Health Leaders Media, M.D. Anderson made the decision to encrypt all devices in 2008, but by 2013 had still not done so. The breaches were reported by M.D. Anderson to OCR in 2012 and 2013 and involved an unencrypted laptop, which was stolen, and two unencrypted thumb drives which were lost. The laptop contained electronic protected health information (ePHI) of more than 29,000 people while both thumb drives contained ePHI of 5,800 people combined. M.D. Anderson plans to appeal the decision.
This recent ruling is a reminder that implementing new ePHI policies in healthcare organizations and covered entities must be done expeditiously. A vital factor in securing ePHI is fully utilizing encryption. It is a crucial link in security which can thwart hackers and thieves, yet so many in healthcare have yet to adopt it. Why it is not used more extensively is not fully known. Affordable encryption technology has been available for quite some time. It can be complicated for those not well-trained in implementing it. However, it is now more apparent that an administrative law judge would not view any excuses for lack of encryption as viable for leaving ePHI vulnerable. So, putting together a plan for encryption and implementing that plan quickly is important to do before a breach can take place.
The National Institute of Standards and Technology (NIST) has published, Guide to Storage Encryption Technologies for End User Devices. This guide can give IT and security personnel at healthcare organizations, or their covered entities, excellent information on encryption. It can provide “real-world guidance for three classes of storage encryption techniques: full disk encryption, volume and virtual disk encryption, and file/folder encryption. It also discusses important security elements of a storage encryption deployment, including cryptographic key management and authentication.” While this guide only discusses the encryption of data at rest, not the encryption of data that is transmitted, it can be a good way to educate healthcare entities on how to plan, implement, and maintain storage encryption solutions.
Implementing encryption is not an easy task for small or large healthcare offices alike. Using guides like the one published by the NIST is a good start but making sure to utilize IT companies with encryption experts can make the process much easier. Those trained in encryption can make sure that if a HIPAA data breach occurs, no ePHI will be vulnerable. If M.D. Anderson would have fully implemented their decision to encrypt their devices in 2008, they would not be faced with a 4.3 million dollar fine.
From planning to implementation and on-going support, an IT company like Data Fast Solutions can make sure your encryption plan is rolled out effectively. Contact Data Fast Solutions for more information today!
In February 2017, we wrote about Healthcare System Configuration and Collaboration with the help of SAFER Guides, originally published in 2014, by the Office of the National Coordinator for Health (ONC). The SAFER Guides, or Safety Assurance Factors for EHR Resilience, were updated in 2017 and put together to assist healthcare organizations with electronic healthcare record (EHR) implementation and safety.
However, a recent study shows that many healthcare organizations do not adhere to the recommended safety practices contained in the SAFER Guides. The study found that healthcare companies do tend to follow more of the technical recommendations, but just 18%, or 25 of 140 SAFER recommendations, were fully implemented.
As we stated in our previous blog, using a SAFER Guide for EHR implementation is not mandatory, but they do provide useful tools to ensure EHR’s are not left vulnerable. The SAFER Guides, used along with a HIPAA Certified I.T. company, can ensure that the technical aspects of EHR implementation are covered, but not utilizing the guidelines, fully, can result in the safety of electronic health records being at risk.
“Of the 11 recommendations most likely to be ‘not Implemented,’ most (9 of 11) were from 3 guides: Test Results Reporting, Communication and CPOE/CDS, with 4 from the CPOE/CDS guide alone,” researchers wrote. “Conversely, all System Interfaces and Contingency Planning guide recommendations were implemented by at least one site.”
One of the most important findings in the study suggests that, according to researchers, “the guides may also assist in driving culture change regarding organizational learning related to evaluation and improvement of the EHR”. However, “this has historically been seen as the sole responsibility of the IT department rather than as shared responsibility among stakeholders across the entire organization in conjunction with EHR vendor.” This is important because EHR safety does not happen solely from within the technical department or team.
The SAFER Guides specifically state that a multi-disciplinary team should complete the self-assessments and evaluate potential health IT-related patient safety risks addressed by the specific SAFER Guide within the context of a particular healthcare organization. The checklists and worksheets are designed as simple tools to make sure all aspects of EHR are considered. Utilizing the guides, as they were intended, can increase the likelihood of implementing and utilizing EHRs safely and effectively.
Data Fast Solutions is HIPAA I.T. Certified and can assist your organization in utilizing the SAFER Guides effectively to ensure a safe EHR implementation and continued EHR safety. Contact Data Fast Solutions today!
General Data Protection Regulation, or GDPR, is due to take effect next month and many in healthcare in the U.S may wonder how it affects them. Per the GDPR portal, it “was designed to harmonize data privacy laws across Europe” and relates to those residing in the EU. However, it does have far reaching effects into the United States due to how personal data is collected, used, disclosed and processed by controllers and processors. Simply put, controllers determine the “purposes, conditions and means of processing personal data”, while processors are those who process “personal data on behalf of the controller”.
American healthcare organizations may think that GDPR is already completely addressed through U.S. HIPAA regulation, however, that is not necessarily the case. An article, published in February of this year, by The National Law Review, Does GDPR Regulate Clinical Care Delivery by US Health Care Providers?, helps address the specifics of GDPR as it relates to U.S. healthcare. Per the article, the GDPR does not have direct reach to personal data processing by a U.S. controller or processor if the business is:
· Not physically located in the EU
· Not offering goods and services through advertising or direct marketing to individuals in the EU
· Not monitoring the post care of individuals treated in the U.S.
With many smaller U.S. healthcare offices, all three of the criteria may not apply. However, post care of those located in the EU may occur, so GDPR would need to be strictly enforced to avoid stiff penalties.
The key in healthcare providers having to adhere to GDPR in the U.S. pertains to the location of an individual in the EU, not their EU citizenship. So, if you’re treating an EU citizen who resides in the U.S., HIPAA laws, not GDPR, would apply. If you are providing post care to an individual who resides in the EU, HIPAA and GDPR must be followed.
It’s important to understand that HIPAA relates to the privacy of protected health information (PHI) while GDPR, according to the article above, relates broadly to personal data, health related or otherwise, which is “any information relating to an identified or identifiable natural person who is in the EU, regardless of the individual’s EU citizenship status.”
The broader terms of GDPR, as opposed to HIPAA are outlined in the HIPAA Journal article, Understanding GDPR Compliance, published last January, which states:
Any body which collects, maintains or uses an individual´s personal data but neglects to first acquire the informed consent of those persons, or does not delete destroy their record of the data concerned after an individual has withdrawn their consent – breaches the GDPR. There are numerous other rights of individuals that must be taken into account by companies or organization[s] when they review their GDPR compliance. These rights of individuals include [but are not limited to]:
In addition, the IAPP (International Association of Privacy Professionals) gives a good side-by-side comparison of HIPAA and GDPR. If you are an American healthcare entity, it’s important to be informed about GDPR as it must be strictly adhered to beginning next month. Data Fast Solutions can assist you in making sure your healthcare I.T. services meet both GDPR and HIPAA regulations. Contact us today!
Some I.T. professionals simply provide a service and rely on the technology, itself, to work as it should. This approach may be okay for some industries, but it’s especially harmful if it’s done within healthcare and it can lead to increased breaches. As trained HIPAA I.T. professionals, Data Fast Solutions not only provides secure I.T. services, but stays informed on what’s working well to provide clients with the best, knowledgeable service.
Recent data suggests that while I.T. provides the healthcare sector with many advances in patient data and care, healthcare data breaches are still increasing. In analyzing the reasons behind the breaches, Verizon’s 2018 Protected Health Information Data Breach Report found that in almost 60 percent of 1,368 security incidents, occurring in 27 countries, breaches were due to insiders or employees. Almost three-quarters of the reported incidents were in the United States.
Researchers also found that insiders being the source of breaches is unique to healthcare and they are driven by:
The study also confirmed the research published by the American Journal of Managed Care which found that paper and film were the most common locations for data breaches. In the cases studied, it occurred in 27% of incidents.
Additionally, the report found the following categories in the breaches that they studied:
It’s obvious, by the report, that a reduction in paper data, along with more secure systems in place, can result in a reduction in the amount of security breaches. The authors of the report suggest full disk encryption (FDE) and routinely monitoring record access just as Data Fast Solutions has always recommended. However, the report also points to the need for more robust policies and procedures within a healthcare organization to combat error across all categories. How policies and procedures are changed to address the issues is unique to each organization but being proactive is key.
There are hundreds of cases in the news of breaches within healthcare that are occurring with an almost knee-jerk reaction of analysis after the fact. Just as the Verizon report shows, the approach to breaches is almost always the same. Focusing on securing ePHI and increasing training for employees is recommended and should not be taken lightly, but information provided by the media suggests that these recommendations are falling on deaf ears. That is not necessarily the case.
Perhaps, more importantly, is the need for analysis on what is working right. Data provided to healthcare I.T. professionals regarding organizations who have successfully thwarted attacks as a study in success, rather than failure, may not be newsworthy, but can possibly help more. While some healthcare companies may experience a breach, many more are using HIPAA trained I.T. professionals like Data Fast Solutions who have the knowledge and expertise to assist with I.T. policies that work. Technology, like people, is never perfect, but Data Fast Solutions learns from data breach analysis and focuses on what works well to keep PHI safe.
Healthcare industry data breaches have, unfortunately, become a more frequent occurrence in recent years. This information is tracked through the Health and Human Services (HHS) online breach portal. The portal has been dubbed the “Wall of Shame” and shows a higher rate of breaches over the past three years. It was put in place in 2009 to provide data, as required by section 13402(e)(4) of the HITECH Act, to “post a list of breaches of unsecured protected health information affecting 500 or more individuals.” Although the information provided contains the type and location of the breach, the portal does not provide more specifics which could help healthcare officials and I.T. professionals learn more about why the breaches are occurring.
Tracking trends in healthcare breaches is the key and the Protenus Breach Barometer is one of the best ways to reveal those trends. It utilizes data compiled by DataBreaches.net to provide a monthly snapshot which can be used to better combat specific issues. Prior year data, month over month, reveals that hacking and issues occurring from within healthcare organizations are the two main culprits of the data breaches. Those inside Issues include mistakes made by staff as well as malicious attempts by employees to obtain secure data.
As we have mentioned in previous blog posts, technology is not always fail proof when it comes to human error, but consistent employee training and everyday awareness can reduce the rate at which errors occur. Training all staff to constantly be aware of malicious attempts by insiders to steal electronic personal health information (ePHI) can help thwart an attack before it occurs. Simple, daily, communication can help raise awareness and keep all employees on alert. In addition, with the increasing rate of breaches, increasing the rate at which healthcare data audits are performed can help limit damage should employee errors occur.
Addressing issues outside of an organization that involve hacking can be much more difficult. Hackers are increasingly more sophisticated in their attempts at obtaining highly valuable healthcare data than they have been in the past. However, just as hackers are persistent, highly reputable I.T. companies, such as Data-Fast Solutions, are just as persistent at stopping them. Through on-going education, training, and analyzing data breach trends, the healthcare I.T. industry is constantly learning new ways to progress.
With healthcare information technology, knowledge of issues after they occur is not enough. In addition to current technology, and ethical employees who understand the importance of protecting ePHI, getting to the root of data breach problems will help organizations become more proactive in their on-going approach. For assistance with your healthcare I.T. audit or to implement a more secure healthcare system for your organization, contact Data-Fast Solutions today.
In a previous blog, we discussed appointing a HIPAA Privacy and Security Officer and all of the duties that the officer may perform as set forth by the American Health Information Management Association (AHIMA).
In addition to those duties, an important task is to regularly audit your healthcare company to ensure overall HIPAA compliance. Part of your company’s audit should be to make sure Business Associate Agreements are up-to-date and include revisions, required under the Omnibus Final Rule, that the business associate will stay HIPAA compliant.
The HIPAA Omnibus rule (section 164.103) states that a covered entity may be a business associate of another covered entity and a business associate includes:
(i) A Health Information Organization, E-prescribing Gateway, or other person that provides data transmission services with respect to protected health information to a covered entity and that requires access on a routine basis to such protected health information.
(ii) A person that offers a personal health record to one or more individuals on behalf of a covered entity.
(iii) A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate.
(4) Business associate does not include:
(i) A health care provider, with respect to disclosures by a covered entity to the health care provider concerning the treatment of the individual.
(ii) A plan sponsor, with respect to disclosures by a group health plan (or by a health insurance Issuer or HMO with respect to a group health plan) to the plan sponsor, to the extent that the requirements of § 164.504(f) of this subchapter apply and are met.
(iii) A government agency, with respect to determining eligibility for, or enrollment in, a government health plan that provides public benefits and is administered by another government agency, or collecting protected health information for such purposes, to the extent such activities are authorized by law.
(iv) A covered entity participating in an organized health care arrangement that performs a function or activity as described by paragraph (1)(i) of this definition for or on behalf of such organized health care arrangement, or that provides a service as described in paragraph (1)(ii) of this definition to or for such organized health care arrangement by virtue of such activities or services.
To ensure your business associates remain HIPAA compliant, Data-Fast Solutions recommends that your HIPAA Privacy and Security Officer audit your business associates on a regular basis. This is extremely important because the duties they carry out, as a covered entity, make you liable for any penalties occurred for violations committed by them.
Some ways to audit a business associate include asking about their security systems in place and:
As HIPAA Certified I.T. professionals, Data-Fast Solutions can assist you with an I.T. audit to ensure your company, and your business associates, are HIPAA I.T. compliant. Contact us at (817)380-3188 for more information.
In a previous article, Small Healthcare Providers and HIPAA Compliance, it was noted that many small to mid-sized healthcare offices are less likely to appoint a HIPAA Privacy Officer and a HIPAA Security Officer. Part of the challenge is that privacy and security officers are hard to find across many sectors. The healthcare industry, requiring candidates with in-depth knowledge of HIPAA and HITECH, can make filling the position even more difficult. However, as HIPAA rules and technology continue to evolve, this is one area where adhering to the HIPAA mandate can keep smaller offices from experiencing a privacy breach.
Understanding the responsibilities of each officer can help smaller organizations find existing or new employees who may fit the requirements with little or no additional training.
According to the American Health Information Management Association (AHIMA), a privacy officer’s responsibilities include:
AHIMA describes the responsibility of a HIPAA Security Officer as one who:
It’s important to note that if one individual meets the requirements of both officers it is acceptable for one person to perform both roles. However, many smaller offices tend to appoint an existing office or billing manager to the privacy and security position. In doing that, one or more privacy and security duties may not be performed adequately. So, it is okay for some work to be delegated to others if the privacy and security officer makes sure that the work is carried out properly.
For assistance from an I. T. security standpoint, a HIPAA knowledgeable I.T. professional can help. Data Fast Solutions has been providing HIPAA I.T. services in the Dallas Fort Worth area for many years. If you have any questions about your information technology and HIPAA compliance, contact Data Fast Solutions today!
This article is ©2017 Data Fast Solutions • All Rights Reserved
The HIPAA Security Rule was established to provide national standards regarding electronic personal health information (ePHI). In relation to the security rule, administrative security standards were created to address different areas of concern in relation to ePHI. One important piece is password management which states “the covered entity must implement procedures for creating, changing, and safeguarding passwords.” The following information provides some guidelines in relation to the security standards for passwords.
To create a strong password, use the criteria below.
A password is only strong if:
Having a system that prompts users to update their passwords every three months or so seemed like a good idea in the past. However, current data suggests that changing passwords too frequently can make them less secure. A blog written for the Federal Trade Commission, by Chief Technologist, Lorrie Cranor, “Time to rethink mandatory password changes” states that when users are required to change their passwords frequently, they often select weaker passwords leaving them more open to attackers. A good rule of thumb is to review passwords and storage of passwords on a yearly basis and create new ones based on complex password creation criteria at that time.
With increasingly complicated passwords and different passwords for every site, storing passwords is almost always necessary to be able to remember them. However, the storage must be secure. Writing passwords on a piece of paper when it’s accessible to others is like storing passwords in your computer, or smartphone, without using encryption and both leave your passwords vulnerable to misuse.
After reviewing and updating less secure storage methods, it’s important to securely delete any current passwords stored elsewhere. This can be done using a shredding software to safely erase existing files.
Passwords are meant to safeguard data and the user from unscrupulous attacks. Following the guidelines above can help your healthcare organization implement, or update, password procedures to ensure your ePHI is secure. Data Fast Solutions is always available to help your company with any of your HIPAA compliant technology needs. As certified HIPAA technology experts, we specialize in all aspects of keeping your ePHI safe.