All Data Fast News is © Data Fast Solutions, unless where otherwise indicated • All Rights Reserved
Keep up to date with Data Fast Solutions for your business.
The HIPAA Security Rule was established to provide national standards regarding electronic personal health information (ePHI). In relation to the security rule, administrative security standards were created to address different areas of concern in relation to ePHI. One important piece is password management which states “the covered entity must implement procedures for creating, changing, and safeguarding passwords.” The following information provides some guidelines in relation to the security standards for passwords.
To create a strong password, use the criteria below.
A password is only strong if:
Having a system that prompts users to update their passwords every three months or so seemed like a good idea in the past. However, current data suggests that changing passwords too frequently can make them less secure. A blog written for the Federal Trade Commission, by Chief Technologist, Lorrie Cranor, “Time to rethink mandatory password changes” states that when users are required to change their passwords frequently, they often select weaker passwords leaving them more open to attackers. A good rule of thumb is to review passwords and storage of passwords on a yearly basis and create new ones based on complex password creation criteria at that time.
With increasingly complicated passwords and different passwords for every site, storing passwords is almost always necessary to be able to remember them. However, the storage must be secure. Writing passwords on a piece of paper when it’s accessible to others is like storing passwords in your computer, or smartphone, without using encryption and both leave your passwords vulnerable to misuse.
After reviewing and updating less secure storage methods, it’s important to securely delete any current passwords stored elsewhere. This can be done using a shredding software to safely erase existing files.
Passwords are meant to safeguard data and the user from unscrupulous attacks. Following the guidelines above can help your healthcare organization implement, or update, password procedures to ensure your ePHI is secure. Data Fast Solutions is always available to help your company with any of your HIPAA compliant technology needs. As certified HIPAA technology experts, we specialize in all aspects of keeping your ePHI safe.
This article is ©2017 Data Fast Solutions • All Rights Reserved
Recent natural disasters, such as Hurricane Harvey in Texas and Hurricane Irma in Florida have, once again, put the spotlight on the importance of healthcare contingency planning. When a catastrophic event takes place, it's imperative for any business to have a back-up plan and be up and working again as soon as possible. This is especially true in healthcare. Many in the healthcare industry have contingency plans in place as required. However, testing and updating the plan as the needs of the business, and those employed by the business, change is imperative to the plan working properly should the need arise to use it.
Electronic Personal Health Information (ePHI) is an integral part of any healthcare contingency plan and the HIPAA Final Security Rule, Section §164.308(a) (7), “requires the establishment and implementation of procedures for responding to events that damage systems containing electronic protected health information”. This requirement is outlined in the Health and Human Services’ Information Technology Contingency Plan template. The template, designed for HHS, can be a useful tool for any company. It’s a comprehensive plan for all the I.T. systems in an organization should a natural disaster or other catastrophic event take place.
As with any good contingency plan, the HHS plan establishes procedures to restore ePHI through notification, recovery, and reconstitution. The template also provides a sample contact list which is formulated to provide a line of succession for individuals with decision making authority. It also identifies the team who is responsible for enacting the contingency plan and the team’s responsibilities. In addition, and an integral part of the plan, is to establish criteria for validation and testing of the plan between the business owner and the system developer at least once a year.
The HHS I.T. contingency plan can be found with a simple Google search as can other, similar, back-up plans for HIPAA related data. However, some smaller health care organizations may not have an in-house system developer on staff. When it comes to HIPAA related data and keeping electronic protected health information (ePHI) safe, it’s important to have a knowledgeable and experienced I.T. company. An I.T. professional who can help with constructing a workable plan custom designed for the specific needs of the business will help save time and money.
Data Fast Solutions can assist with testing and continued maintenance of a contingency plan through modification, or the creation of a new plan, to make sure it coincides with any new systems put in place. As HIPAA Certified I.T. Professionals, Data Fast specializes in ePHI and restoring it quickly, so lifesaving data is readily available should a catastrophic event take place.
While medical record retention requirements are not governed by the HIPAA Privacy Rule, state laws generally do provide direction on how long medical records should be kept. However, per Health and Human Services, the HIPAA Privacy Rule requires that covered entities apply appropriate administrative, technical, and physical safeguards to protect the privacy of medical records and other protected health information (PHI) for whatever period such information is maintained by a covered entity, including through disposal. (See 45 CFR).
Many healthcare providers today are utilizing electronic medical records in their day-to-day practice even if older charts have not yet been migrated completely. With technology rapidly advancing, it can be a challenge for medium and small healthcare facilities to navigate the rules and regulations of HIPAA and state laws as well as the technology needed to retain electronic protected health information (ePHI) safely.
However, there are some helpful guidelines by Health and Human Services to help ensure ePHI is being managed and retained securely.
The Privacy and Security Guide provides a specific section on working with electronic health records (EHR) and health I.T. developers to help understand the privacy and security practices put in place. It reads as follows:
“When my health IT developer installs its software for my practice, does its implementation process address the security features listed below for my practice environment?
o ePHI encryption
o Auditing functions
o Backup and recovery routines
o Unique user IDs and strong passwords
o Role- or user-based access controls
o Auto time-out
o Emergency access
o Amendments and accounting of disclosures
• Will the health IT developer train my staff on the above features so my team can update and configure these features as needed?
• How much of my health IT developer’s training covers privacy and security awareness, requirements, and functions?
• How does my backup and recovery system work?
o Where is the documentation?
o Where are the backups stored?
o How often do I test this recovery system?
• When my staff is trying to communicate with the health IT developer’s staff, how will each party authenticate its identity? For example, how will my staff know that an individual who contacts them is the health IT developer representative and not a hacker trying to pose as such?
• How much remote access will the health IT developer have to my system to provide support and other services? How will this remote access be secured?
• If I want to securely email with my patients, will this system enable me to do that as required by the Security Rule?”
The additional section on cybersecurity is especially helpful as cloud based storage of ePHI is more prevalent. This section has a link to the HHS Security Risk Assessment Tool at:
This can be useful for small to medium-sized health care practices and their I.T. professionals.
As technology changes and improves quickly, it may be helpful for healthcare professionals to know that there are HIPAA trained I.T. professionals such as Data Fast Solutions who can assist them effectively.
When it comes to electronic personal health information (ePHI), there is no lack of guidance for healthcare professionals on how it should be handled to remain HIPAA compliant. However, the way in which ePHI is exchanged is rapidly changing and a patient must consent to an electronic health information exchange (eHIE). Some providers have a simple “opt in” or “opt out” option, but this should not be a simple “yes” or “no”. Meaningful consent is required. HHS.gov describes meaningful consent as “when the patient makes an informed decision and the choice is properly recorded and maintained”. In addition, according to HHS, the meaningful consent should have the following six aspects in regard to a patient’s decision:
Ironically, with many healthcare providers, patient consent is not obtained electronically, but through paper form. The Office of the National Coordinator for Health Information Technology (ONC) has put together a toolkit to encourage healthcare organizations and providers to offer patients the ability to provide meaningful consent, or non-consent, through technology.
There is a trial project for e-consent underway and it’s easily obtainable through the ONC’s e-consent toolkit. The toolkit is not an all-encompassing, straight out of the box, way for an organization to immediately implement e-consent. However, it does offer well-researched examples of how to implement a technological approach to meaningful consent. The ONC e-Consent Trial Project put together a way to gather a patient’s input on consent, educate them about eHIE, and capture and store this information electronically.
The toolkit includes planning resources which include an example survey for patients to obtain what patients need to know before making a meaningful consent decision. The toolkit also contains educational materials, texts, and stories, and, of course, technical resources. The technical resources for providers includes a helpful eConsent Story Engine Tool which can display educational material to patients and allows for electronically capturing patients’ signatures. Also, for implementers of the tool, there are video tutorials in regard to the e-Consent Story Engine Tool, architectural analysis and technical standards for computer software and hardware for the Story Engine installation on a web server, an installation guide, and a user guide.
As technology continues to evolve in the healthcare industry, just as meaningful consent is required from patients, it makes sense to utilize technology in a meaningful way. Utilizing helpful resources such as the ONC’s e-Consent Toolkit can help your organization lessen paperwork and redundancy. Data-Fast Solutions can help your organization utilize the e-Consent Toolkit and other technical resources to ensure your company is functioning more efficiently.
Since HIPAA was enacted over two decades ago, the top reasons for HIPAA breaches have remained constant. Even with the possibility of incurring hefty fines, which have exceeded billions, healthcare organizations continue to be vulnerable to HIPAA related threats.
The top reasons for HIPAA breaches continue to include:
- Lost or stolen devices
- Improper disposal of devices
- Employee dishonesty
- Third-party (or business associate) disclosure
To be proactive and avoid possible HIPAA violations, it’s important to be aware of these issues and communicate them as effectively as possible. Educating others about common HIPAA violations can help diminish occurrences, but training for HIPAA must be done efficiently and, most importantly, consistently to be effective.
Training which includes employee and business associate involvement can increase retention of the information being presented. One of the most effective training techniques is done through role playing by assigning employees specific tasks to carry out in a team environment. The team works together to accomplish a common goal which can encourage communication about the importance of possible HIPAA violations. This type of training also encourages awareness about possible dishonest employees or business associates. Other, more traditional, training can be done in a classroom setting, once a quarter, or, preferably, more frequently if time allows.
Another way to ensure the people in your healthcare organization are HIPAA-aware is through on-going, weekly, email communication. This can include notices about well-known breaches in the news such as the recent “Wanna Cry” ransomware attacks. These notices can be a reminder to employees to follow important HIPAA guidelines on a regular basis. Technology alerts within commonly used software have also shown to be highly effective. For example, setting pop-up reminders to backup important data on a consistent basis can thwart ransomware attacks.
Hardware used by employees outside of the office or hospital can be equipped with software to disable it should the device be lost or stolen, however, timing is key. So, this is not always as effective as an aware employee who knows the importance of keeping devices secure inside, and outside, a work setting. Providing clear instructions on how to dispose of hardware containing sensitive, HIPAA-related data is imperative as well, yet not having a specific process and procedure in place for hardware disposal can make it confusing to some employees.
The top reasons for HIPAA breaches are not unavoidable if employees are kept alert and involved. Most people affected by these types of breaches are not those whose jobs involve cyber security on a regular basis. This is why hackers and thieves find it so easy to boldly prey on a healthcare organization’s vulnerabilities. However, as technology evolves and most healthcare organizations are utilizing it more and more, there is a greater threat for a breach. This is why it can be much more cost effective to hire a company such as Data Fast Solutions, who specializes in HIPAA security, rather than be faced with high fines and fees for a breach that could have been avoided rather easily.
HIPAA breaches are not something that a healthcare organization wants, or expects, to occur and one of the top culprits continuing, and showing no signs of diminishing, is ransomware. Per the Ransomware and HIPAA Fact Sheet, published by Health and Human Services, on average, there have been 4,000 daily ransomware attacks since early 2016. These attacks were across all industries and affected individuals as well. Estimates show that in 2016, ransomware resulted in costs of over a billion dollars making it one of the most lucrative malicious acts carried out by criminals. Over a year later, well into 2017, ransomware attacks are still a serious problem.
As many in healthcare now know, ransomware is malware, a type of malicious software, used to attempt to high-jack a computer system in exchange for payment. As these attacks have risen, many healthcare organizations are unsure of whether they should be held liable for hackers’ unscrupulous access of HIPAA protected data. In answer to this, and other questions, Health and Human Services (HHS) put together the Ransomware and HIPAA Fact Sheet to help healthcare professionals take proactive steps to ensure their businesses are not easily attacked and what to do should an attack occur. Becoming familiar with the fact sheet is imperative to prevention and recognizing a ransomware related HIPAA breach.
The fact sheet states:
“Whether or not the presence of ransomware would be a breach under the HIPAA Rules is a fact-specific determination. A breach under the HIPAA Rules is defined as, ‘…the acquisition, access, use, or disclosure of PHI in a manner not permitted under the [HIPAA Privacy Rule] which compromises the security or privacy of the PHI.’ See 45 C.F.R. 164.402.
When electronic protected health information (ePHI) is encrypted as the result of a ransomware attack, a breach has occurred because the ePHI encrypted by the ransomware was acquired (i.e., unauthorized individuals have taken possession or control of the information), and thus is a ‘disclosure’ not permitted under the HIPAA Privacy Rule.
Unless the covered entity or business associate can demonstrate that there is a ‘…low probability that the PHI has been compromised,’ based on the factors set forth in the Breach Notification Rule, a breach of PHI is presumed to have occurred. The entity must then comply with the applicable breach notification provisions, including notification to affected individuals without unreasonable delay, to the Secretary of HHS, and to the media (for breaches affecting over 500 individuals) in accordance with HIPAA breach notification requirements. See 45 C.F.R. 164.400-414.”
The Ransomware and HIPAA Fact Sheet also provides preventative security measure recommendations based on the HIPAA Security Rule. These include putting together a security management process, creating procedures to protect against malicious activity, providing user training on software protection so the user can help report any suspicious activity, and implementation of controls for accessing ePHI. It also discusses the importance of a thorough risk analysis.
As with most malicious software activity, and with ransomware in particular, one of the best ways to thwart an attack is to be educated on the risks. The ransomware and HIPAA Fact Sheet is a great tool for becoming more familiar with ransomware and its implications. Utilizing a HIPAA certified I.T. company in conjunction with the information provided by HHS can help lessen a healthcare organization’s ransomware risk significantly. Data Fast Solutions is HIPAA I.T. certified and can ensure that your ePHI is safely protected from ransomware and other malicious software.
As busy healthcare professionals focus on their core business of patient care, smaller offices tend to be more vulnerable to HIPAA violations. A recent survey by NUEMD revealed that only 40% of 927 respondents were aware that OCR HIPAA Audits were even planned to take place. The majority of respondents to the survey had 1 to 10 providers.
Although HIPAA requires a HIPAA Security Officer and a HIPAA Privacy Officer be appointed, smaller offices are less likely to do so. In fact, even though the officers are required, the NUEMD survey found that only 53% of offices had security officers and only 54% had a privacy officer. As the survey points out, a compliance plan is the first step in making sure that HIPAA guidelines are followed and 70% of respondents claimed to have such a plan. However, simply having a plan is not beneficial unless thorough training for the compliance plan is also done.
In addition to compliance plans, the NUEMD survey also found that although HIPAA requires electronic devices containing personal health information (PHI) to be cataloged, a majority of small healthcare offices were not adhering to this requirement. Yet, patient and staff communication via mobile, email, texting and social media is taking place. Training for new and existing employees on overall compliance and on-going training on the use of all technology in a HIPAA compliant manner is important.
Larger healthcare offices are not immune. Although larger healthcare providers usually have robust I.T. departments, this doesn’t always prevent them from having some of the same issues found in smaller offices. Often, smaller healthcare practices may not be aware that lots of time and money is not necessary when it comes to their healthcare I.T. In fact, small I.T. companies may be their best option for assistance in HIPAA compliance. Companies like Data-Fast Solutions have the same technology as large I.T. firms but are much more agile in their responsiveness and ability to monitor HIPAA I.T. related issues more cost effectively.
In summary, for small healthcare practices, having a HIPAA compliance plan in place and working the plan through training and follow-up communication can help a smaller practice avoid time-consuming and costly HIPAA related issues later. Having a HIPAA certified I.T. professional company like Data-Fast Solutions to assist with I.T. compliance and provide on-going I.T. support is key. This can leave smaller healthcare practices the time to focus on patient care.
Business Associate (BA) data breaches are a constant threat in healthcare. No healthcare organization operates completely on its own and having a signed business associate agreement (BAA) in place does not guarantee that a BA breach will not occur. However, there are steps that can be taken to minimize risk and lessen the overall effect of a breach.
Security Risk Assessment
Health and Human Services has guidelines on security risk assessment which can be found at:
As stated in their guidance, it is intended to provide clarification, but is not intended to be a “one-size-fits-all blueprint”. Each organization is unique and a risk assessment should be approached as thoroughly as possible based on the specific needs of the business. The risk assessment must be documented each time it is conducted and an assessment should be made anytime the policies or procedures within the healthcare organization or a business associate’s organization are updated.
Policies and Procedures for Protection of ePHI
Clear, concise policies and procedures for the protection of ePHI should be well documented to provide employees and business associates with instruction on how to protect ePHI. They should be easily accessible and, ideally, should be presented in a training environment to ensure ePHI is well protected by anyone in the business who utilizes ePHI.
Training on the use of ePHI with all parties involved should be conducted on a regular basis for new employees and business associates. Training for all employees and business associates should occur as the needs of the business change in any aspect such as the implementation of new software or with regard to any new HIPAA compliance rules and regulations.
When a Breach Occurs
If a business associate experiences a breach in data, it is imperative that a procedure for notification is in place and used as quickly as possible once a breach is recognized. Health and Human Services provides thorough guidelines on the reporting of a breach by a healthcare organization, or their business associates, which can be found here:
This is a high-level view of how to manage a breach, prior to, and after, one may occur with a business associate. Basically, the same way a healthcare organization would address an ePHI breach in its own facility is the same way it should be addressed with the business associate. If a business associate can not meet the requirements of the healthcare entity’s ePHI policies and procedures, a BAA should not be executed with that company.
The role of information technology in healthcare has had a major impact on patient care. Healthcare technology has allowed innovative, instant, collaboration for healthcare professionals throughout the world. Important health-related data can be shared within seconds and has led to life-saving procedures. It has also brought about telehealth, or telemedicine, which is a way to reach patients who may not otherwise have access to quality care. Or, as a convenient way to allow patients an alternative to traditional face-to-face check-ups in a doctor’s office. Many large corporations have implemented telehealth for their employees, and their families, who may be suffering from minor ailments.
As defined by the U.S. Department of Health and Human Services, telehealth is "the use of electronic information and telecommunications technologies to support and promote long-distance clinical health care, patient, and professional health-related education, public health and health administration. Technologies include videoconferencing, the internet, store-and-forward imaging, streaming media, and terrestrial and wireless communications." As with all other forms of electronic personal health information (ePHI), telehealth technology should be HIPAA compliant.
The HIPAA guidelines for telehealth were set forth for any healthcare professional or organization who provides remote services to patients and requires:
- Only authorized users should have access to ePHI
- A system of secure communication should be implemented to protect the integrity of ePHI
- A system of monitoring communications containing ePHI should be implemented to prevent accidental or malicious breaches
It’s important that SMS, Skype, or email, not be used to conduct telehealth activities. As has been noted in previous Data-Fast Solutions blogs, when electronic personal health information (ePHI) involves other parties, there must be a Business Associate Agreement (BAA) on file. The BAA must outline ways in which ePHI is protected and allow audits of the system used to store ePHI.
When using SMS, Skype, or email, copies of information sent via these methods are kept on the service providers’ servers. The companies providing these services would not enter into a BAA, so using them would be a breach of HIPAA regulations and therefore is not an option.
In order to conduct telehealth and be HIPAA compliant, only secure, encrypted messaging should be used. In addition to messages, encrypted data such as images, documents, and videos can be viewed through user-friendly apps. Only healthcare professionals, their patients, and other covered entities would have access to them through secure, authorized logins. Since the data is encrypted it is rendered unreadable or unusable outside of the private network.
As technology continues to evolve, telehealth can become a more viable option for larger parts of the population. With the ability to utilize a technologically safe, secure environment to receive medical attention, it is possible to increase wellness while decreasing the spread of illnesses that can occur in hospitals and doctor’s offices.
Safeguarding electronic Personal Health Information (ePHI) can be done in many ways technologically. However, it's often human error that can cause a breach to occur. If a device containing ePHI is lost or stolen and it doesn't have proper encryption or access protection, all of the data on the device is in jeopardy. A recent settlement between the U. S. Department of Health and Human Services Office for Civil Rights (OCR) and MAPFRE Life Insurance Company of Puerto Rico for $2.2 million was due to human error. According to a breach report filed with OCR by MAPFRE, a USB data storage device was stolen from their I.T. department and there were no safeguards in place to keep the names, dates, and social security numbers of over 2,200 individuals from being compromised. MAPFRE implemented a corrective action plan in addition to the settlement.
A thorough, monthly, risk analysis of HIPAA-related data can help prevent a corrective action plan from having to be implemented. In an article, How to Reduce Human Error and Prevent HIPAA Breaches, published in the "HIPAA Journal", spokesperson for the OCR, Rachel Seeger stated that "Human error increases risk when there are already vulnerabilities in place." No technological advances made, to date, have been able to compensate for human mistakes when it comes to sensitive data.
In conjunction with risk analysis, training new employees and conducting on-going training of existing employees can help thwart a data breach. According to the HIPAA Journal training should include:
Additional, more specific, training based on the needs of your particular healthcare organization can help ensure that a data breach from human error will not occur. For example, in offices that utilize marketing via social media and other types of advertising, patient privacy should always be first. Only those patients who provide consent for their photos, or other personal data, can be used.
As was the case with MAPFRE Life Insurance Company, even data that is not transferred out of a facility is still left vulnerable to theft. Having physical safeguards in place within an organization such as keeping sensitive data under lock and key is one way to keep them contained. Implementing technology such as a remote wipe-out of stolen data isn't always effective if a theft is not reported immediately.
Technology is only as good as the person utilizing it. There will always be human error in technology but through continual risk analysis and training, the mistakes can be kept to a minimum and contained.