Bit by Bit Computer Consultants

Suffering a data breach has a $7M+ price tag. Does your organization have visibility into the security posture of its business ecosystem?

Your Biggest Security Blind Spot:

Why Third Party Breaches Are On The Rise

Hi Tracey,

It only takes one third party breach for a hacker to reach your network -- and most companies have tens of thousands of vendor relationships.

The PWC 2015 US State of Cybercrime Survey found 23% of organizations do not evaluate third parties at all, 19% of CIOs are not concerned about supply-chain risks, and only 16% of respondents evaluate third parties' security more than once a year.

Download SecurityScorecard's latest white paperWhy Third Party Security Breaches Are On The Rise to learn:

·         Why 70% of attacks occur as a result of third party security breaches

·         The weakest link 'attack methodology'

·         Why outsourced business resources means outsourced risk

Cybersecurity and the increasing risk present in third parties are the subject of 4 out of the 6 financial services cyber trends in Booz Allen Hamilton's 2016 annual report.

Download the white paper now, and find out why third parties are the number one risk.

For more information on how your organization can gain operational command of 3rd party risk, and visibility into the security posture of your entire business ecosystem -- contact Bit by Bit today:

(212) 691-8081

Sales@bitxbit.com

Robert Blake
Bit by Bit Computer Consultants
721 N Fielder Rd. #B
Arlington, Texas 76012
Direct 817.505.1257

Read my Blog at www.3boffice.com

twitter.com/robertblakejr

http://www.linkedin.com/in/robertblake

Skype - robertblakejr

10 Common HIPAA Myths and Misconceptions

Health Insurance Portability and Accountability Act (HIPAA) compliance has become a top concern among doctors practicing in the United States. According to the Department of Health and Human Services (HHS), more than 36,000 HIPAA complaints have been investigated from April 2003 to June 2017.

But not everything you hear about HIPAA is true. Today, we're going to explore some of the most common HIPAA myths and misconceptions

#1) Written Authorization is Always Required When Disclosing PHI

Normally, doctors must obtain the patient's consent via a written authorization form when disclosing his or her Protected Health Information (PHI) to third-party entities, as per the HIPAA Privacy Rule. However, there are certain exceptions to this requirement.

Doctors, for instance, can disclose PHI without the patient's written authorization if the disclosure is used to facilitate healthcare services, treatment or payment. Additionally, doctors are allowed to disclose a patient's PHI to law enforcement without written authorization if they believe the patient may cause harm to themselves or others. For all other situations, however, written authorization is typically required when disclosing PHI to third-party entities.

#2) You Don't Have to Report Small Breaches

Just because a PHI breach is small doesn't mean you can ignore it. The HHS requires doctors and covered entities to report all PHI breaches affecting fewer than 500 individuals to the HHS Secretary within 60 days of the end of the year in which the breach was initially discovered.

For larger breaches affecting 500 or more individuals, covered entities must notify the HHS Secretary without unreasonable delay and no later than 60 days from when the breach was initially discovered. All breach notifications -- those affecting fewer than 500 individuals and those affecting more than 500 individuals -- must be submitted manually using the online portal on the official HHS.gov website.

#3) Patient Sign-In Sheets Violate the Privacy Rule

If patient sign-in sheets were a violation of the Privacy Rule, we would see significantly more fines levied against doctors. From family-owned healthcare practices to large hospitals, countless healthcare providers use sign-in sheets. They are typically located at the front desk in the lobby, where patients sign their name to check in.

Keep in mind, however, that sign-in forms are only acceptable when they contain a limited amount of information about the patient. Requesting the patient's name, date and appointment time is perfectly fine. But if the sign-in sheet requires the patient's reason for visiting, it could be considered a violation of the Privacy Rule. Stick with basic information on your practice's sign-in sheets to avoid a HIPAA violation.

#4) Doctors Must Provide All Patients With a Copy of Their Medical Records

The Privacy Rule does not require doctors to provide all patients with a copy of their medical records. It does, however, give the patients the right to request a copy of their medical records. Assuming the patient follows the required steps -- and the doctor does not believe the medical records will harm the patient's health -- the doctor must comply with the request.

If the doctor denies the patient's request for medical records, the doctor must notify the patient in writing. If the doctor does not comply, the patient may file a complaint with the Office for Civil Rights (OCR).

#5) Patients Can Sue Doctors for HIPAA Violations

Some doctors and covered entities wrongfully assume that patients can sue them for violating HIPAA. While patients can file a complaint with the OCR -- and the OCR may follow up by investing the incident to determine if fines or corrective action is required -- patients can not sue for HIPAA noncompliance.

With that said, some state laws allow patients to sue doctors for other reasons, such as breach of doctor-patient confidentiality or invasion of privacy.

#6) Doctors Cannot Disclose PHI to Friends

Family members aren't the only ones who can receive updates on the status of a patient's healthcare; friends can receive updates as well. This goes back to the Privacy Rule, which allows doctors and covered entities to disclose a patient's PHI without written authorization if the disclosure is used to facilitate healthcare treatment, services or payment.

A doctor, for instance, may inform a patient's roommate about the patient's medicine dosage. However, a doctor may decline to disclose PHI to a patient's friend if the doctor believes the patient objects to this disclosure.

#7) Password Protection is Sufficient for Electronic Devices Containing ePHI

Conventional passwords are becoming increasingly less effective at securing electronic devices. According to a 2016 Verizon Data Breach Investigations report, an overwhelming majority (63%) of data breaches are caused by weak or stolen passwords. Therefore, password protection alone isn't sufficient for protecting electronic devices on which Electronic Protected Health Information (ePHI) is stored.

The HIPAA Security Rule requires covered entities to protect ePHI using "reasonable and appropriate" administrative, physical and technical safeguards.

Technical safeguards are technologies like unique user identification, emergency access, automatic logoff, encryption, authentication and password protection. Physical safeguards, on the other hand, are physical measures like maintenance records, locked doors, video surveillance, facility security plans, and media disposal. Administrative safeguards are policies and procedures designed to protect ePHI from disclosure.

#8) Encryption is a Required Specification of the Security Rule

Encryption is one of the most effective ways to secure data, leading many doctors to believe it's a required specification of the Security Rule. The HHS debunks this myth on the frequently asked questions section of its HIPAA website, stating that encryption is actually an addressable specification.

So, what does this mean exactly? Addressable specifications, including encryption, are only required under the Security Rule when the specification is deemed reasonable and appropriate in securing ePHI following a risk assessment. If a doctor conducts a risk assessment and determines that encryption is beneficial, he or she must then implement encryption as a safeguard.

#9) Covered Entities are Liable for Business Associates

Another HIPAA myth believed by doctors is that covered entities can be held liable for the actions of a business associate. If a business associate fails to implement the necessary safeguards to protect ePHI from disclosure, for instance, the doctor may assume that he or she is at fault. As a result, some doctors invest countless time and resources into monitoring their business associations, checking to ensure they comply with HIPAA.

But HIPAA does not require covered entities to monitor the compliance or noncompliance of their business associates, nor can covered entities be held liable for such violations. The only requirement is for doctors to create a business associates agreement (BAA) when giving third-party entities access to PHI.

#10) Hackers Only Target Financial Data

Finally, some doctors believe hackers won't target their medical practice simply because they don't have valuable data, so they place HIPAA compliance on the back burner.

According to Forbes contributor Mariya Yao, the average cost of stolen credit card numbers on the black market is just $0.25, while social security numbers are even cheaper at $0.10. Electronic health records (EHR), however, can fetch hundreds or thousands of dollars. Besides, HIPAA violations can occur regardless of whether data was stolen.

As you can see, there are plenty of myths and misconceptions surrounding HIPAA. By understanding the nuances of HIPAA, doctors can improve the privacy for their patients while also minimizing the risk of fines and corrective action plans stemming from violations.

For help with implementing security or other technology solutions contact:

Robert Blake
Bit by Bit Computer Consultants
721 N Fielder Rd. #B
Arlington, Texas 76012
Direct 817.505.1257
Mobile 972.365.7010

Bit by Bit Website

twitter.com/robertblakejr

http://www.linkedin.com/in/robertblake

Skype - robertblakejr