HIPAA Training – Part III
Goals
•
•Learn simple ways to protect information.Learn simple ways to protect information. •
•Learn how to continually give training.Learn how to continually give training.
•
Policy
•It’s the law.
•The doctor has to sign all of them.
•The privacy official’s name must be on them.
•Must be reviewed each year and proof of this must be documented.
Procedure
•How you apply the law to this office.
•Writing procedures is an everlasting process of reviewing and updating.
Why Review and
Update the Procedures?
•New breaches are discovered. •New technology is used.
•Office changes occur such as remodeling. •What you’re doing to protect PHI.
Procedures
•Be general.
Training
•Have documented meetings.
•Each employee, including the doctor, must sign their own name on the Training Register.
•If the doctor does not allow training, then the doctor is liable for all fines.
Training
•Some discussion topics:
• Implementation of Policies • Notice of Privacy Forms
• General Penalty for Failure to Comply with Requirements and Standards
Training
•More discussion topics:
• Breaches
• Office Procedures Regarding PHI • Complaints Regarding PHI
• Handling Patients’ Restrictions • Medical Release Forms
• Front Office Procedures • Back Office Procedures • Computer Security
Training
Register
What Do You Have to Do to Protect Information and to Avoid the Fines?
•Understand two basic questions:
• Continually have training. • Keep records.
Keep Records
•Every time you have training you must record it. •This is the government.
HIPAA Security
•Computers were required to be secured by April of 2005.
• Password • Hackers
OBJECTIVES
•Understand HIPAA Security Rule
HIPAA Security Standard
•What is the purpose?
• Establish a standard for health care providers with regards to treatment of patient health information
• Give patients more control and access to their medical information
• Secure protected health information (PHI) transmitted, stored, or maintained in electronic format from real or potential threats of disclosure or loss
HIPAA Security Standard
•General
• Consistent with the Privacy rule in that the Security part of the Privacy rule requires that “appropriate” security be applied to all PHI in all events
• Focuses more on “what” needs to be done, rather than “how”. • Cost of implementation is a factor, but not a preclusion.
• Cost, size, technical infrastructure and criticality of potential risks are factors, allowing for a flexible approach.
• Sets out processes for decision-making, but does not make decisions; remains ‘technology neutral’.
HIPAA Security Standard
•What the rule does?
•Ensures the confidentiality, integrity, and availability of all
electronic PHI a covered entity (CE) creates, receives, maintains, or transmits.
• Protects against any reasonably anticipated threats or hazards to the security or integrity of such information
• Protects against any reasonably anticipated uses or disclosures of such information that are not permitted or required
Privacy vs. Security
•Privacy
• Individuals rights to control access and disclosure of their protected or individually identifiable healthcare information
• Establish authorization requirements • Establish individual rights
• Establish regulations for use or disclosure of PHI
•Security
• Establishes minimum level of security that covered entities must meet
• Adopts standards for the security of ePHI to be implemented by covered entities
Three Pillars of Data Security
Confidentiality Integrity Accessibility
Data or information is not made available to unauthorized persons or processes Data or information has not been altered or destroyed in an
unauthorized manner
Data or information is accessible and usable upon demand
by an authorized person
Security Rule Organization
Safeguards •Administrative
• Administrative actions, policies, and procedures, to manage, the selection, development, and implementation, including the maintenance of security measures to protect electronic health information and to manage the
conduct of the covered entity’s workforce in relation to the protection of that information.
•Physical
• Security measures to protect a covered entity’s electronic information
systems and related buildings and equipment from environmental hazards and unauthorized intrusions.
•Technical
• The technology and policy and procedures for how to protect electronic protected health information and control access to it.
Electronic Data Security
•Electronic Data Security:
• The generic name for the tools designed to protect data and to prevent intrusions.
•Principle of Easiest Penetration:
• An intruder must be expected to use any available means of penetration. This is not the most obvious means, nor is it one against which the most solid defense has been installed.
•Principle of Adequate Protection:
• Computer hardware and software must be protected to a degree consistent with their value. Electronic data never loses its value, unless the
Security Threats
•Virus •Spyware •Adware •Worms •Trojan Horse •Phishing (pharming) •War Dialing •Social EngineeringSocial Engineering
•Preying on the Best Qualities of Human Nature:
• The desire to be helpful
• The tendency to trust people • The fear of getting into trouble
A successful social engineer receives information
A successful social engineer receives information
without raising any suspicion as to what they are
without raising any suspicion as to what they are
doing.
doing.
Social Engineering
•
•ImpersonationImpersonation •
•Important user Important user
•
•ThirdThird--party authorization party authorization
•
•Technical support Technical support
“
“There are system problems and There are system problems and you will have to log me on to
you will have to log me on to
check the connection
Recognize the Signs
•In Person
• May appear as an employee or • Dressed in a uniform.
• Part of the cleaning crew.
• Roams without raising suspicion.
•Dumpster Diving
•Shoulder Surfing
• Shoulder surfing is using direct observation techniques, such as looking over someone's shoulder, to get information.
Social Engineering
•Refuse to give contact information •Rushing
•Name-dropping •Intimidation
•Small mistakes
•Request confidential information
What can you do?
Ask Questions!
•Correct spelling of the person’s name? •Number where you can return the call? •Contact information?
•Why the information is needed. •Who authorized the request.
• Verify the authorization
And Do It !!!
Where Do Intruders Come From? Who are these threat agents?
•Teenage pranksters •Hacker junkies
•Disgruntled employees •Disgruntled patients •Competitors
•Terrorists (disruption of services) •Criminals (selling information)
Physical Vulnerabilities and Access
•Being aware of your surroundings!
• Where’s my computer located? • Is anyone watching me?
• Is the hallway door open?
• Is the monitor visible from the window?
• Is the computer visible from the patient waiting area? • Are the servers in locked rooms or cabinets?
• Does the cleaning crew have access to the computers? • Does the screen saver activate when idle?
• Do I log out before leaving the room? • Do I use my PC for a night light?
Password Vulnerabilities
If you think it’s weak, then it is weak
•Passwords
•First line of defense against unauthorized access to your:
• Computer, Files, Network Connections, Key to your electronic identity •Do Not Use:
• Any dictionary words, any proper names, common phrases, obvious passwords, keyboard words, let a website save it, use the same one. •What to use:
• At least eight characters, at least one capital letter, At least one number, at least one special character, one you can remember, change them regularly
Your Account Is Only As
Secure As Its Password
•Recommendation
• 120 day rotation
• Don't let others watch you log in. • Change your password often.
• Don’t write your password on a post-it note
• Don’t attach it to your video monitor or under the keyboard.
Password Construction
•It can’t be obvious or exist in a dictionary. • Every word in a dictionary can be tried within
minutes.
•Don’t use a password that has any obvious significance to you.
Password Standard
•Eight character minimum and should contain at least one of each of the following characters:
• Uppercase letters ( A-Z ) • Lowercase letters ( a-z ) • Numbers ( 0-9 )
Password Management
•Its OK to share offices, equipment and ideas, but...
Do not share your password
Do not share your password
with anyone, anytime!
Safeguard Your
Strong Password
• Be careful about typing your password into a strange computer.
• Anti-virus protection enabled? • Owner trustworthy?
• Keyboard logger running to record your keystrokes?
• Who was the last person to use that computer?
• Do not use the automatic logon feature in Microsoft.
E-mail Vulnerabilities
•Emails
• Are you opening Pandora's box?
•Basic method of communication to transfer: • Messages, Files, Programs
•What to look out for:
• Extensions (.xls, .doc, .php, .ppt, .exe, .vbs, .bin, .com, pif); Suspicious Subjects Lines; I love you/My
daughter’s pictures; You have won/Free Gift; Funny, Humorous, etc.; Look alike sites; Chain Letters; Web Links; Attachment not expected
EMAIL Policy
•Permissible uses:
• Entity’s permissible uses?
•Prohibited uses:
• Entity’s prohibited uses?
ALL MESSAGES SHOULD BE
ALL MESSAGES SHOULD BE
CONSIDERED PUBLIC!
CONSIDERED PUBLIC!
Web Browsing Security
•Web Surfing
• Active content and viruses or other malicious software • Security risks in the PC and MAC versions of Internet
Explorer and Netscape browsers
Visiting Internet Sites
•Be careful about providing personal, sensitive information to an internet site.
•Be aware that you can get viruses from Instant Messenger-type services.
Privileges and Responsibilities
•Use of your company computer account is a privilege.
• Along with the privilege to use company network resources come some responsibilities.
• Remember that Internet traffic is logged, monitored, and saved
Backups
•Back your computer up every night •Take the back up offsite
So How Do We Start?
•Be aware!
•Learn, practice and adopt good security habits. •Report anything unusual.
Security is 90% You and 10% Technical Security is 90% You and 10% Technical
Absolute vs. Acceptable
Levels of Risk
•“Absolute protection” from risk is an impossibility
•“Acceptable level” of risk is a more realistic approach to managing risk
Keep an Inventory
•Know exactly what equipment you have by listing an inventory.
• What kind of hardware do you have? • What kind of software do you have?
Keep an Inventory
•Record:
• When you began using it • When you stopped using it • When you upgraded
