Securing Patient Portals
What you need to know to comply with HIPAA
Omnibus and Meaningful Use
Brian Selfridge, Partner, Meditology Services, LLC
6/3/15
2
Brian Selfridge, Meditology
• 12+ years experience in healthcare IT security
and compliance leadership
• Previously CISO of AtlantiCare and healthcare
security practice at PricewaterhouseCoopers
• Published author, certified CISSP and Info
systems security and info assurance by CNSS & NSA
• Leads Meditology’s IT Risk Management
practice
Meditology is dedicated to delivering expertise and
leadership in information privacy and security, compliance,
6/3/15
3
Blake Sutherland, Trend Micro
• 15+ years experience in security
• Helped to bring Cloud Security to the
forefront at Third Brigade – acquired by Trend Micro
• Experience with HITRUST
Trend Micro Incorporated, a global leader in security so<ware, strives to make the world safe for exchanging digital informaDon.
Our innovaDve security soluDons for consumers, businesses and governments protect informaDon on mobile devices, endpoints, gateways, servers and the cloud.
6/3/15
4
Agenda
• Introductions
• Healthcare Industry Trends
• Incentives & Penalties
• Patient Portal Security Requirements
• How to Address Security Requirements
• Trend Micro Security for Patient Portals
HEALTHCARE INDUSTRY TRENDS
5
Healthcare Industry Trends
• The move to 3rd party hosted applications is shifting
security administration, but not the risk
• Market and regulatory pressures are driving rapid portal
adoption
• Mandatory breach notification under HITECH is
increasing visibility for data loss events
• Oversight from federal and state agencies is ramping up
o OCR
o CMS
o State Attorneys General
6/3/15
INCENTIVES & PENALTIES
7
Incentives & Penalties
• Patient Portals and Meaningful Use (MU)
o
HITECH provides
$19.2 billion
in incentive
payments to promote EHR adoption
o Requires “certified” EHR technology and deployment of
a secure patient portal
o Incentive payments scale from individual providers to
large health systems
o MU also establishes penalties in future years for
providers that have not met requirements
6/3/15
Incentives & Penalties
(continued)
• HIPAA / HITECH / Omnibus
o
Penalties can be up to
$1.5 million
per year per
violation
6/3/15
9
Covered En*ty OCR Fine
New York and Presbyterian Hospital (NYP) $4,800,000
Columbia University (CU) $4,800,000
WellPoint Inc. $1,700,000
Affinity Health Plan, Inc. $1,215,780
Idaho State University $400,000
Shasta Regional Medical Center $275,000
Skagit County $215,000
PATIENT PORTAL SECURITY
REQUIREMENTS
6/3/15
6/3/15
11
Portal Security Scope
12
6/3/15
Risk Analysis AdministraDve
Physical Technical
HIPAA Security Rule
Secure Messaging Download Data PaDents
Reminders EducaDonal Materials
ARRA / MU PaDent Portal Requirements
(1)
MU & Portal Security Myths
13
6/3/15
Source: The Office of the Na-onal Coordinator for Health Informa-on Technology (ONC), 2014.
HOW TO ADDRESS SECURITY
REQUIREMENTS
6/3/15
Risk Assessment Process
• There is no single prescriptive
method that guarantees compliance with the Security Rule, but a typical security risk assessment includes the following steps:
o Assess risks and identify potential threats to the confidentiality,
integrity and availability of ePHI.
o Respond to risks by creating a Corrective Action Plan and prioritizing remediation efforts.
o Continuously monitor changes that may affect security controls and
update the Corrective Action Plan. 15
6/3/15
Assess Risks
Respond to Risks Monitor
Determination of Risk
16
6/3/15
Relevant Threats
Internal and External VulnerabiliDes
Degree of harm that may occur
Likelihood that harm will
Corrective Action Plan
17
6/3/15
Correc*ve Ac*on Plan
• Start & End Date • Owner
• Milestones
RemediaDon Priority Degree of Risk
Threats & VulnerabiliDes
Monitor Risks
18
6/3/15
Monitor Risk
Key Performance
Indicators
Changes to systems, environment
Compliance
CAP Progress
Sharing the Risk
19
6/3/15
“Third-‐party snafus are adributed for 41 percent of breaches.”
“Over the past three years, the number of security incidents at
companies adributed to partners and vendors has risen—increasing from 20% in 2010 to 28% in 2012.”
“76% of data breaches analyzed by TrustWave resulted from a third-‐party which introduced the security deficiencies that were ulDmately exploited.”
Technical Vulnerabilities
• Identify potential vulnerabilities to the patient portal
through technical testing including:
o Application-level vulnerabilities
o Supporting infrastructure and platforms
o Web servers
o Databases
o Access and authentication
• Assess against standards such as HITRUST and the
Open Web Application Security Project (OWASP)
• Conduct routine scanning to identify vulnerabilities over
time
20
21
6/3/15
Source: OWASP, 2014
Technical Vulnerabilities
• Encryption Requirements
o Stage 2 of MU specifically requires addressing the
encryption and security of data stored and transmitted via the certified EHR technology
o Verify encryption is in place and actively protecting ePHI
• Encryption Solutions
o Encrypt data at rest including in backups, laptops, and
mobile devices
o Use Extended Validation (EV) SSL certificates to secure all
transactions and communications on the portal and to visually indicate to visitors that the site is secure.
22
Blake Sutherland
What to look for in a PaDent Portal
Security SoluDon
Trend Micro Security for PaDent Portals
24 Patient Portal
web app
On-Premise Data Center
Third Party / Cloud Hosted Data Center
Patient Portal Landscape
Medical Devices
EHR EHR
Billing / Finance
Billing AnalyDcs
AnalyDcs Lab
Claims Claims
Pharmacy
Home Health Home
Health
Human Resources
Human Resources
EHR
PaDent Portal
Lab
PaDent Portal
Patient Portal Vendors
• Epic MyChart
• Cerner Patient Portal
• RelayHealth Portal
• McKesson My Care Plus
• Intuit Health Portal
• AllScripts Portal
• eClinicalWorks Portal
• Jardog’s FollowMyHealth
• NextGen
Security for Patient Portals Web site: DS for Web Apps Data: SecureCloud
Data Center: Deep Security
Advanced Threats: Deep Discovery Endpoints: OfficeScan, Email Encryption, InterScan Web Security, InterScan Messaging Security, ScanMail
RecommendaDon Reminder
Trend Micro can help.
Request your Patient portal health check today!
25
webappsecurity.
trendmicro.com
You need a Patient Portal security approach that addresses: • Routine risk assessment and corrective action tracking • Comprehensive vulnerability detection
• Actionable insight on vulnerabilities for faster mitigation
• Security for your entire ecosystem – including
patient portal, data center, medical devices, end user devices and sensitive data
Questions?
• Thank you for your time
6/3/15
27 For more information visit
webappsecurity.trendmicro.com Brian Selfridge
Meditology Services
Blake Sutherland
Trend Micro
© 2014 Meditology Services, Atlanta, GA. All Rights Reserved
